Brazil’s BCB 766 updates Pix MED

Operation timeline

Attack chain and TTPs

The Pix rule update is not explained by a single abuse technique, but by a set of vectors that repeat and overlap. The dominant pattern that emerges from the research is social engineering backed by instant messaging, fake calls, sponsored ads, cloned sites, and, increasingly, AI used to make the scam more credible. The chain often ends in a Pix transfer, but the setup varies. Sometimes it is a fake bank hotline. In other cases, it is an nonexistent rental, debt renegotiation, fake public benefits, or counterfeit charges from official agencies.

MED 2.0 was designed precisely to deal with a reality in which the money does not always stay in the first account that receives the fraudulent Pix. Finsiders Brasil and Folha Jundiaiense explain that the new architecture allows the mapping of the "tree" of transactions derived from a root transaction and allows partial blocks across several banks, so the total can reach the original amount even when the money has been spread out. That matters because criminals split funds to make tracing and restitution harder.

Infraction notifications are the coordination mechanism. Migalhas notes that DICT allows the identification of fund-diversion routes and the coordination of sequential blocks and refunds between institutions. Version 8.5 adds a graph-depth field, TransactionDepth, to indicate the layer to which the notification belongs. Diario do Comércio reported that this information will appear starting October 26, 2026, in notifications sent to the participant holding the potentially fraudulent account.

The criminal tactic, by contrast, still relies heavily on the human factor. Correio do Povo cites studies that attribute about 40% of financial fraud in Brazil to social engineering, with variants such as fake bank hotlines, impersonation of bank employees, and fake police operations. Super Rádio Tupi added that criminals buy online traffic, purchase databases, and use AI to refine messages and ads before closing the capture with a financial payment. The material also reports cases where real personal data, such as CPF and date of birth, are used to simulate individualized service.

Regional impact

Regional overview

The regional impact of the change is concentrated in Brazil, because that is where Pix, DICT, and MED form a unique operating ecosystem. No additional verifiable facts are available in the supplied material for the rest of the bloc’s countries. Within Brazil, the reform affects banks, fintechs, acquirers, payment service providers, merchants with high Pix volume, and antifraud teams that will need to adjust reconciliation, notification response, and identity validation.

Brazil

Brazil is where the regulatory change sits, and the rest of the countries in the report do not have additional factual coverage in the research. Normative Instruction BCB No. 766 and its later adjustment, No. 767, reorganize the effective dates for changes to the DICT Operational Manual in two broad blocks: August 10, for initial tracing and monitoring, and September 1, for the expansion of the MED response deadline. Some of the operational changes tied to infraction notifications move to October 26.

The reading of the sources separates three layers. The first is the regulatory layer, with version 8.5 of the manual and the repeal of IN No. 752. The second is the technical layer, where tracing attributes, CPF and CNPJ validation against Receita Federal, rules for Pix Automático in the event of operational errors, and a notification structure capable of reflecting transaction depth are added. The third is the antifraud layer, with MED 2.0, the ability to trace funds in layers, and centralized signals to support block or refund decisions.

At the same time, fraud pressure is national and concrete. The data gathered by the business press and sector studies shows sharp growth in losses, a low effective recovery rate, and a range of scams that no longer rely only on phone impersonation. There is Pix fraud in fake debt renegotiations, rental listings, charges for nonexistent benefits, messages exploiting public programs, stores that receive altered payment receipts, WhatsApp-based contagion, and attacks that use malware to capture credentials or SMS messages. That is why the BC is also pushing scam alerts to customers and a centralized fraud-probability indicator with AI.

The practical consequence is that risk management is no longer just transactional. Institutions will need to consolidate key verification, atypical-pattern analysis, detailed reconciliation, request traceability, and response to infrastructure and recovery notifications. Revista Empreende warns that merchants and platforms also need finer records because the tracing flow can reach later accounts, not just the first receiving one. Finsiders adds a legal point: if institutions do not structure the accept-or-reject flow for refunds well, they may face actions from victims and from recipients affected by chargebacks.

Technical indicators

No classic IOCs, such as hashes, IPs, or unique domains tied to a single actor, were published in the consolidated material. What is verifiable in this research are operational and regulatory indicators that are useful for fraud monitoring and compliance.

Analysis for security teams

The Pix update forces a separation between prevention, detection, and response. On prevention, the first adjustment is identity. Version 8.5 of the DICT Operational Manual incorporates CPF and CNPJ validation against Receita Federal databases when registering or changing Pix keys, which makes directory hygiene stricter. For banks, fintechs, and PSPs, that means cleaning up onboarding and key-change processes, because poor validation can open the door to accounts used as intermediate steps in fraud.

