Neobanks, FinTech, and PSPs, August 2026

Active Threats and Campaigns

In August, the region was not dominated by a classic ransomware campaign against fintechs, but by an ecosystem of fraud, extortion, and abuse of payment infrastructure. That distinction matters because it changes which controls should be prioritized: authentication and authorization, processing integrity, counterparty monitoring, and coordinated response with payment networks and regulators.

Ransomware and Extortion

There were two cases where ransomware or extortion was the main focus, and in both the available material makes the financial pressure component clear. The first was the Brazilian Federal Police investigation into a group that breached the system of a financial institution and demanded 10 bitcoins not to disclose sensitive data. Coverage by Correio Braziliense adds that the demand was equivalent to approximately R$ 328 mil.

The source does describe a classic extortion case, with a threat to leak information and payment in cryptoassets. The material does not provide enough detail to say whether assets were encrypted, so it should be described as extortion with a disclosure threat, not as confirmed ransomware with encryption. That nuance avoids conflating legal impact with operational impact.

The second case linked to economic pressure or damage was the exposure in the crypto ecosystem of Avici and Rain cards, but it does not fit the same category. In that case, the vector was an authorization vulnerability in card contracts, not extortion. Recovery came through refunds and patches, not negotiation with attackers.

Fraud and Phishing

Fraud was the dominant threat in August and cut across several subsectors. The TAG case involved an attempted diversion of receivables, the Riccheri incident involved operational collection fraud, and Chile provided a persistent statistical signal of rising fraud in digital channels, especially debit and credit cards.

What stood out in August is that much of the fraud did not remain a mere attempt. There were blocked cases, alerts, and referrals to authorities. That means the sector is detecting more, but exposure is also high. The fact that 25 of 83 verified incidents were documented fraud or phishing shows sustained pressure on the transactional layer.

The reading of the Brazilian cases is that fraud no longer depends only on deceiving the end user. It can also mean manipulating trusted relationships between registrars, acquirers, and destination accounts. Chile, by contrast, underscores the persistence of risk in everyday payments and the greater weight of debit cards. These are two sides of the same problem.

APT and Organized Intrusion

The material did not show a classic APT campaign attributed to a persistent group with a regional focus on neobanks or PSPs in Latin America. There are signs of organized intrusion, such as the Brazilian investigation into the attack on a German financial institution, and the cases of intrusions into financial systems in Brazil. But the material is not enough to classify this as an APT campaign in the strict sense.

The absence of a clearly documented APT campaign does not mean there was no sophisticated intrusion. It only means August was dominated by fraud, extortion, processing errors, and contract vulnerabilities, not by solid attribution to a persistent actor. For defensive intelligence, that is also useful signal, the ecosystem is closer to large-scale fraud than to a discreet, long-running offensive operation.

Critical Vulnerabilities

The analyzed material recorded 1 critical CVE mentioned during the period, but it did not identify it by number or with enough technical detail to build an exploitation table. That does not mean critical vulnerabilities were absent in the region, only that the month was dominated by operational incidents, fraud, and financial fraud cases, not technical CVE disclosures.

The practical lesson from this block is that the critical attack surface in the sector is not limited to traditional software. In August, the clearest vulnerability did not appear as a CVE exploited in a banking app, but as a contract logic problem and a flawed update in the payments and cards layer. That calls for a broader risk inventory beyond software installed on servers.

Regulation and compliance

August brought four documented regulatory moves, and all point in the same direction: more reporting obligations, stricter response requirements, and tighter oversight of payment providers. The region is not seeing any loosening of controls, but a tougher notification and oversight framework.

In Chile, the Central Bank published and explained its 2026 Payment Systems Report, with a focus on digital fraud and the persistent increase since 2024. The official material matters because it does more than describe losses, it pushes for stronger regulatory measures and action by payment service providers. That framing puts the sector under direct scrutiny.

TrendTIC noted that, under Chile’s Cybersecurity Framework Law, public and private institutions designated as Critical Infrastructure Operators or Essential Service Providers must report to the National CSIRT any cyberattack or incident with significant effects. For the payments ecosystem, that means part of the industry now faces more demanding and earlier formal reporting duties.

