A photo carries one date inside it, the device records another, and the service it passed through logs a third. Each belongs to a different owner, and each owner answers to a different law. That is why serious digital evidence is always correlation — and why serious correlation leaves a judicial paper trail.
The button exists, it's written into the USDT contract, and only Tether can press it. As a rule, the request comes from law enforcement, not the victim. Freezing stops the money, but it doesn't send it back on its own. And everything depends on the funds still being there.
Two different scams are circulating under the same name. In one, the QR Code hides a link and leads to a fake site. In the other, the QR is a payment and the payee has been swapped. The figure that made headlines measures only the first — and the defense against one is useless against the other.
A script injected into Brazilian online stores swaps the Pix QR Code and the copy-and-paste string at the moment of payment, for the exact amount of the purchase. There is no flaw in Pix: the payer's only defense is the payee name that Central Bank rules require the app to display — and that is precisely the name e-commerce has made impossible to verify.
A manifesto against the industry, a leak that held the world's attention, and, in every video, a QR code to buy the coin named after the manifesto. The order of events — all of it public — is what reveals the pattern: the token came before the cause.
Screenshot, file, timestamp, location: the reader calls all of it "evidence," while the law has a separate name for each one. Five of those names are defined by statute. The rest are forensic vocabulary. Knowing which is which is what separates what you present from what actually holds up.
The Banco Central promised that 2026 would bring a lookup showing whether your Pix key had been flagged for fraud — and warned, at the same press conference, that it would not include the reason. As of September 2026, neither exists. The report that does exist has a field called "Situação" (Status), and it answers a different question.
Investment fraud doesn't pick victims by social class — it picks them by database. And what the database defines isn't how much to extract; it's when to stop paying.
The flag can be created by a single institution acting alone, with no review by any other participant, under a standard the Banco Central itself put in writing that it has yet to define in objective terms. It circulates for five years among every institution — and access to the endpoint that exposes it is barred to the end user.
The SPA's public consultation closes on 9 September. The text repeals Ordinance 827/2024 in full, replaces two grounds for denial with twelve, and reaches operators that are already licensed.
Brazil's Special Return Mechanism has six deadlines, and they don't carry equal weight. Five are service-level targets, measured by percentile. One is a deadline with an automatic consequence — and the party that misses it is the defrauded customer's own PSP.
Section 512(h) of the DMCA hands over a user's identity with no lawsuit and no judge. Brazil chose the opposite path and never built an equivalent. The gap between the two models is being measured right now, at the Supreme Court.