Brazil’s scam losses show why pre-fraud prevention must move faster

At a glance

What this is: This is an analysis of Brazil's scam environment, where annual losses exceed R$21.2 billion and behavioural, real-time prevention is positioned as the necessary response.

Why it matters: It matters because fraud control cannot rely on transaction-stage detection alone when coercion, social engineering and instant payments compress the window for intervention.

Context

Scam prevention fails when institutions only inspect the payment itself. In fast-payment ecosystems, the attacker often wins by shaping behaviour before the transfer occurs, so controls that trigger after authorisation arrive too late. For identity and fraud teams, the real governance problem is not just detection volume but whether the organisation can recognise coercion, impersonation and manipulation in time.

Feedzai's analysis of the Brazil market frames fraud as a cross-channel, cross-institution problem rather than a single-bank issue. That matters for fraud prevention platforms because it shifts the control question from isolated transaction scoring to shared behavioural intelligence, coordinated escalation and response across banks, telecoms, platforms and government.

Key questions

Q: How should fraud teams stop scams before a customer authorises the transfer?

A: Fraud teams should score the interaction before final authorisation, not after the transaction is complete. That means combining behavioural signals, device context and scam typology to interrupt coerced decisions in real time. In instant-payment environments, prevention has to be measured in seconds, with clear escalation paths when patterns indicate pressure, impersonation or unusual hesitation.

Q: Why do faster payment rails increase fraud risk?

A: Faster rails compress the time between compromise, authorisation, and irreversible settlement. That means fraud teams have less time to detect anomalies and even less time to reverse losses. When the trust decision happens in-session, static onboarding controls no longer provide enough protection. Organisations need live identity and transaction signals to keep pace with the payment model.

Q: What breaks when payment fraud controls rely only on the transaction itself?

A: Controls fail when they treat the payment as isolated from the actor behind it. Fraudsters can reuse stolen, synthetic, or hijacked identities, making a transaction look normal while the surrounding identity context remains adversarial. Strong programmes connect device, behaviour, and account history so approval decisions reflect continuity, not just a momentary score.

Q: How do banks and telecom providers share responsibility for scam prevention?

A: Banks and telecom providers need shared intelligence, aligned escalation rules and clear ownership for contacting customers when scam patterns emerge across channels. Neither side sees the full attack path on its own. The strongest model is coordinated detection that joins messaging, call, email and payment signals into one operating picture.

Technical breakdown

Why batch fraud controls miss scam coercion

Traditional fraud controls often evaluate transactions after they have been formed, scored or queued, which works poorly when a scammer is guiding the victim in real time. Scams are not only a payment problem, but a behavioural manipulation problem. The attacker uses pressure, urgency, impersonation or false promise to alter the victim's decisions while the transaction is still unfolding. That means the security signal is not the transfer alone, but the sequence of hesitations, device interactions and decision changes that precede it. In a Pix-like environment, latency matters because the fraud window is measured in seconds, not hours.

Practical implication: Shift detection upstream so behaviour, context and session signals are evaluated before payment finalisation.

How behavioural telemetry improves scam detection

Behavioural telemetry looks at how a person interacts with a device, including typing cadence, touch patterns, hesitation and phone movement. These signals are useful because coerced or manipulated users often behave differently from normal users, even when they still authorise the transfer themselves. The technical value is in correlation: many weak signals become stronger when analysed together and compared against a baseline over milliseconds. This does not replace identity or authentication checks; it complements them by detecting anomalies in the decision-making process that follow a successful login or trusted session.

Practical implication: Correlate device, session and behavioural signals so scam indicators can interrupt the transaction path in real time.

Why multi-sector data sharing changes scam defence

Scam operations move across telecoms, messaging, email, payment rails and banking channels, so no single institution sees the full pattern. A multi-sector defence model joins signals from banks, telecom providers, government and law enforcement to expose repeat infrastructure, recurring victim journeys and scammer reuse of channels. This is a governance problem as much as a detection problem, because the quality of the shared intelligence depends on consistent escalation paths, compatible data handling and clear ownership of action. Without that collaboration layer, each organisation only sees a fragment of the attack.

Practical implication: Build shared escalation and intelligence workflows across channels so fraud patterns can be blocked before they spread between institutions.

