The MED didn't get your money back. What the rule says and what you can still do

The Mecanismo Especial de Devolução — the MED — is the procedure Banco Central created for Pix transfers made under a scam, fraud or crime. You dispute the transaction in your bank's app, the bank opens a recovery request, and the bank that received the money is required to freeze the amount and review the case.

What the MED does not promise is an outcome. It returns whatever it finds. This article is about what to do when it finds nothing.

First, what the request actually does

When you file a dispute, the bank that received your Pix is notified and must freeze the amount in the recipient's account immediately. If the account holds less than the amount claimed, whatever is there gets frozen, and any credits that land in it during the review are frozen too, accumulating until they reach the amount of the scam.

From there, the process has three timed stages: up to 7 days for the recipient's bank to review the case, up to 72 hours for your bank to initiate the return, and a target of 6 hours (in 99% of cases) for each bank in the chain to send the money back, one at a time. Under normal conditions, the outcome lands in about ten days. We explain here why the 72-hour deadline is the one that matters most.

When you open the request, your bank must not require a police report, nor assess whether you are right. The Banco Central guide is explicit: open first, review afterwards.

Why the money doesn't come back

There are three common reasons, and none of them is within your control.

The destination account was empty. Scammers don't leave money sitting still. If the funds were already gone when the freeze arrived, there is nothing to freeze.

The money had already moved on. The MED follows the money across more than one account, along a chain Banco Central calls a tracing graph. But it follows one link at a time, and every link is another chance for the money to have been withdrawn, converted or dispersed. From 26 October, the notification exchanged between banks will state which layer of that chain the transaction sits in. That's data for the banks, not a new screen for you.

The account was closed. Accounts used in scams tend not to last long.

And there is a fourth, less well-known point that shuts the door afterwards. From the guide:

"Não há mais necessidade de o participante monitorar a conta após a conclusão da solicitação de devolução, em caso de devolução parcial ou rejeição da solicitação por ausência de saldo."

— MED guide, version 4.4, section 4.2.4

In other words: money that enters that account later is not captured by the same request.

Nobody covers the loss out of their own pocket

This is the general rule, and it is the harshest sentence in the guide for anyone who has lost money:

"Caso o PSP do recebedor rejeite a solicitação de devolução por falta de fundos, por encerramento de conta ou por qualquer outro motivo, ele não tem nenhuma obrigação em devolver recursos para o usuário pagador usando recursos próprios."

— MED guide, version 4.4, section 4.2.5

The same applies to your own bank, provided it complied with the Regulamento do Pix when authorising the transaction. Put plainly: if the scam happened and the money vanished, neither bank is obliged, on that basis alone, to cover the loss.

When the loss becomes the bank's

The general rule has two exceptions, and both arise from a bank's error, not the scammer's.

The recipient's bank rejected the case, and it really was a scam. If it refused the notification in a case that was in fact fraud, a scam or a crime, it becomes liable for the refund.

The recipient's bank accepted it, and your bank didn't see it through. If the notification was accepted but your bank cancelled the recovery or failed to request the return, liability for the refund falls on your bank.

This is where it pays to check the status of the request. For individuals, the bank must make the disputes viewable in the app, showing the case number, the status (under review, approved, rejected or cancelled) and the amount returned. A rejected or cancelled request does not prove the bank erred, but it is the cue to ask why, in writing.

Outside those two situations, there is still the separate argument about the bank's own failure in letting the transaction through — for instance, when it was completely out of character for your profile. That is an argument for the courts, and recent STJ case law now requires proof of that failure case by case.

The formal route: complain to Banco Central

The guide states that anyone who feels wronged by a bank's conduct during the MED may open a dispute against it, under the terms of the Manual de Resolução de Disputas do Pix. In practice, that means a complaint filed through the Registro de Demandas do Cidadão (RDR) system on the Banco Central website. The rules are in section 3 of the manual, and four of them determine whether the complaint will get you anywhere:

The deadline is 45 calendar days from the event you are complaining about. The manual says that attempting to resolve the matter directly with the bank interrupts that clock until the bank issues a formal reply through its service channels. That is why the first step is to complain to the bank, in writing, and keep that dated reply.

Everything has to go in at once. It is the complainant's responsibility to attach sufficient documents and evidence at the moment of filing. Once filed, the complaint will not accept new attachments on your initiative.

One complaint per event. You cannot open multiple requests about the same case. The bank answers the second one by citing the number of the first.

The bank has 10 business days to reply, conclusively, on everything that was raised, and may request a single extension of equal length, informing you of the reason. Banco Central may request information from everyone involved and consult Pix's own systems to analyse the case.

Filing with the RDR is not a verdict: the manual obliges the bank to respond and allows Banco Central to request information, but it does not describe a BC ruling on your case. It is the MED guide that speaks of disputes being won or lost, and it is the guide that says the losing party may take the matter to court.

What to keep from day one

The dispute accepts no attachments after filing, and a court case rests on evidence. So whatever you gather at the outset is what will count:

• the Pix receipt and the case number of the dispute in the app;
• screenshots of the request status at every change, dated, including the amount returned;
• the entire exchange with the scammer: messages, profiles, links, numbers;
• the bank's formal replies, dated, by email or through the official channel;
• the police report, which the bank cannot require in order to open the MED, but which carries weight in the complaint and in court.

And the clock at the very start: the in-app dispute only accepts transactions up to 80 days old. After that, the app itself tells you the MED window has expired.

In one line

The MED returns what it finds, not what you lost. When it fails for lack of funds, nobody makes you whole; when it fails because a bank erred, that bank foots the bill — and the complaint to Banco Central has a 45-day window and accepts no attachments after filing.

Fell for a scam, or nearly did? Report the case. A report won't recover your money, but it helps map who is running the scam and warns whoever comes next.

Sources

• Banco Central do Brasil — Guia de implementação dos procedimentos de devolução no Pix, com ênfase no Mecanismo Especial de Devolução, versão 4.4, in force since 1 September 2026. Sections 4.2.4 (flow and freezing), 4.2.5 (liability) and 6 (self-service).
• Banco Central do Brasil — Manual de Resolução de Disputas do Pix, versão 5.0, section 3, "Resolução de disputas entre participantes e usuários finais do Pix".
• Banco Central do Brasil — Registrar reclamação.
• CyberX — No relógio do MED, o único prazo que solta o dinheiro é o do banco da vítima
• CyberX — MED não é chargeback: quem sofre uma devolução indevida ganha 80 dias para reagir
• CyberX — Golpe da falsa central: a responsabilidade do banco saiu do automático e foi para a prova