Digital Fraud: How Bank Liability Works in Brazil

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

A bank’s liability for electronic fraud turns on one precise question: did the institution’s security system fail, or was the victim tricked into acting on his or her own? That distinction determines who bears the loss and shapes how an account holder should gather evidence to seek reimbursement.

The growth of digital banking has multiplied financial scams: cloned apps, fake links, fraudulent call centers, and instant transfers obtained through social engineering. Faced with a loss, an account holder’s first question is usually a direct one: will the bank give my money back? Under Brazilian law, the answer is not automatic, but it follows well-settled criteria that separate the situations in which the bank is liable from those in which the consumer bears the risk.

Understanding that boundary is critical before you file any administrative complaint or lawsuit. Framing the case correctly from the very start improves your chances of recovering the money and keeps you from creating evidence that works against your own interests.

Strict Liability of Financial Institutions

The starting point is the Consumer Protection Code (Código de Defesa do Consumidor, or CDC). The relationship between a bank and its account holder is a consumer relationship, and Article 14 of the CDC establishes strict liability for a service provider when a service is defective. In practice, this means that when bank security fails, the consumer does not have to prove the institution was at fault. It is enough to show the harm and its connection to the tainted transaction.

This understanding was consolidated in Precedent 479 (Súmula 479) of the Superior Court of Justice (STJ), under which financial institutions are strictly liable for damages caused by fraud and crimes committed by third parties in the course of banking operations. The reasoning is based on enterprise risk: whoever profits from digital activity must bear the risks inherent in it.

The court classifies these frauds as an “internal fortuitous event” (fortuito interno), meaning an event tied to the very nature of the banking service. Authentication failures, accounts opened with forged documents, unusual transactions that were not blocked, and data leaks all fall into this category. In these scenarios, refunding the money is the rule, and arguing that a third party committed the crime does not relieve the bank of its duty to compensate.

Internal Fortuitous Events and the Victim’s Exclusive Fault: Where to Draw the Line

The same Consumer Protection Code that imposes strict liability also provides exceptions. Article 14, paragraph 3, removes the duty to compensate when the defect does not exist or when the fault lies exclusively with the consumer or a third party. This is where cases divide.

In some situations, the bank is plainly at fault. A fraudster who opens an account in the victim’s name, takes out a payroll-deductible loan without proper authentication, or moves money in the account after breaking into the bank’s systems exposes a defect in the service. The security that was promised was not delivered, and the bank remains liable.

A different situation arises when account holders, deceived by social engineering, hand over passwords, approve transactions in the app, or make voluntary transfers to the fraudster. Recent case law has recognized that when a victim is induced to act and there is no failure in the security systems, the victim’s exclusive fault may be established, which removes or reduces the bank’s liability.

The boundary, however, is delicate and depends on the facts of each case. Even in social engineering scams, the institution may be liable if it failed to adopt reasonable protective measures, such as blocking transactions out of line with the customer’s profile or sending alerts on suspicious activity. The absence of safeguards that available technology already makes possible reopens the question of a defective service.

The reasoning is based on enterprise risk: whoever profits from digital activity must bear the risks inherent in it.

How to Document the Fraud to Seek Reimbursement

Evidence is the heart of recovering your loss. Account holders should act quickly and methodically, because every passing hour makes it harder to trace the funds and preserve the records. Documentation begins the moment you discover the fraud.

The first step is to file a police report, giving the dates, times, amounts, and how the scam unfolded. Next, notify the financial institution formally and demand a protocol number, disputing the transactions and requesting that the funds be blocked and the charges reversed. Use channels that generate a receipt; a phone call alone is not enough.

Preserve every digital element: screenshots of conversations, messages received, phone numbers, the e-mail addresses the criminals used, transfer receipts, and statements showing the unusual activity. For instant transfers, ask the bank to trigger its refund mechanism as soon as possible.

It is equally important to gather proof that the transaction departed from the account’s usual pattern, such as an inconsistent amount, an unusual time of day, an unknown recipient, and a series of transactions within a short interval. This information supports the argument that the security systems should have identified and blocked the activity.

With your evidence organized, you can file a complaint with consumer protection agencies and through the institution’s ombudsman channels. If the bank still refuses to reimburse you, a lawsuit allows you to seek the return of the money and, depending on the case, compensation for pain and suffering (danos morais) when the defective service causes distress beyond mere annoyance.

A lawyer’s technical guidance, starting with the initial screening, helps frame the incident correctly, avoid damaging admissions, and direct the collection of evidence. Correctly distinguishing a security failure from the victim’s exclusive fault is what shapes the strategy and the chances of success.

Frequently Asked Questions

Does the bank have to refund the money in every electronic fraud?

Not in every case. When the institution’s security fails, as with an account opened using a forged document or an unusual transaction that was not blocked, strict liability applies and a refund is the rule. If the victim’s exclusive fault is proven, meaning the victim gave out passwords or made voluntary transfers with no defect in the service, the duty to compensate may be removed. The analysis depends on the specific case and on how the fraud occurred.

I was scammed and made the transfer through social engineering. Can I still be reimbursed?

It depends. Case law has recognized exclusive fault when a consumer is induced to act without any failure in the bank’s systems. However, if the institution failed to adopt reasonable protective measures, such as alerts and blocking of transactions out of line with the customer’s profile, the bank may be held liable. Proving that the activity was unusual and should have been stopped is essential to reopening the question of a defective service.

Which documents are essential to seek reimbursement?

The essential documents are the police report, the protocol number for your dispute with the bank, statements showing the unusual activity, transfer receipts, and all of the digital material from the scam, such as the criminals’ messages, phone numbers, and e-mail addresses. It also helps to show that the transaction was inconsistent with the account’s history. The faster and better organized this evidence is, the greater your chances of recovering the money through an administrative or judicial process.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.