NHI Mgmt Group analysis

Brazil's scam problem is now a governance problem, not just a fraud problem. The article's figures show that exposure is broad, losses are material and the path from manipulation to payment is compressed into seconds. That combination means institutions cannot treat scam defence as a narrow fraud-engine issue. They need operating models that connect identity, channel security, payment controls and customer response into one decision chain.

Pre-fraud prevention is the decisive control shift for instant-payment ecosystems. The article correctly distinguishes pre-fraud intervention from post-fraud recovery, and that distinction matters because recovery only mitigates damage after trust has already been exploited. In fast-payment systems, the control that matters most is the one that can stop coercion before authorisation is completed. For practitioners, the question is whether their control stack is built for prevention or simply for reimbursement.

Behavioural scoring becomes a trust signal when the customer is the attack surface. In scam cases, the compromised element is often not a credential but the user's decision process under pressure. That makes typing cadence, touch rhythm and hesitation valuable because they expose manipulation that classic authentication never sees. The practical implication is that fraud teams should treat behavioural context as part of identity assurance, especially where instant payments and social engineering intersect.

Multi-sector intelligence is the named concept Brazil needs, because scams now cross institutional boundaries by design. No single bank, telco or platform can see the full attack path when contact, persuasion and payment each happen in different systems. Authorised Push Payment fraud is a useful reference point here because the same pattern of social engineering, urgency and pressured authorisation appears across payment ecosystems. Practitioners should design for coordinated detection and escalation, not isolated scoring.

What this signals

Scam defence is moving from fraud detection to trust orchestration. The reader should expect more programmes to treat social engineering, customer behaviour and payment authorisation as one control surface rather than separate teams. That shift will force better coordination between fraud, IAM, customer operations and channel security, because the attack succeeds when those boundaries stay disconnected.

Prevention will outrun recovery as the primary performance measure. In instant-payment environments, reimbursement and asset recovery still matter, but they no longer define programme quality on their own. The stronger test is whether a team can detect manipulation before the customer completes the action, because once the transfer is authorised the control opportunity has largely passed.

Behavioural context is becoming a core fraud signal. Organisations that only score static identities will miss the moment when a trusted customer is being pushed into an unsafe decision. The practical direction is clear: connect behavioural telemetry, channel intelligence and customer verification so scam patterns are visible before loss is booked.

For practitioners

• Instrument pre-authorisation behavioural checks Score typing cadence, touch behaviour, hesitation and device movement before the payment is finalised so scam coercion can be interrupted in real time.
• Replace batch-only detection with low-latency intervention Move from end-of-day review to streaming signals and immediate decisioning for fast-payment rails where losses occur within seconds.
• Build cross-sector escalation paths Define how banks, telecoms, platforms and public authorities share intelligence on recurring scam patterns, false contacts and repeat infrastructure.
• Train customers to verify outside the message thread Direct users to official channels, known contacts and out-of-band confirmation whenever an unsolicited message creates urgency or asks for payment.

Key takeaways

• Brazil's scam exposure is widespread enough that transaction-only controls are no longer sufficient for meaningful prevention.
• The article's core evidence is the scale of loss and the speed of authorisation, which together favour real-time behavioural defence.
• Practitioners should build cross-sector, pre-fraud controls that detect coercion before a customer completes the transfer.

Related NHI Mgmt Group resources: Fraud Prevention Platform Buyer's Guide · Authorised Push Payment (APP) Fraud Guide · Collaboration Tool Security Guide · DLP Buyer's Guide

Key terms

• Coerced Transaction: A coerced transaction is a payment or transfer that the user authorises under pressure, deception or impersonation rather than through normal intent. In fraud operations, the attacker does not need to break authentication if they can manipulate the customer into approving the action.
• Behavioural Telemetry: Operational evidence that shows what an identity actually did, not just what it was allowed to do. For autonomous systems, behavioural telemetry is essential because policy compliance alone cannot prove that the sequence of actions was safe.
• Fraud Prevention: Fraud prevention is the set of controls and processes used to stop malicious or deceptive activity before it causes loss. It commonly combines identity verification, risk scoring, review workflows, and policy enforcement, with effectiveness depending on how well those controls fit the organisation’s users, channels, and threat model.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security for practitioners who need to connect identity controls to broader security decisions. It is suitable for teams building governance across identity, access and emerging automated systems.