Pix Scams: When Your Bank Is Liable and Steps to Try to Recover Your Money

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

When a scammer makes unauthorized transfers from a victim’s account, the immediate question is who bears the loss and what to do to get the money back. The answer depends on how the fraud happened, how quickly you react in the first hours, and whether you can trigger the blocking and refund mechanisms available for electronic transactions.

When the Financial Institution Is Liable for Fraud

A bank’s liability for fraudulent transfers is not automatic, but it is not rare either. The central question is whether there was a failure in the service, that is, whether the institution failed to take the security precautions expected of anyone who handles other people’s money. When the fraud results from a vulnerability in the banking system itself, the settled position is strict liability, which does not require proof of fault on the part of the service provider.

Brazil’s Superior Court of Justice (STJ) established this rule in Precedent 479 (Súmula 479), under which financial institutions are strictly liable for damages caused by internal risks (fortuito interno) tied to fraud committed by third parties in the course of banking operations. The logic is straightforward: the risk of scams is part of the bank’s profit-making business, so the bank must bear it rather than pass it on to the injured customer.

There is, however, a gray area. If the account holder made the transfer personally after being tricked by social engineering, the bank will usually argue that the victim was solely at fault. That argument does not always prevail. Courts look at whether the institution offered effective anti-fraud tools, whether the transaction showed unusual signs, and whether the system allowed activity inconsistent with the customer’s profile without any additional verification.

What to Do in the First Hours

The window for action is short and decisive. In electronic fraud, every minute lowers the chance of recovering the money, because criminals typically scatter the funds across third-party accounts, known as laranjas (straw account holders or “mules”), within moments. That is why the first step is to file a dispute with the bank immediately, preferably through a channel that generates a protocol number, such as the app, the phone line, or in-person service.

When you file the dispute, give the exact date, time, amount, and destination of each transaction you do not recognize. This account supports the request to block the funds and serves as evidence later. It is worth asking, at the same time, for the protocol number and the name of the representative, and noting the exact time of the contact.

Next, you need to file a police report (boletim de ocorrência). The report will not recover the money by itself, but it documents the crime, reinforces the good faith of the person who was harmed, and is usually required by both the institution and the courts. You can also report the incident to the authority responsible for cybercrime, where there is a specialized police unit in the area.

Changing your passwords and reviewing the devices connected to your account is just as urgent. Many frauds drag on because the criminal’s access remains active, allowing new transfers while the victim is still trying to understand what happened.

The logic is straightforward: the risk of scams is part of the bank’s profit-making business, so the bank must bear it rather than pass it on to the injured customer.

Precautionary Blocking and Refund of Funds

For instant transfers, the banking system has a specific refund mechanism that is triggered when there is well-founded suspicion of fraud. Once notified, the institution can order a precautionary block on any funds still in the destination account, freezing the balance for a period while the unlawful origin of the transaction is investigated.

If the block reaches funds that have not been withdrawn or redistributed, the refund tends to be simpler and faster. The problem arises when the money has already passed through several accounts. In that situation, recovery depends on tracing the funds and, often, on a court order directing the reversal.

It is important to distinguish the administrative precautionary block, carried out within the financial system itself, from a court-ordered measure. The first is preventive and temporary. When it is not enough, the courts allow you to request urgent relief (tutela de urgência, similar to a preliminary injunction) to freeze accounts, identify the beneficiaries, and compel the bank to reimburse the consumer.

Keeping organized records makes a difference in the outcome. Protocol numbers, screenshots, emails, statements, and the police report together form a body of evidence that supports both the negotiation with the bank and any eventual lawsuit. Without this record, the consumer’s word tends to carry less weight against the institution’s version of events.

How to Seek a Reversal and Gather Evidence

If the administrative route has been exhausted without a solution, or if the bank refuses to reimburse you, the path to holding the bank accountable opens up. The consumer can demand the full return of the amounts taken and, depending on the case, compensation for moral damages when the fraud causes real harm, such as wrongful entry on a credit blacklist, loss of essential funds, or dismissive treatment by the institution.

The relationship between a customer and a bank is a consumer relationship, which brings significant procedural advantages. The main one is the possibility of reversing the burden of proof, which places on the institution the task of showing that its system was secure and that the failure resulted solely from the victim’s own conduct. In practice, it is up to the bank to prove that its service was sound, not up to the consumer to prove an internal defect in a structure to which the consumer has no access.

To strengthen your claim, you should gather the detailed statement with the disputed transactions marked, the proof of the dispute protocol, the police report, any messages exchanged with fake customer service agents, and the bank’s formal response. This material shows the victim’s diligence and the timeline of events.

When the amount involved is large or the institution resists, a lawyer can help fine-tune the strategy, assess the most suitable legal theory, and file urgent requests capable of freezing accounts before the money disappears for good. Professional guidance also helps you avoid common mistakes, such as accepting settlements that cover only part of the loss or giving up rights without realizing it.

Consumers should understand that failing to recover the money right away does not end the matter. Even if the funds have been scattered, the question of the security failure and the duty to pay compensation remains, and that duty does not depend on the bank being able to locate the scammer.

Frequently Asked Questions

Is the bank required to refund the amount of a fraudulent transfer?

It depends on how the fraud happened. When there is a failure in the security of the banking service, the strict liability recognized in STJ Precedent 479 applies, and the institution must reimburse the customer. In social engineering cases, the bank usually claims the victim was solely at fault, but that argument is assessed case by case, taking into account the anti-fraud tools available and whether the transaction showed unusual signs.

What is the deadline to dispute transactions I do not recognize?

You should file the dispute as quickly as possible, ideally within the first hours, because the precautionary block on the funds is only effective while the balance remains in the destination account. Besides notifying the bank immediately, it is advisable to file a police report and keep every protocol number. Acting quickly does not prevent a later claim for compensation, but it greatly increases the chance of recovering the money directly.

Do I need a police report to request a reversal?

A police report is not the only legal requirement for a reversal, but it is highly recommended. It documents the crime, reinforces the good faith of the person who was harmed, and is usually required by the financial institution and the courts as part of the body of evidence. Without it, the consumer’s version becomes weaker against the bank’s claim that the transaction was legitimate.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.