Two different scams are circulating under the same name. In one, the QR Code hides a link and leads to a fake site. In the other, the QR is a payment and the payee has been swapped. The figure that made headlines measures only the first — and the defense against one is useless against the other.
Revolut handed over documents, verification selfies and customer statements to someone writing from a legitimate government domain. The request was fake. In Brazil, the law lets an administrative authority demand subscriber data without a judge, and the urgency exception widens that door further. What the Brazilian rule limits — and what it doesn't prevent.
A manifesto against the industry, a leak that held the world's attention, and, in every video, a QR code to buy the coin named after the manifesto. The order of events — all of it public — is what reveals the pattern: the token came before the cause.
Investment fraud doesn't pick victims by social class — it picks them by database. And what the database defines isn't how much to extract; it's when to stop paying.
The standard that classifies authenticators puts SMS codes and app codes in the same bucket: neither one holds up against phishing. The attack that dominates today doesn't break the code — it lets you type it correctly and keeps the result.
An operation by the Civil Police of Pernambuco lays bare what prevention guides rarely show: the fake investment scheme isn't a lone fraudster improvising. It's a structure with an office, a script and a monthly target.
The scam doesn't convince the victim all at once. It walks them through six stages, each designed to make the next one seem reasonable. Understanding the funnel is what makes it possible to interrupt before the last stage.