In a fake bank call scam, criminals impersonate bank employees, claim that a suspicious transaction has occurred and induce the victim to disclose information, install software, take out credit or transfer funds. The contact may appear legitimate because the criminals mention personal data, spoof telephone numbers or reproduce procedures that resemble genuine customer service.

The occurrence of fraud does not, by itself, determine who must bear the loss. Under Brazilian law, the outcome depends on the relationship between the criminals’ conduct, the consumer’s actions and the quality of the financial institution’s or payment institution’s security and response mechanisms.

Is the bank automatically liable?

No. Article 14 of Brazil’s Consumer Protection Code establishes strict liability for defective services, but liability may be excluded if the supplier proves that there was no defect or that the harm resulted exclusively from the consumer’s or a third party’s conduct.

Precedent Statement 479 of Brazil’s Superior Court of Justice (STJ) provides that financial institutions are liable for losses arising from third-party fraud when the event constitutes an internal fortuitous event—an operational risk inherent in banking activity. Applying this rule requires an examination of the particular facts.

Which failures may indicate a defective service?

In recent decisions, the STJ identified circumstances that may show that a transaction should have triggered fraud-prevention systems, including:

  • transactions inconsistent with the customer’s history and financial profile;
  • unusual loans taken out immediately before transfers;
  • several consecutive transactions, within a short period, to new recipients;
  • amounts, times, locations, devices or access methods outside the customer’s usual pattern;
  • approval of suspicious transactions without additional safeguards proportionate to the risk;
  • unjustified delay in freezing funds or activating mitigation mechanisms after timely notice of the fraud.

These factors are not an automatic checklist. The evidence as a whole must show whether the available controls were adequate and whether the institution could reasonably have detected or reduced the loss.

What did the STJ decide in 2026?

The 2026 decisions show that outcomes may differ according to the proven facts.

In REsp 2,209,868/SP, the Third Panel upheld a decision rejecting the bank’s liability. The lower court had found no transaction inconsistent with the customer’s profile and no defective service; it also found that the largest transfer was made in person without the fraud being reported to branch employees.

By contrast, in AgInt in REsp 2,221,112/SC, the Fourth Panel considered the almost immediate notice and the five-day delay in effectively activating a precautionary freeze and the Pix MED. The failure to react and mitigate was treated as a defective service.

In REsp 2,269,747, the Third Panel reaffirmed that banks and payment institutions must monitor atypical transactions. The decision considered, among other matters, loans taken out on the same day and transactions inconsistent with the account’s history.

These precedents do not replace an individual assessment. They provide legal criteria for determining whether there was an internal fortuitous event, a security defect, a break in causation or exclusive fault.

How does the Pix MED work?

The Mecanismo Especial de Devolução (MED), or Special Refund Mechanism, is a Pix procedure designed to improve the chances of recovering funds in fraud cases. According to the Central Bank of Brazil, a victim may submit a request through their institution within 80 days of the transaction, but should act as quickly as possible.

Once the procedure is opened, the institutions involved review the event and may temporarily freeze available funds in related accounts, up to the disputed amount. A refund may be full, partial or unavailable because it depends on confirmation of the fraud and the existence of reachable funds.

As a rule, the MED does not cover a commercial disagreement, a Pix mistakenly sent to the wrong person or funds received by an innocent third party. A MED request also does not automatically establish the institution’s civil liability.

What should a victim do immediately?

  1. End the contact and do not install software or provide additional passwords, codes or security tokens.
  2. Notify the bank through official channels, request a preventive freeze and ask for the MED for eligible Pix transfers.
  3. Change passwords and secure devices, particularly if remote-access software was installed or credentials were shared.
  4. File a police report containing the chronology, amounts, recipient accounts and methods used by the criminals.
  5. Preserve reference numbers and documents before deleting messages, call logs, emails or applications.

Prompt action may improve the chance of freezing funds and also documents the moment at which the institution received the warning.

Which evidence should be preserved?

  • complete statements and transaction receipts;
  • customer-service reference numbers, times and official channels used;
  • screenshots, messages, emails and call records;
  • documents concerning loans, limit increases or the registration of new devices;
  • the bank’s responses, MED status and any refund denial;
  • records showing the account’s usual transaction pattern;
  • the police report and complaints to consumer-protection authorities, if any.

These records help reconstruct the sequence of events and assess whether the transactions were atypical, whether notice was timely and what measures were actually taken.

When may a legal assessment be appropriate?

An individual review may be appropriate when an institution refuses to freeze funds or open the MED, responds after a significant delay, records unrecognized loans or adverse credit information, validates transactions clearly inconsistent with the consumer’s profile, or disputes the source of a data leak.

The administrative responses, contracts, authentication rules, available technical evidence and the possible involvement of more than one institution should also be reviewed. Reimbursement, a declaration that a debt is unenforceable and compensation for other harm depend on the facts and evidence; they are not automatic consequences of a scam.

Conclusion

Fake bank call scams require a rapid response, preservation of evidence and careful examination of the security chain. Recent STJ decisions confirm two complementary points under Brazilian law: a bank is not automatically liable for every fraud, but it may be liable when its service fails to detect atypical transactions or respond appropriately after an alert.

Vinicius Faria Advocacia
OAB/RJ 189.329
Rio de Janeiro — Brazil
Informational content. This article addresses Brazilian law and the Brazilian precedents available on the publication date. Any specific matter depends on its documents, evidence and circumstances. No outcome is promised.

Official sources