← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD
Operation Nêmesis: insider access and fraud on 400 cards in Brazil
Brazilian police say a credit cooperative insider helped a gang abuse 400 customers' cards and move over R$ 3 million. How insider fraud works and what to do.
Police in Brazil's Federal District (PCDF) launched Operation Nêmesis on October 29, 2026 against a group suspected of abusing the credit cards of a financial cooperative's customers with help from inside. According to Metrópoles, an employee of the cooperative — whose name and employer were not disclosed — allegedly accessed, without authorization, the system that generates purchase authentication codes. The group then allegedly made unauthorized online transactions with data from about 400 customers between January and July 2025, causing losses of more than R$ 3 million. The suspects have not been convicted and are presumed innocent.
What do we know about the case?
| Item | Reported fact |
|---|---|
| Investigators | PCDF cybercrime unit, with Bahia's DEIC |
| Customers affected | About 400 cards |
| Losses | Over R$ 3 million |
| Warrants | 8 temporary arrest, 9 search warrants in Brasília, Salvador and Itabuna |
| Possible charges | Electronic fraud theft, criminal association, money laundering (up to 21 years combined) |
How did the card fraud work?
- Insider access: the employee allegedly entered the system that issues authentication codes — the layer meant to prove the cardholder is the one buying.
- Card use: other members in the Federal District and Bahia made the transactions.
- Laundering: proceeds went to merchants tied to the group, moved through pass-through accounts and were split among members; part was converted into crypto.
Authentication codes exist to stop criminals who only have a card number. When an insider can generate or see them, purchases look legitimate to fraud filters.
Why is insider fraud so dangerous?
Most scams rely on tricking the customer — a fake bank call, a phishing link, a skimmed card. In insider fraud the customer does nothing wrong; the risk lies in privileged access held by staff or vendors. Institutions must reimburse, investigate and, when personal data is involved, assess breach notification under Brazil's LGPD (see Brazil regulation). The money trail — shell merchants, pass-through accounts, crypto — is classic money laundering.
What happens next?
Police said they are analyzing seized material to identify other participants. The arrests are temporary, a measure used during investigations; no indictment or conviction has been reported. The institution was not named, so affected customers should expect contact from the cooperative itself — not from third parties calling and claiming to be the police or the bank. The case shows why access controls, logging of who views each system and separation of duties matter inside institutions as much as customer education does outside them.
What to do if you see a charge you didn't make
- Dispute it right away through the app or the number on the back of your card, and ask for a new card.
- Turn on real-time purchase alerts and review every statement line.
- Keep the protocol number; escalate to the ombudsman, the Central Bank or consumer agencies if refused.
- File a police report so investigators can link similar cases.
- Never trust a caller offering to "reverse" the charge — scammers exploit news like this (fake bank call center scam).
Follow new cases on the Radar.