Cybercrimes in Brazil: Main Offenses and How to Defend Yourself

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The spread of connected devices and digital transactions has widened the field of action for online criminals. Offenses committed in virtual environments are now among the main concerns of Brazilian criminal law. Knowing which offenses apply and what defenses are available is essential if victims are to respond effectively to digital violations.

The Legal Framework for Cybercrimes in Brazil

Brazilian criminal law protects the digital environment through several complementary statutes. Law 12.737/2012, known as the Carolina Dieckmann Law, added Article 154-A to the Penal Code. It makes it a crime to break into another person’s computing device in order to obtain, alter, or destroy data, or to install vulnerabilities in order to gain an unlawful advantage. Under the current wording, the offense is punishable by imprisonment and a fine, with aggravated penalties when the crime is committed against public officials or the administrators of critical systems.

Law 14.155/2021 was a significant step forward. It added paragraph 2-A to Article 171 of the Penal Code, creating the offense of electronic fraud, punishable by four to eight years of imprisonment. The provision covers conduct carried out through social media, fraudulent phone contacts, and messaging apps to deceive a victim and obtain an undue financial gain.

The Marco Civil da Internet, Brazil’s Internet Civil Framework (Law 12.965/2014), rounds out this body of law by requiring providers to retain access logs. This makes it possible to gather evidence in criminal investigations and related civil actions, and it makes the legal system more cohesive in responding to these offenses.

Main Offenses and Their Consequences

Among the most common offenses is digital fraud, carried out through phishing, cloned social media profiles, and fake websites that imitate bank pages or online stores. The offender tricks the victim into handing over financial data or making transfers. This constitutes the crime defined in Article 171 of the Penal Code, with penalties that can reach eight years of imprisonment in its electronic form.

Extortion through data hijacking, commonly known as ransomware, falls under Article 158 of the Penal Code when the offender demands payment to restore access to encrypted files. It can be charged together with the computer intrusion offense in Article 154-A, in which case the penalties are added together. Companies and government agencies are among the preferred targets, although individuals are also frequent victims.

Crimes against honor committed online, such as slander, defamation, and insult (Articles 138 to 140 of the Penal Code), are subject to specific rules on territorial jurisdiction and on the statutory deadline for filing a complaint. In addition, a provider that has been properly notified and fails to remove the unlawful content may be held jointly liable in a civil action under Article 19 of the Marco Civil da Internet.

How to Gather Evidence and Seek Legal Protection

The first step in any defense strategy is to preserve digital evidence immediately. The basic body of evidence includes screenshots showing the date and time, records of conversations, the email addresses involved, and the URLs visited. Tools that authenticate digital documents, such as electronic notarial records (atas notariais) and blockchain registration services, make evidence gathered before filing a lawsuit considerably stronger.

A criminal complaint filed with a police unit specialized in cybercrime sets in motion investigative tools that private parties cannot use on their own, including a court order lifting the confidentiality of telematic data.

Filing a police report, preferably with one of the police units specialized in cybercrime that exist in the states, starts the investigation and allows a court to order providers to hand over data. Providers must keep application logs for only six months under Article 15 of the Marco Civil. That makes it urgent to file the complaint formally, so that the traces are not lost for good.

In civil court, victims can seek compensation for property damage and pain and suffering from the identified offender and, in certain cases, from an application provider that failed to comply with a removal order. An urgent injunction to take down unlawful content can be obtained by showing the unlawful act and the risk of continuing harm. As a rule, you do not need to identify the person responsible first.

Frequently Asked Questions

What is the deadline for filing a police report for a cybercrime?

There is no fixed deadline for filing a police report, but time is of the essence because providers keep data for only a short period. Access logs for internet applications are retained for just six months under Article 15 of Law 12.965/2014. You should therefore file the complaint as soon as possible, so that a court can order the release of this information before it is deleted.

Can an internet provider be held liable for damage caused by third parties?

As a general rule, an application provider is not civilly liable for content posted by third parties until it is notified by a court order to remove the unlawful material, under Article 19 of the Marco Civil da Internet. Once the provider fails to comply with a court order to remove the content, it becomes jointly liable for the ongoing harm to the victim. This opens the door to compensation claims with a broader reach.

Is it possible to identify the person behind a cybercrime committed with a fake profile?

Yes. The offender can be identified through a court order lifting the confidentiality of telematic data, which makes it possible to trace the IP address used when the offense was committed. Using the IP address, the police ask the connection provider for the account holder’s registration data. This allows the person responsible to be identified and criminally charged, even if the crime was committed under a false identity or an anonymous profile.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.