← Articles and guides on fraud, cybersecurity, privacy and AML

Pix scams in numbers: how much was stolen and why refunds stay low

Central Bank data show R$24.5 billion stolen through Pix since 2022 and only 8.9% returned. What MED 2.0 changes and how to protect yourself.

2026-10-31

Pix, Brazil's instant payment system, has become the country's favorite way to pay, and the favorite target of scammers. Central Bank data compiled by O POVO+ show that between January 2022 and April 2026 at least R$24.52 billion was stolen through Pix scams. Institutions returned R$2.2 billion, or 8.9%. For every R$100 lost, R$8.90 came back.

The same data point to an average of 271,500 confirmed frauds per month since Pix was launched. These figures explain why the Central Bank overhauled its Special Return Mechanism (MED), and why refunds are still low.

The size of the problem

Different sources measure Pix fraud from different angles; their numbers should not be added together.

Central Bank (via O POVO+): R$24.52 billion stolen from Jan 2022 to Apr 2026; R$2.2 billion returned.
Brazilian Public Security Forum (via Rádio Senado): about 24 million people fell for a Pix scam between July 2024 and June 2025, with estimated losses of R$29 billion.
Febraban, the banking federation (via Convergência Digital): R$2.7 billion lost to Pix fraud over two years, with fraud volume up 43% from 2023.

Across the banking system, Febraban estimates fraud losses in electronic channels and cards reached R$10.1 billion in 2024, up 17% from R$8.6 billion in 2023.

The fastest-growing scams

In the first half of 2025, according to Febraban, the most reported scam among bank customers was the fake sale, with 174,000 cases (+314%), followed by the fake call center or fake bank employee (139,000; +195.7%) and the WhatsApp scam (73,000), the only one declining (−9.9%). The criminal does not hack anything: he persuades the victim to send the money.

Why MED returns so little

MED lets customers dispute a Pix sent in a scam and request a refund. It is heavily used but recovers only a small share of disputed amounts.

MED indicator	Value	Period
Refund requests	~5 million, 31% accepted	through Jun 2025
Returned vs. disputed	R$459m of R$6.98bn	through Jun 2025
Disputes per month	1.3 million on average	Jan–Aug 2025
Disputes after the in-app button	3.5m (Oct), 3.4m (Nov)	2025
Amount returned per month	R$56m (Jan–Aug avg.); R$70.3m (Oct); R$62.8m (Nov)	2025
Share of disputed amount returned	7% to 9%	2025

When disputing became a single tap in banking apps, requests nearly tripled, but refunds rose much less. A refund depends on money still sitting in the receiving account, and scam proceeds usually leave within minutes.

There is also a structural obstacle: pooled accounts, in which a fintech keeps one account in its own name at a bank, mixing many clients' funds. The bank only sees the fintech, which makes it harder to trace money and enforce court freezes, as IstoÉ Dinheiro explains.

What MED 2.0 changes

MED 2.0 has been mandatory since February 2, 2026. It follows the "money trail" across several accounts, not just the first one, and allows refunds within up to 11 days of a dispute. Under Resolution BCB 546, the Central Bank waived sanctions for non-compliance between February 2 and May 10, 2026, according to Finsiders.

BC Protege+: launched in December 2025, it lets citizens block new accounts from being opened in their name; it stopped 111,000 suspicious openings in its first month.
CMN Resolution 5,274 and BCB Resolution 538 (Dec 2025): require multi-factor authentication for administrative access to Pix, isolation of those environments and an annual independent penetration test, with a compliance deadline of March 1, 2026.

How to protect yourself

Banks never call asking for passwords, codes or test transfers. Hang up and call the official number yourself.
Be wary of prices far below market on marketplaces and social media.
Confirm money requests from relatives through another channel.
Set Pix limits in your banking app and register trusted devices only.
Turn on BC Protege+ to block accounts opened in your name.
Got scammed? File a MED dispute in your bank's app right away and report it to the police. Speed matters.