Cybercrimes in Brazil: Applicable Laws and Penalties

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazilian law criminalizes conduct such as unlawful access to a device, electronic fraud, and digital fraud. Law 12.737/2012 and Law 14.155/2021 increased the penalties for cybercrimes, including imprisonment in aggravated cases.

The Landscape of Cybercrime in Brazil

Cybercrimes, also called digital crimes or computer crimes, are one of the biggest legal concerns today. According to the Brazilian Public Security Yearbook (Anuário Brasileiro de Segurança Pública), reports of electronic fraud have risen significantly in recent years, driven by the rapid digitization of banking and government services.

Brazil’s criminal law has been updated several times to keep pace with technology, creating specific offenses for conduct that takes place in the digital environment.

Main Laws on Cybercrime

Carolina Dieckmann Law (Law 12.737/2012)

Law 12.737/2012 added Article 154-A to Brazil’s Penal Code, which criminalizes unlawful access to a computing device. The offense consists of breaking into someone else’s device, whether or not it is connected to the internet, by circumventing a security mechanism, in order to obtain, alter, or destroy data, or to install vulnerabilities to gain an unlawful advantage.

The base penalty, under the wording Law 14.155/2021 gave to art. 154-A of the CP (Brazilian Penal Code), is imprisonment (reclusão) of 1 to 4 years and a fine (the original penalty under Law 12.737/2012 was detention of 3 months to 1 year). It may be increased by 1/3 to 2/3 if it results in economic loss, and by 1/3 to 1/2 if committed against public authorities.

Law 14.155/2021, Electronic Fraud

This law was an important milestone because it created the offense of electronic fraud (art. 171, §2º-A of the CP), punishable by imprisonment of 4 to 8 years and a fine. Electronic fraud occurs when the victim is deceived through information provided over the internet or by phone, and is misled by contact through social media, fraudulent e-mails, or any other electronic means.

The penalty is increased by 1/3 to 2/3 if the crime is committed against a public servant or by using a server kept outside Brazilian territory.

Marco Civil da Internet (Brazil’s Internet Civil Framework) (Law 12.965/2014)

Although it is not a criminal statute, the Marco Civil lays important groundwork for investigating cybercrimes, such as requiring providers to retain connection and access records.

Most Common Cybercrimes

The offenses most frequently charged in the digital context include:

• Electronic fraud (art. 171, §2º-A, CP), scams via PIX (Brazil’s instant payment system), fake links, social engineering
• Unlawful access to a device (art. 154-A, CP), hacking, malware installation
• Theft by electronic fraud (art. 155, §4º-B, CP), taking money from digital accounts
• Digital extortion (art. 158, CP), ransomware, sextortion
• Digital identity fraud (art. 307, CP), fake profiles used to gain an advantage
• Online defamation and insult (arts. 139-140, CP), offensive posts on social media
• Digital stalking (art. 147-A, CP), repeated harassment by electronic means

Investigation and Jurisdiction

Cybercrime investigations in Brazil are led by specialized cybercrime police units, located in the main state capitals. The Federal Police handle crimes under federal jurisdiction, such as fraud against the financial system and transnational crimes.

As for territorial jurisdiction, the STJ (Brazil’s Superior Court of Justice) has held (CC 156.284/PR) that it is set by the place where the offense was completed, which is generally the victim’s home. This makes access to justice easier, since the victim can file a report in his or her own city.

Preserving Digital Evidence

The victim of a cybercrime should take immediate steps to preserve evidence:

1. Take screenshots with the date and time visible
2. Save the original URLs, e-mails, and messages
3. Have a notarial record (ata notarial) drawn up at a notary office (cartório) to give the evidence public authenticity
4. File a police report (boletim de ocorrência) as soon as possible
5. Do not delete conversations or interactions with the suspect

Recovering Funds and International Cooperation

The biggest concern for most cybercrime victims is getting their money back, especially in cases involving PIX and electronic transfers. The Central Bank of Brazil regulated the Special Return Mechanism (Mecanismo Especial de Devolução, MED) through BCB Resolution No. 103/2021, which allows the recipient’s bank to block and return funds moved in cases of fraud or operational failure. You should notify the financial institution as quickly as possible, because the funds can be scattered across several accounts within minutes, making recovery impossible after a certain point.

Alongside the administrative request, the victim may file a lawsuit seeking urgent relief to order the freezing of accounts, the freezing of crypto assets held on Brazilian exchanges, and the lifting of the suspects’ bank secrecy. Article 300 of the Code of Civil Procedure allows courts to grant preliminary orders when the right appears probable and there is a risk of harm that would be hard to repair. Case law has accepted fast rulings in well-documented cases, especially those involving large sums or clear signs of an organized criminal group acting repeatedly.

When the offender operates from another country, criminal prosecution requires international legal cooperation. The Department of Asset Recovery and International Legal Cooperation (DRCI), part of Brazil’s Ministry of Justice, coordinates requests for assistance to foreign authorities, making it possible to obtain evidence, locate suspects, and freeze assets abroad. Multilateral treaties, such as the Budapest Convention on Cybercrime, provide an additional legal basis for sharing information between Brazilian authorities and signatory countries.

Frequently Asked Questions

Is a PIX scam a crime? What is the penalty?

Yes. A PIX scam falls under electronic fraud (art. 171, §2º-A of the CP), punishable by imprisonment of 4 to 8 years and a fine. If it is committed against an elderly or otherwise vulnerable person, the penalty is increased.

Can I sue someone who created a fake profile using my name?

Yes. The conduct may amount to identity fraud (art. 307, CP) and, depending on the context, defamation or fraud. In addition to the criminal case, you can seek compensation for moral damages in a civil action.

How do I report a cybercrime?

File a police report at the nearest police station or through your state’s online police station. In many states, you can file the report online. For federal crimes, contact the Federal Police.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.