Pix security: MED 2.0, the dispute button and new Central Bank rules

Dispute button, MED 2.0 money tracing, new-device limits and BC Protege+: Brazil's Central Bank rules to fight Pix fraud and how victims can use them.

2026-10-23

Brazil's instant payment system, Pix, has had a refund mechanism for scams since 2021: the MED (Special Return Mechanism). It worked poorly because criminals moved the money through several accounts before victims complained. In 2025 and 2026, the Central Bank overhauled the rules.

What changed

28 August 2025: BCB Resolution 493 published the new MED rules (Agência Brasil).
1 October 2025: a dispute button became available in banking apps. The claim goes instantly to the fraudster's bank, which must freeze available funds; both banks have up to seven days to analyse and refunds are due within 11 days (Mercado & Consumo).
23 November 2025: tracing and refunds from accounts beyond the first recipient became available on an optional basis.
2 February 2026: MED 2.0 became mandatory for all Pix participants, with a grace period on enforcement until 10 May 2026 under BCB Resolution 546 (Finsiders).

Following the money

MED 2.0 follows funds through intermediary accounts and institutions and shares tracing data among participants. The rules also broaden criteria for precautionary blocks of suspicious accounts and keys and strengthen information sharing with law enforcement (Asaas). The MED covers fraud, scams and coercion, not buyer's remorse, commercial disputes or typing errors.

Other safeguards

New devices: phones never used for Pix are limited to R$200 per transaction and R$1,000 per day until registered with the bank; banks must also check at least every six months whether customers carry fraud flags in the Central Bank database (Inteligência Financeira).
Night-time cap: since October 2021, transfers by individuals between 8 pm and 6 am are limited to R$1,000 (Jornal Contábil).
BC Protege+: launched in December 2025, it lets people block accounts from being opened in their name; it stopped 111,000 suspicious account openings in its first month (Finsiders).

In September 2026, the Central Bank also announced that exclusion from Pix as a penalty will take effect immediately rather than after 30 days (Portal de Prefeitura).

Limits of the system

MED 2.0 still depends on funds being available in the traced accounts when the freeze happens. Money already withdrawn in cash, converted to crypto or sent outside the system is hard to recover, and the mechanism does not reach good-faith third parties, such as a merchant who sold a real product to the fraudster (Mercado & Consumo). That is why the Central Bank pairs it with preventive tools that try to stop mule accounts from being opened and block transfers from unknown devices.

For banks, the changes are also operational. Institutions offering Pix must use fraud-risk solutions that draw on security data held by the Central Bank to flag atypical transactions, and must treat customers with fraud flags differently, for example by ending the relationship, applying longer authorisation times or placing precautionary blocks on incoming funds (Inteligência Financeira).

If you are scammed

Act fast: the sooner you dispute, the more likely funds remain.
Use the dispute button in your bank's app.
File a police report and keep screenshots and receipts.