Digital Crimes in Brazil: Types, Penalties, and How to Report Them in 2026

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Learn about the main cybercrimes defined in Brazilian law and how to report them.

Main digital crimes in Brazil

Brazilian law defines a range of digital crimes: unauthorized access to a computing device (Article 154-A, Penal Code, imprisonment (reclusão) of 1 to 4 years), theft by electronic fraud (Article 155, §4º-B, imprisonment of 4 to 8 years), electronic fraud (estelionato) (Article 171, §2º-A, imprisonment of 4 to 8 years), online stalking (Article 147-A, imprisonment of 6 months to 2 years), and sharing intimate images without consent (Article 218-C, imprisonment of 1 to 5 years).

How to report digital crimes

File a police report (Boletim de Ocorrência) at a police station specializing in cybercrime, or at any police station. Preserve all evidence: screenshots showing the date and time, URLs, emails you received, and your message history. A notarized record (Ata Notarial, prepared at a notary office) gives digital evidence the weight of a public document.

You can also report to SaferNet Brasil (safernet.org.br) for human rights crimes committed online.

You can also report to SaferNet Brasil (safernet.org.br) for human rights crimes committed online.

Protection and prevention against digital crimes

Prevention is the best strategy against cybercrime. Essential measures include: using strong, different passwords for each service, turning on two-factor authentication (2FA) on every account that allows it, keeping your operating system and apps up to date, not clicking on suspicious links in emails or messages, checking that a website is authentic before entering personal or financial data, and never sharing verification codes you receive by SMS. If you fall victim to a financial scam, notify your bank immediately to try to block the transaction. Pix’s Special Return Mechanism (MED) allows funds to be recovered in cases of proven fraud.

Criminal proceedings in Brazil follow the rules of the Code of Criminal Procedure and guarantee the accused the right to a full defense and to adversarial proceedings. The presumption of innocence is a fundamental constitutional principle: no one is considered guilty until a criminal conviction becomes final and unappealable.

A crime victim can seek redress in both criminal and civil court. In the criminal case, the defendant’s conviction may include an obligation to compensate the victim. In the civil case, a lawsuit for property damages and pain and suffering (danos morais) proceeds independently of the criminal case.

Civil liability and compensation

In addition to the criminal case, the victim of a digital crime can seek redress in civil court. You can file a lawsuit for compensation for danos morais (non-pecuniary damages, similar to pain and suffering) and property damages against the person who committed the crime. In cases of personal data leaks, the General Data Protection Law (LGPD, Law 13.709/2018) holds liable any company that failed to adequately protect the data subjects’ information. The victim can file a complaint with the National Data Protection Authority (ANPD) and bring a lawsuit for damages.

For crimes against honor committed online (slander, defamation, and insult), the victim can ask a court to order removal of the offending content and identification of the author, even if the author uses an anonymous profile. The Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law 12.965/2014) provides that application providers must hand over access records upon a court order, making it possible to identify those responsible for unlawful content.

Cybercrime has grown significantly in Brazil. Police units specializing in digital crimes operate in the main state capitals and have technical teams to investigate electronic fraud, system intrusions, and other offenses committed online. Where there is no specialized unit, you can file the police report at any police station or, in many states, online.

International cooperation is increasingly important in fighting digital crime, since many scams are carried out from servers located in other countries. Brazil is a signatory to the Budapest Convention on Cybercrime, which makes it easier to exchange information and cooperate with police in other countries to investigate and punish those responsible.

Frequently Asked Questions

How long until the crime of unauthorized access to a computing device becomes time-barred?

Article 154-A of the Penal Code provides for imprisonment (reclusão) of 1 to 4 years for unauthorized access to a computing device, as worded by Law 14.155/2021. Given the maximum sentence of 4 years, the statute of limitations on the State’s power to prosecute runs out in 8 years under Article 109, item IV, of the Penal Code, counted from the date the offense was committed.

Can people who commit digital crimes from abroad be held accountable?

Yes, in certain circumstances. Article 7 of the Penal Code allows Brazilian criminal law to apply extraterritorially, especially when the crime affects a Brazilian victim or when its effects are felt in Brazilian territory, which is common in online fraud. Brazil is also a signatory to the Budapest Convention on Cybercrime, a treaty that enables international cooperation to investigate and hold offenders accountable.

Does the Marco Civil da Internet require providers to keep access records?

Yes. The Marco Civil da Internet (Law 12.965/2014) requires connection providers to keep connection records for one year and application providers to keep application access records for six months. These records can be requested through a court order, making it possible to identify those responsible for unlawful conduct online, including through anonymous profiles.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.