In Brazil, the official response to fraud and intrusions was also institutionalized. The Federal Police announced operations such as Pane Seca, Ouroboros and Klonen, with coordination of investigations and communication with the relevant authorities. Although these are not regulations in the strict sense, they point to an environment in which financial fraud, money laundering and cyber intrusion are being pursued in a more integrated way.

The TAG case also showed the value of reporting and cooperation among private actors. The company activated protocols, blocked access and notified the authorities, while industry groups alerted their members. In compliance terms, that response matters as much as preventive control, because the operational standard is no longer just to avoid the incident, but to prove traceability and containment.

Countries and subsegments most affected

The month’s geographic distribution was uneven. Argentina, Brazil, Chile, and Peru stood out, each with a different level of detail. At the subsegment level, the most exposed areas were banking and acquiring, payment processors, digital wallets and exchange platforms, and the crypto card ecosystem.

Argentina

Argentina was defined by the Riccheri case, which put the integration of electronic tolls, virtual wallets, and payment reconciliation under scrutiny. The impact was highly visible because the deviation involved amounts hundreds of times higher than expected and because media coverage was extensive. For the PSP subsegment, the episode is a reminder that a calculation failure can have nearly the same reputational effect as a breach.

The complaint process documented by Alerta Tránsito also shows a formal response chain involving the concessionaire, TelePASE, and, ultimately, Vialidad. That sequence is useful for understanding how billing incidents are handled in critical mass-service infrastructure. This was not a cyberattack, but it was a breakdown in transaction integrity.

Brazil

Brazil was the country with the highest concentration of incidents involving financial fraud, extortion, and police investigations. The three clearest threads were the attempted R$ 350 million fraud against TAG, the Pane Seca, Ouroboros, and Klonen operations, and the investigation tied to an attack on a German financial institution with suspected involvement of a Brazilian group.

The subsegment reading is equally clear. Stone, TAG, payment processors, acquiring, banks, and payment ecosystems appear interconnected. On top of that, there are signs of laundering through transit accounts, companies, and virtual asset platforms. Brazil showed a payments-chain problem, not an isolated incident at a single institution.

Chile

Chile contributed fewer specific incidents and a stronger structural signal. The Central Bank of Chile reinforced a narrative of persistent growth in digital fraud, with higher incidence in debit cards and reported losses of US$98 million in the first half of 2026. That affects issuers, acquirers, and payment providers directly.

The sector relevance is twofold. First, fraud rates are rising across nearly all payment instruments. Second, the central bank itself is calling for stronger regulation and controls. In risk terms, Chile appears less as a country with a single incident and more as one where the numbers are already forcing control redesign.

Peru

Peru enters through Kambista, which reported a possible data exposure in its cloud infrastructure. Although data extraction was not confirmed, the decision to notify users in advance reflects compliance sensitivity and reputational management. For a digital exchange fintech, even the possibility of exposure can trigger internal review and communication obligations.

Subsegments

In the electronic wallets and payments segment, TelePASE and Mercado Pago accounted for the most visible failure. In acquiring and receivables processing, TAG was the most serious case. In banking and organized financial fraud, Brazil concentrated several official operations. And in crypto finance, Avici and Rain showed how card infrastructure can affect multiple programs at once.

Trends and signals to watch

The comparison with July shows a clear shift in focus. The previous month was dominated by vulnerabilities, with 40 of 66 incidents. In August, the center of gravity moved to fraud, with 25 of 83 incidents. That does not mean the technical surface improved evenly, only that the available material captured more operational incidents, more diversion attempts, and more cases of insufficient validation.

The rise in unclassified incidents, from 3 to 19, is a methodological and operational warning sign. For anyone managing a payments portfolio, it can mean the ecosystem is seeing more events whose true nature was still unclear at the time of publication. In practice, an unclassified incident has to be tracked as a potential breach, outage, or fraud until proven otherwise.

The drop in critical CVEs mentioned, from 15 to 1, also calls for caution. This is not an improvement in regional exposure, but a change in the type of events reported by the sources. August brought less technical vulnerability disclosure and more fraud cases, police operations, and processing problems. The right reading is a shift in attention, not a lower risk profile.

The strongest signal to watch is the combination of fraud and shared infrastructure layers. TAG, TelePASE, and Rain show that risk is not only at the end user level, but in the calculation, authorization, settlement, and contract update chain. That expands the exposure radius to processors, registrars, acquirers, wallets, and issuing partners.

