The resolution published on 18 September gives institutions seven days to answer a request to cancel a flag, requires them to keep a record of their reasoning, and sets the flag's lifespan at five years. The duty to notify the flagged person, however, only begins on 1 February 2027 — and does not include the reason.
Two different scams are circulating under the same name. In one, the QR Code hides a link and leads to a fake site. In the other, the QR is a payment and the payee has been swapped. The figure that made headlines measures only the first — and the defense against one is useless against the other.
A script injected into Brazilian online stores swaps the Pix QR Code and the copy-and-paste string at the moment of payment, for the exact amount of the purchase. There is no flaw in Pix: the payer's only defense is the payee name that Central Bank rules require the app to display — and that is precisely the name e-commerce has made impossible to verify.
Revolut handed over documents, verification selfies and customer statements to someone writing from a legitimate government domain. The request was fake. In Brazil, the law lets an administrative authority demand subscriber data without a judge, and the urgency exception widens that door further. What the Brazilian rule limits — and what it doesn't prevent.
The Banco Central promised that 2026 would bring a lookup showing whether your Pix key had been flagged for fraud — and warned, at the same press conference, that it would not include the reason. As of September 2026, neither exists. The report that does exist has a field called "Situação" (Status), and it answers a different question.
The flag can be created by a single institution acting alone, with no review by any other participant, under a standard the Banco Central itself put in writing that it has yet to define in objective terms. It circulates for five years among every institution — and access to the endpoint that exposes it is barred to the end user.
The rule that extended the contestation window carries two effective dates. Coverage reported the first one. On the second, the infraction report will be required to state which layer of the tracing graph the transaction sits in.
Brazil's Special Return Mechanism has six deadlines, and they don't carry equal weight. Five are service-level targets, measured by percentile. One is a deadline with an automatic consequence — and the party that misses it is the defrauded customer's own PSP.
The Brazilian Central Bank will add to each infraction notification the hop depth at which a transaction sits along the fraud trail. Layering stops being invisible to whoever receives the notification — and the first-hop problem finally gets a number.
As of September 1, the window to contest a Pix return transaction goes from 30 to 80 days. It is the recourse available to whoever was debited by a MED they consider improper — and every wrong call along that chain has an owner named by the rulebook.
In July, the STJ held that banks are not automatically liable for the fake call-center scam. Nine months earlier, the same panel had ruled against a bank. The contradiction is only apparent — what shifted was not the doctrine, but the burden of proof.