Banks Won't Be Able to Offer New Money to Indebted Customers. The Rule Helps You Spot the Fake Loan Scam
Resolução BCB nº 602, published on October 26, lets customers choose which products they agree to receive offers for and, for those already in debt, limits credit offers to renegotiating existing debt. It takes effect on March 31, 2027. For crypto, the only change is the choice. And it replaces a stricter rule that never came into force.

▸In this article
On October 26, the Banco Central do Brasil published Resolução BCB nº 602 in the Diário Oficial, setting out how banks, payment institutions, brokerages and virtual asset service providers may send advertising and individual commercial offers to retail customers. The part that matters to the customer takes effect on March 31, 2027, and institutions have 120 days from publication to adapt their systems and channels.
The rule has two layers. One applies to everyone and is a choice. The other applies only to those in a fragile financial position, and is a restriction. Conflating the two leads to reading the rule as something it is not.
The choice, for every customer
The resolution covers individual offers of credit, virtual asset services, foreign exchange and payment services — credit cards included — as well as products from brokerages, securities dealers and consortium administrators. An active offer, under the rule, is any commercial communication originating from the institution, or from anyone acting on its behalf — including banking correspondents and Banking as a Service partners — directed at a specific customer who did not ask for it.
Institutions will have to give customers the option of stating which products they agree to receive such offers for, displayed prominently in every channel used to make offers: app, website, ATM, email, SMS, push notification, instant messaging, virtual assistant. Customers may revoke any authorization at any time, with immediate effect, and the institution must remind them of this every six months.
The heaviest point sits in Article 4, §1: if the customer makes no choice, the institution may keep offering every product. This is an opt-out model, not an opt-in. Anyone who never touches the setting keeps receiving offers exactly as they do today.
The same applies to cryptocurrencies. The rule does not restrict crypto offers: it gives the customer the right to refuse them, product by product.
The restriction, for those already in debt
The second layer applies only to credit and credit cards. For customers the rule describes as being "in circumstances that demand qualified attention," active credit offers face two constraints at once (Article 5, §1):
- they require the customer's prior authorization, specific to each product type, which cannot be granted in bulk and must be renewed at least once a year;
- and they are limited to renegotiating, porting or migrating existing debt to more favorable terms, "with no possibility of offering additional disbursements," save for cases provided for in other regulations.
In other words: even with authorization, the offer made to such a customer cannot be new money.
Who falls into this group is defined by Article 6. The institution must consider, at a minimum, whether the customer's available income is insufficient — or at material risk of becoming insufficient — to cover the minimum subsistence threshold; whether there is vulnerability or lack of financial literacy tied to age or education; whether the customer persistently uses revolving credit or installment plans on the card bill; and whether they persistently carry overdue debt within the financial system. Persistence is presumed in two objective cases: revolving credit or installment plans on three or more bills within a six-month period, and debt overdue by 90 days or more.
The income criteria are set by each institution, on an "objective, consistent and verifiable" basis, according to the rule. That is why customers have no way of knowing, from the outside, whether their bank has placed them in this group. The two presumed cases are the ones they can recognize on their own.
In every case, indebted or not, an offer may only be presented after assessing whether the credit suits the customer's profile and their actual capacity to repay (Article 8).
The rule that 602 replaced before it ever took effect
Resolução 602 repeals Article 6 of Resolução BCB nº 567, from May 2026, which had not yet come into force: 567 only takes effect on July 1, 2027. The repealed article went further. It conditioned every credit and card offer in digital channels on the customer's "prior authorization," drawing no distinction based on indebtedness. It required advertising to carry a warning about the risks of the product. And for customers with overdue credit, it limited offers to swaps into less costly products.
The new rule moves the date forward, from July to March 2027, and widens the protected group beyond those merely in arrears. But it swaps prior authorization from all customers for a choice that, if the customer never makes it, leaves the offers flowing. We found nothing in 602 requiring the risk warning in advertising that the repealed article called for.
What this has to do with scams
The fake loan scam targets precisely the people the rule protects. The Federação Brasileira de Bancos describes criminals posing as financial institutions and promising "easy release of money for consumers with bad credit," then charging fees and taxes to release credit that never arrives. "There is no such thing as a loan that requires any kind of upfront payment," Febraban says.
From March 31, 2027, the rule gives people in that situation a second signal. If your account has been overdue for 90 days or more, or you have used revolving credit on three or more bills in the past six months, and you receive an unsolicited offer of "new pre-approved credit" in your bank's name, that offer runs against the rule. Either the bank is breaking it or — far more likely — it isn't the bank.
The signal has limits, and it is worth being clear about them. The rule binds the institution, not the scammer, who follows no rules at all. It only applies from March 2027. And the customer's classification is made by the bank, which may use criteria the customer cannot see. The signal is grounds for suspicion, not proof that an offer is genuine. An offer that complies with the rule can still be fake.
The practical rule is unchanged: real credit never charges anything before releasing the money. Check the offer by opening your bank's app yourself, not through the link or the number that came in the message. The rule leaves the customer free to initiate a contract within the product environment, and that is the safest route.
In one line
From March 31, 2027, a bank cannot offer new money, on its own initiative, to a customer already in debt. An offer like that arriving over WhatsApp is one more reason to be suspicious.
Sources
- Banco Central do Brasil — Resolução BCB nº 602, de 23 de outubro de 2026 (DOU of 10/26/2026, Section 1, p. 138)
- Banco Central do Brasil — Resolução BCB nº 567, de 4 de maio de 2026 (Article 6 repealed by Res. BCB 602)
- Febraban — Febraban alerta para o golpe do falso empréstimo (05/23/2023) and Bandidos estão usando nome da Febraban para aplicar golpes na população (02/12/2025)
About the author

Robert F.
request a secure channelRobert F. is the founder of CyberX, a digital intelligence operation applied to investigation, based in Brazil with cross-border reach.
He works in OSINT, on-chain tracing and antifraud for legal teams, corporate compliance, banking antifraud and public authorities.
In CyberX publications we write about what can be said in public — fraud and scam typologies, digital threats, on-chain tracing, regulation, and what separates an investigation from a database lookup. Never about a case we work on, clients, matters under judicial secrecy, or operational detail that would compromise an investigation in progress — ours or anyone else's. A third party's case enters through the public official act, and through what it teaches, not through what it exposed.
Related reading
CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing, and fraud prevention. This content is informational and does not constitute legal advice.
how we write →Source: https://cyberx.to/en/news/banks-wont-be-able-to-offer-new-money-to-indebted-customers-the-rule-helps-you-spot-the-fake-loan-scam
Retrieved on