Articles and guides on fraud, cybersecurity, privacy and AML
In-depth articles with data on Pix scams, FBI IC3 fraud, breach costs, ransomware, LGPD vs GDPR, cybercrime penalties, AML and cybersecurity M&A.
- Fake FTC calls threaten to cut off your phone: how the scam works — The FTC warns of callers posing as its staff who say your number was used in crimes, pass you to a fake officer and demand a deposit. How it works, what to do.
- Fake police call scam in Brazil: a video call to steal your face — Police in southern Brazil warn of callers posing as officers who push victims onto a video call to capture their face and voice for fraud. How it works and what to do.
- Fake charity deepfakes in Brazil: inside Operation Cáritas — Brazilian police arrest 5 suspects accused of using deepfakes of a singer and priests in fake charity drives that moved R$10 million. How it worked and how to give safely.
- El Buen Fin 2026 scams: fake stores and WhatsApp prizes in Mexico — Before El Buen Fin (Nov. 13-17), Mexican authorities warn of cloned stores and a fake 200,000-peso WhatsApp prize. The scams, the numbers and how to stay safe.
- 2026 midterm election scams: the FBI warning on donations and AI — Ahead of the Nov. 3 vote, the FBI warns of fake PACs, campaign 'investment pools', merchandise that never ships and fake voter-registration pages powered by AI.
- Data leaked in Brazil? What to do, step by step, under the LGPD — Your data leaked in Brazil? Step by step: passwords, bank, Registrato, police report, the 3-business-day LGPD notice rule and how to complain to the ANPD.
- Binance hack: $6.3B theft tied to North Korea, what we know — The $6.36B Binance hack, the largest crypto theft on record: how it happened, what was frozen, why North Korea is blamed and what users should do now.
- Pix scams in numbers: how much was stolen and why refunds stay low — Central Bank data show R$24.5 billion stolen through Pix since 2022 and only 8.9% returned. What MED 2.0 changes and how to protect yourself.
- Fake bank call centres and courier scams in Brazil: how they work — Fake bank call centre scams in Brazil rose 195.7% in the first half of 2025, Febraban says. How the fake courier step works and how to stay safe.
- US cyber fraud hits a record: key findings of the FBI IC3 2025 report — Losses reported to the FBI reached $20.9 billion in 2025, up 26%. Key figures on investment fraud, BEC, crypto and scams targeting older Americans.
- Cost of a data breach in 2025: Brazil, the US and the world compared — The global average breach cost fell to $4.44 million, but in the US it hit a record $10.22 million. Brazil's figure, the role of AI and what cuts the bill.
- Mule and pooled accounts: how crime exploits Brazilian fintechs — From Operation Carbono Oculto to Law 15,397/2026: how mule and pooled fintech accounts enabled laundering in Brazil and what regulators changed.
- Ransomware in Brazil's government and healthcare: 2024–2026 cases — Municipalities, hospitals and health software vendors: the ransomware attacks publicly confirmed in Brazil between 2024 and 2026 and what they teach.
- Ransomware 2025–2026: most active gangs, top countries and Brazil — 2025 set records for ransomware victims and active gangs, with Qilin on top. See the most targeted countries, where Brazil ranks and what surveys show.
- Brazil's LGPD in practice: what the ANPD enforces and how to comply — Three-day breach notices, DPO rules, standard clauses and fines up to R$50 million: the ANPD regulations in force and its 2026–2027 enforcement priorities.
- LGPD vs GDPR vs US law: privacy fines and breach notice deadlines — Brazil requires breach notice within 3 business days, the EU within 72 hours, and the SEC 4 business days. Compare fine caps, deadlines and enforcement.
- WhatsApp cloning and fake relative scams in Brazil: protection and law — Account cloning and “new number” fake relative scams: how WhatsApp fraud works in Brazil, what Law 15,397/2026 changed and how to protect yourself.
- Cybercrime penalties compared: Brazil, the US and Latin America — From ANPD fines to billion-dollar DOJ pleas: verified penalties for digital crime, data breaches and money laundering in Brazil, the US and Latin America.
- Brazil's INSS pension fraud: verified facts and figures — R$6.3 billion diverted, 97.6% of deductions unauthorised and over R$3 billion refunded: the verified numbers of Brazil's INSS pension fraud scandal.
- Brazil's ANPD becomes a regulatory agency: what changes for companies — Law 15,352/2026 turned Brazil's ANPD into an agency with financial autonomy and 200 new posts. What changes in LGPD and ECA Digital enforcement.
- US state privacy laws: the full map through 2028 — Twenty-four US states have comprehensive privacy laws, from 2020 to 2028. See the effective dates, California's fines and where the federal bill stands.
- Betting and money laundering in Brazil: AML rules and 2026 cases — What Ordinance SPA/MF 1,143 requires from Brazilian betting operators, first-year market data and the 2026 police operations on betting laundering.
- Pix security: MED 2.0, the dispute button and new Central Bank rules — Dispute button, MED 2.0 money tracing, new-device limits and BC Protege+: Brazil's Central Bank rules to fight Pix fraud and how victims can use them.
- Money laundering: FATF lists, a COAF record and Brazil's crypto rules — FATF removed four countries from its grey list in October 2026, Brazil's COAF set a record and the Central Bank tightened crypto rules. What changes now.
- Brazil's biggest data breaches and what happened next — From the 223 million CPF mega-leak to Pix keys, iFood and Cemig: Brazil's largest public data breaches and what happened after each case was revealed.
