Portuguese 
English 
Spanish 
4 min of reading 
0 comments 
A Decision By TJ-MG Held Two Digital Banks Responsible For Not Blocking Unusual Transactions Made After Scammers Gained Access To A Customer’s Phone. The Institutions Will Have To Refund The Amounts And Pay Compensation For Security Failure
The rise of virtual scams in Brazil has exposed a concerning fragility: the difficulty for financial institutions to identify operations that completely deviate from the customer’s pattern. And when this failure causes losses, the Courts have made it clear that the responsibility does not fall solely on the victim. This was the case in Minas Gerais, where a recent decision placed two digital banks at the center of a case that gained significant attention among consumers.
The story began when a bank customer received a call supposedly from the bank’s security. The scammers claimed that there was suspicious activity on her account and that she needed to follow a “verification procedure.” Convinced by the persuasive conversation and the sense of urgency, the customer clicked on a link that allowed the criminals to access her phone remotely. From there, they transferred money via Pix to third parties and even took out a loan in the victim’s name.
The losses were immediate. The criminals diverted 4,200 reais and took out a loan of 21,500 reais, all in just a few minutes. The customer filed a lawsuit against two digital banks, claiming a security failure, but the request was denied in the first instance. The judge of the 12th Civil Court of Belo Horizonte understood that the victim was solely at fault for allowing remote access to her device.
-
The noise law will no longer be in effect at 10 PM starting in June with a new rule valid during the 2026 World Cup.
-
The Chamber opens a debate on driver’s licenses at 16 years old as part of a reform that includes around 270 proposals to change the Brazilian Traffic Code and may redesign rules for licensing, enforcement, and circulation in the country.
-
The new Civil Code could revolutionize marriages in Brazil with “express divorce” and changes that could exclude spouses from inheritance.
-
Banco do Brasil sues famous influencer for million-dollar debt and intensifies debate on delinquency, risks of seizure, and direct impact on Gkay’s credibility.
The financial institutions reinforced this thesis in court. They argued that the customer herself validated the loan by sending a selfie and allowing the use of geolocation, in addition to stating that she should have been suspicious of the phone contact. For the banks, it was a classic scam that should not generate liability for the institution.
But the case took a different turn in the second instance. The 10th Civil Chamber of the Court of Justice of Minas Gerais completely overturned the sentence. Judge Octávio de Almeida Neves, the rapporteur of the case, was categorical in stating that the banks’ responsibility is objective when there is a failure in service provision, as determined by Summary 479 of the Superior Court of Justice. And, in this case, the failure was evident.
According to the rapporteur, none of the institutions presented effective mechanisms to identify atypical and high-risk operations. The transactions made by the scammers completely deviated from the customer’s pattern, who used the account almost like a savings account, with minimal transactions over time. Suddenly, large value transfers and a loan were taken out in quick succession, which should have triggered automatic security alerts. None of this happened.
The ruling highlighted that the banks did not present a transaction history that justified such a change in account behavior. For the court, the mere fact of validating such disparate operations demonstrates the existence of a serious defect in the service provided. The decision reinforced that it is not up to the consumer to prove that there was a system failure, but rather for the financial institution to demonstrate that it took all possible measures to prevent the scam.
The decision also reminded that Brazilian law protects consumers in situations like this. Both the Consumer Defense Code and the consolidated jurisprudence of the STJ determine that the responsibility of financial institutions includes fraud and crimes committed by third parties when there is a failure in security mechanisms. The validation of transactions incompatible with the customer’s profile, according to the court, highlights this type of failure.
As a result, the bank responsible for the transfers was ordered to refund, in double, the 4,200 reais diverted via Pix. The payment institution involved in the fraudulent loan was required to return the 21,500 reais that the scammers contracted. Additionally, both companies were ordered to pay, jointly, 5,000 reais for moral damages.
The decision serves as an important alert for the financial sector. In a scenario where digital scams are multiplying, it is not enough to offer modern applications and quick operations. Security must keep pace with technologies, and transaction validation must be capable of identifying abrupt changes in customer behavior. When this does not happen, the risk of the scam cannot be passed on to the consumer.
Cases like that of the “ghost hand” show how the social engineering applied by criminals has evolved. They use advanced techniques to convince victims, collect information, and execute operations in seconds. If banks do not strengthen their detection systems, they end up contributing to the occurrence of such frauds.
The decision by TJ-MG reinforces an increasingly clear message in the Judiciary: it is unreasonable to expect ordinary consumers to identify complex scams or sophisticated security failures. When an operation does not align with the customer’s history, it is the bank’s responsibility to act, block, investigate, and protect. When it fails, the responsibility lies with it.
-
-
2 pessoas reagiram a isso.