Security team recommendations

Security teams at neobanks, fintechs, and PSPs should treat August as a month for payment integrity controls, not just intrusion prevention. The available evidence points to prioritizing transaction validation, fraud correlation, third-party monitoring, and response plans that include operational and legal communication.

First, integrity controls should be strengthened across the entire processing chain. The Riccheri case shows that a pricing error can move from capture to final debit without a containment barrier. That requires value limits, exception rules, reconciliation tests, and alerts for unusually large deviations before the charge settles.

Second, third-party dependencies and update contracts should be reviewed. The Avici and Rain incident shows that an old version of a card contract can remain active and become a point of failure. Teams should require version inventories, patch confirmation, anomalous behavior testing, and clear criteria for deactivating legacy programs.

Third, in Brazil and across any acquiring or registration network, counterparty monitoring should be part of the defense. The TAG case indicates that an alert from a third party can stop a large operation. That suggests integrating external signals, suspicious destination lists, cross-checking of accounts, and rapid escalation among ecosystem actors.

Fourth, response procedures should include the regulatory layer from the outset. In Chile, the obligation to report to CSIRT Nacional may apply to critical operators and essential providers. In situations with possible data exposure, such as Kambista, preventive notification and traceability of the internal analysis are as important as forensic review.

Fifth, fraud, extortion, and technical vulnerability should be clearly separated in internal classification. If a team mixes categories, it loses the ability to prioritize. August showed extortion with a threat of leakage, transaction fraud, processing failures, and a card contract vulnerability. Each requires different controls and different escalation paths.

Frequently asked questions

Which country showed the sharpest signal for digital payments in August?

Brazil concentrated the highest density of incidents tied to fraud, extortion, and official investigations, while Chile delivered the most persistent statistical signal on rising digital fraud. Argentina stood out for a mass processing failure at toll booths, and Peru for a possible data exposure at a fintech.

Was the TelePASE case on the Riccheri a cyberattack?

No, the available coverage describes it as a processing and billing error in the integration between TelePASE and Mercado Pago. The case was serious because of the amount debited and the control failure, but the material does not attribute a malicious intrusion. See the relevant incidents section.

What was the month’s predominant threat, and how does it relate to blocked operations?

The predominant threat was fraud, with 25 of 83 verified incidents. That includes blocked attempts, sector alerts, and diverted funds that were stopped, such as the TAG case in Brazil. The mix of detected fraud and thwarted fraud shows defenses are kicking in, but also that pressure remains high.

What does it mean that there were 19 unclassified incidents?

It means the month’s material recorded 19 events as breaches or disruptions, but without enough detail to classify them precisely from a technical standpoint. That does not make them less serious. For security and compliance, an unclassified incident should still be tracked as a potential exposure, disruption, or fraud until confirmed.

Was ransomware confirmed in neobanks or PSPs in the region?

The material records two cases with ransomware or extortion as the primary focus, but the available text does not allow us to confirm ransomware with asset encryption in a regional fintech. In the Brazilian case cited, there was extortion with a threat to leak data and a demand for 10 bitcoins, not verified encryption.

Which subsectors should review their controls first?

Acquiring, payment registration, digital wallets, digital exchanges, and neobanks with card infrastructure or legacy contracts. The month showed failures in electronic billing, attempts to divert receivables, possible data exposure, and a vulnerability in card contracts on Solana.

Material limitations

This report was built exclusively from the facts dated August 2026 provided in the research material. No internet or external material was used, and no sources outside the authorized list were included. The indicator figures reproduce exactly the base and time window reported for the period.

An indicator at 0, or a low value, does not mean there is no risk in the region. In particular, the fact that the critical CVEs mentioned are 1 in August only means that this was the material analyzed for this month, not that there were no critical vulnerabilities exploited in Latin America. The same applies to other categories if the corpus did not capture them.

The indicator window covers 83 facts dated August 2026, and the comparative data correspond to the previous month only as a reference for trend. Facts from earlier months were not counted within the period, although some were used to contextualize trends or explain technical background.

Consumer social networks and unauthorized posts as a primary source, sponsored content, commercial press releases, and any material not included in the list of available sources for citation were excluded from the evidence. Aggregated telemetry of automated attempts or blocks was also excluded, because it does not constitute an incident and cannot be added to the monthly counts.