- Cybersecurity M&A: 2025's record year and the 2026 megadeals — Cybersecurity M&A hit $96.1 billion in 2025, and Wiz, CyberArk and Armis closed in 2026. The numbers, the buyers' theses and what to expect next.
- Who's who in Brazilian anti-fraud: Serasa, ClearSale, idwall and unico — Serasa Experian bought AllowMe, ClearSale and idwall; unico is valued at $2.6 billion. Meet Brazil's anti-fraud players and how the sector is consolidating.
- Brazil's financial cybersecurity: C&M, Sinqia and the new rules — The C&M Software and Sinqia attacks exposed vendor risk in Brazil's payment system. What BCB Resolution 498 and CMN Resolution 5,274 changed, and lessons.
- Pig butchering: the crypto scam draining billions from Americans — How pig butchering crypto scams work, what Americans lost in 2025 and how the US is going after Southeast Asian scam compounds and the Prince Group.
- Phishing and deepfakes: the 2025 numbers and how to spot them — Brazil saw 553 million phishing attempts blocked in a year, and deepfake fraud losses reached $2.5 billion in 2025. See the data and the warning signs.
- Elder fraud in the US: $7.7 billion lost and how to protect parents — Americans over 60 lost $7.7 billion to fraud in 2025, the FBI says. How tech support and government impersonation scams work and how families can help.
- The biggest data protection fines: GDPR, South Korea and the US — From Meta (€1.2bn) to Coupang (KRW 625bn) and Equifax (up to $700m): a ranking of the largest privacy fines and settlements, and what triggered each one.
- SEC cyber incident rule: what 8-K Item 1.05 filings reveal — Since December 2023, US public companies must report material cyber incidents in four business days. What the 8-K filings show and lessons for boards.
- Latin America: where attacks per organization grow fastest — Latin American organizations faced 3,065 attacks a week in December 2025, the fastest growth of any region. See the numbers, Brazil's role and the reasons.
- US healthcare data breaches: Change Healthcare and the HIPAA landscape — The Change Healthcare attack exposed data on 192.7 million people. US health breach numbers, what went wrong and where the HIPAA Security Rule update stands.
- BEC and real estate wire fraud in the US: how it works, how to stop it — Business email compromise cost US victims $3 billion in 2025. How BEC and real estate closing scams work, and the controls that stop wire fraud before it lands.
- Salt and Volt Typhoon: what is known about China's US network hacks — China-linked hackers breached US telecoms and critical infrastructure. What is publicly known about Salt Typhoon and Volt Typhoon: targets, tactics, response.
- China's data protection regime: PIPL, DSL and the 2025–2026 changes — A guide to China's PIPL, Data Security Law and cross-border data rules, with what changed in 2025–2026, including audits, certification and the amended CSL.
- China vs scam centers: 258,000 cases, mass transfers and executions — China solved 258,000 telecom fraud cases in 2025 and received 58,000 suspects from abroad. The figures behind its crackdown on Myanmar and Cambodia scam hubs.
- China's crypto ban and USDT: how underground banks launder billions — Crypto is banned in China, yet USDT has become the bridge for underground banks. Recent enforcement cases, sentences and the central bank's stablecoin warning.
- China's 1-hour cyber incident reporting: what foreign firms must do — Since November 2025, China requires serious cyber incidents to be reported within 1 to 4 hours. Thresholds, deadlines and what foreign companies need to do now.
- NIS2 explained: scope, obligations, fines and transposition status — A guide to the EU NIS2 Directive: essential vs important entities, 24h/72h reporting, fines up to 2% of turnover and which countries still lag on transposition.
- DORA since January 2025: what changed and supervisory priorities — DORA in review: 3,383 major ICT incidents in 2025, 19 critical tech providers under direct EU oversight and the ECB's resilience focus through 2028.
- EU AI Act and deepfakes: duties and timeline for security teams — What the EU AI Act requires on deepfakes and synthetic content, the new dates after the Digital Omnibus, fines up to 3% and how to fight AI-driven fraud.
- EU AMLA and the new AML package: banks, fintechs and crypto — How AMLA, the AMLR and the Travel Rule reshape EU anti-money laundering: direct supervision of 40 groups from 2028, a €10,000 cash cap and MiCA licensing.
- Payment fraud in Europe: APP scams, UK refunds and the EU PSR — Scams where victims authorise payments are surging in Europe. The numbers, the UK's 88% reimbursement rate and what the EU changes with verification of payee.
- Ransomware: pay or not? OFAC sanctions, insurance and the data — Only 28% of ransomware victims paid in 2025. What OFAC sanctions risk means, what insurers require and how to decide whether paying a ransom makes any sense.
- Supply chain attacks: from SolarWinds and MOVEit to 2026 — Third parties now feature in 30% of breaches. Lessons from SolarWinds, MOVEit, Salesloft Drift, Shai-Hulud and 2026 cases, and how to manage vendor risk.
- Passkeys, MFA and the end of passwords: what stops account takeover — 97% of identity attacks rely on passwords. Which MFA methods resist phishing, what passkey data show and a practical checklist to stop account takeover.
- Cyber insurance market: prices, exclusions and insurer demands — Global cyber premiums reach $15bn and rates have fallen for 13 quarters. Data for Brazil and the US, key exclusions and the controls insurers now require.
- How to build an incident response plan: the first 72 hours — What to do in the first 72 hours of a cyberattack: containment, evidence, notification deadlines in Brazil, the US and the EU, communication and a checklist.