On detection, the focus can no longer stay on the individual transaction alone. The material shows that fraud is fragmented across several institutions and several accounts. MED 2.0 and layered tracing make it possible to follow the money trail and request partial blocks, but that capability depends on teams operating alert rules for unusual behavior, unusual concentration of recipients, the speed of fund dispersion, and matches with known scam patterns. The court cases cited in RRR Advogados and Correio Braziliense show that the absence of preventive blocks or timely reaction can end in judgments against banks.

On response, the operational priority is to coordinate timing. The system is entering a phase in which some rules already apply from August 10, others from September 1, and certain notifications change only on October 26. That means mapping dependencies between technology, legal, customer service, and fraud prevention. If an institution updates only the customer-facing front end, but not its internal blocking and refund workflows, it will face a double burden, from the victim seeking recovery and from the recipient challenging a reversal.

The attack surface is also human. The CERT.br and M2Works guides are explicit: after a suspected scam, cut contact, open the official app, locate the transaction, register the dispute as fraud or social engineering, request MED activation, and preserve evidence. For security and fraud teams, that turns into two concrete tasks. The first is educating users and call centers so they do not validate requests through unofficial channels. The second is ensuring that evidence reaches the back office intact, including messages, links, receipts, and access traces.

At the prioritization level, three vectors stand out as most urgent. One is fake hotlines and institution impersonation, because they still account for many cases and rely on low-cost social engineering. Two is attacks using real data and visual props, such as the Desenrola scam or AI-based campaigns, because they increase the victim’s trust rate. Three is mobile malware and compromised accounts, because they leave a harder-to-reverse footprint and can enable real-time transfers. In all three cases, the operational goal should be to contain fund fragmentation and improve response quality in the first hours.

Frequently asked questions

What exactly changed in Pix between August and October 2026?

The DICT and MED operating framework changed on three dates. On August 10, the new monitoring tied to laranja account tracing began. On September 1, the deadline to respond to MED refunds was extended to 80 days. And on October 26, more detail will be added to certain infraction notifications, according to the Central Bank.

Does the new MED version give victims more time to request a refund?

No. According to Revista Fórum and Finsiders Brasil, the up to 80-day period for the victim to request MED activation already existed. What was extended to 80 days was the time for the recipient or institution to respond to a suspected fraud refund. The difference affects the system’s internal response.

What is the connection between layered tracing and WhatsApp scams?

Layered tracing addresses fraud that does not end with the first transfer. The material shows that many scams use WhatsApp as the initial vector and Pix as the final step, and that the money is often split across multiple accounts. That is why MED 2.0 seeks to follow the full path, not just the first transfer.

What should banks and fintechs do under the new rules?

They need to validate CPF and CNPJ better in Pix keys, respond to notifications within the new deadlines, prepare detailed reconciliation, and support partial blocks across multiple institutions. They also need to work with scam alerts and with processes that can stand up in legal disputes involving victims and recipients if they identify unusual transactions.

What types of fraud appear most strongly in the material?

The strongest patterns are fake bank hotlines, ghost rentals, Desenrola scams, phishing that imitates Receita Federal, AI-based ads, and Android banking trojans. All of them share the same end point, either prompting the user to transfer via Pix or enabling fraudulent transfers from compromised devices or accounts.

Does the Central Bank consider Pix’s central infrastructure compromised?

No, according to Olhar Digital, the Central Bank said Pix’s central infrastructure never suffered a successful attack. The issue addressed by IN No. 766 is not a system outage, but the fraudulent exploitation of its flows through social engineering, rental accounts, phishing, and malware.

Material limitations

The research does not include the full text of Normative Instruction BCB No. 766 or No. 767, so this report reconstructs their effects from specialized coverage and secondary technical descriptions. There are also no classic IOCs attributable to a single actor, and not enough data to state with precision how each technical validation is implemented internally across all participants.

No additional facts were verified for Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States, or Uruguay. The available factual coverage is concentrated in Brazil and its Pix infrastructure. The centralized fraud-probability indicator with AI appears as a project under development, with no confirmed deployment schedule in the material.

As for MED 2.0, some sources present it as already in production since May 2026, but the available excerpt does not detail the specific regulatory devices that activate each phase. For that reason, this report preserves the exact timing attribution when it was verified and treats the difference between prior production and the staggered enforcement of later changes as an operational distinction.