Brazil's Phishing Campaign: Fake Government Sites Stealing CPF Data and Money via Pix

How the Fraud Works

The Fake Websites

This phishing campaign operated approximately 900 malicious domains, primarily impersonating the Brazilian Central Bank's Forgotten Funds Recovery System, the Nubank digital bank, and fraudulent credit lenders.

The Multi-Stage Attack Process

Stage 1: Personal Information Collection Victims are first prompted to enter their CPF (Cadastro de Pessoas Físicas—the Brazilian individual taxpayer registry number). The fraudsters use automated services to query this CPF against databases, retrieving the victim's full legal name, date of birth, and mother's name.

Stage 2: Building False Legitimacy The stolen personal data is weaponized to personalize the fraud:

• On the Central Bank impersonation site, victims see an official-looking video
• Testimonials from purported previous recipients appear
• An audio chat asks victims to confirm their mother's name and answer security questions
• A fake withdrawal receipt is displayed
• A Pix QR code with an artificially short deadline (often 10 minutes) is generated

Stage 3: The Pix Payment Demand Victims are told they must pay:

• R$86.63 as a processing fee for forgotten funds
• R$28.93 as a credit analysis fee for loans

Investigation revealed that multiple fraud sites shared the same payment recipient account and subdomain for QR code generation, indicating a coordinated infrastructure operated by the same criminal group.

How to Identify Fraud

Legitimate Recovery Process

• The official Brazilian Central Bank Forgotten Funds Recovery System is completely free
• The Central Bank never sends links or personal contact to citizens
• Personal information confirmation is never requested via email or chat

Red Flags of Fraud

• Government agencies never charge fees, taxes, or processing costs for legitimate services
• Time-limited payment demands (urgent QR codes expiring within minutes)
• Requests for sensitive personal data like CPF or mother's maiden name
• URLs not matching official government domains (e.g., not ending in gov.br)
• Chatbots asking you to verify identity-confirming information
• Pressure to act immediately without time to verify

Protection Measures

1. Verify URLs Carefully

   • Always check the full address bar before entering information
   • Use browser bookmarks or Google search to reach official sites rather than clicking links

2. Never Share Personal Data on Unsolicited Sites

   • CPF and banking information should only be entered on verified official channels
   • Avoid popup windows requesting sensitive information

3. Be Skeptical of Urgency

   • Time-limited offers are a classic fraud tactic
   • Legitimate government services don't pressure you with deadlines

4. Use Official Channels Only

   • Access the legitimate Forgotten Funds System directly through official Brazilian Central Bank website
   • Ignore any email links offering shortcuts

What to Do If Defrauded

Immediate Actions

1. Contact Your Bank Immediately

   • Dispute the fraudulent Pix transaction
   • Request reversal through Brazil's Special Return Mechanism (MED—Mecanismo Especial de Devolução)
   • Document all communication

2. File a Police Report

   • Contact Brazilian police to file an official complaint (Boletim de Ocorrência)
   • Keep the report number for insurance and bank disputes

3. Monitor Your Identity

   • Research shows 6,002 CPF records compromised in this campaign are being sold on dark web forums
   • Consider credit monitoring services
   • Watch for suspicious credit applications or loans opened in your name

Reporting Resources

• Official Forgotten Funds System: Sistema de Valores a Receber (official website only)
• Pix Fraud: Your bank's customer service department
• Police Report: Brazilian Federal Police (Polícia Federal)
• Identity Theft Monitoring: Your financial institution's fraud prevention team