PIX Fraud 2026: Are Your Fraud Controls Ready for the Next Generation of Instant Payment Scams?

Shufti September 23, 2026 7 minute read

Back

The Irreversibility Problem

By the time a Pix alert fires, the money has already gone. The rail settles in seconds and leaves almost nothing to recover, so the control has to sit before the money moves.

Since 13 October 2025, Banco Central has made that compulsory. Resolução BCB nº 501 created a duty to reject payment transactions addressed to demand deposit, savings or prepaid payment accounts where there is founded suspicion of fraud.

Join Shufti for a 60 minute session built for senior fraud and risk leaders at Brazilian banks, neobanks, payment institutions, digital wallets and acquirers. We look at what has already taken effect, why fraud on this rail defeats controls that passed the audit, and how to test whether your own detection is ready?

Why does this matter?

The duty to reject has been live for almost a year

Art. 2º-A puts the obligation on the receiving institution and requires the account holder to be notified. Most fraud teams have spent the past year choosing founded suspicion factors, documenting them, getting them signed off, and rebuilding the complaints process around payments that were wrongly rejected.

2026 has been a schedule rather than a forecast

Layered tracking became mandatory under MED 2.0 in February. Resoluções BCB nº 552 and 553 took effect in March. Sections of the DICT Operational Manual v8.5 came into force on 1 September. A control programme still planning against next year is already behind.

Pix fraud passes identity checks you currently run

This is authorised fraud. The real customer, on a known device, completes a real authentication, and every identity control returns a pass. Engenharia social is the driver, and adding more identity verification does not address with it. A threshold makes a statement about a transaction. Pix fraud makes a statement about a person.

The account that received the money belongs to someone in the room

A conta laranja is a customer of a regulated institution, and the duty to reject now reaches that end of the transfer too. The money rarely stops at the first account, so a control that closes the case at the block never sees where it went. Fraud teams and AML teams are usually looking at two ends of the same account, and what falls in the gap between them is the part nobody owns.

Meet the Panel

Franklin Delano

Screening and Transaction Monitoring Manager at Ebury

Franklin Delano is an AML and Transaction Monitoring professional with over 7 years of experience across fintech, payments and financial services. He has extensive experience in transaction monitoring, financial crime investigations, fraud risk and AML frameworks, with a particular focus on Latin American markets and complex payment ecosystems. Throughout his career, Franklin has led TM teams, developed monitoring and QC methodologies and investigative procedures, and worked with high-risk payment flows involving digital assets, stablecoins, money transmission, and cross-border transactions.

Daniela Marin

Senior Product Marketing Manager at Shufti

Daniela Marin is a Senior Product Marketing Manager at Shufti, with experience spanning fraud and identity, risk intelligence, cybersecurity, and B2B technology. She has led global go-to-market strategy, product messaging, and thought leadership for international technology brands, bringing a strong understanding of how complex risk and fraud topics can be translated into clear, practical conversations for financial services audiences.

Justin Muscolino

Chief Executive and founder at JTM Compliance Training

Justin Muscolino is the Founder & CEO of Fintech Training Center, where he helps fintechs, banks, and financial services teams strengthen sponsor bank readiness, fraud and AML controls, payments risk, and operational governance. With experience across compliance training, fintech operations, and industry advisory roles, Justin focuses on turning regulatory expectations into practical controls and processes that work in real-world financial environments.

Gustavo Leal

Customer Success Manager at Shufti

Gustavo Leal is a Customer Success Manager at Shufti, based in Brazil, with over 10 years of experience in fintech, payments, identity verification, and fraud prevention. He has partnered with digital banks and payment providers across the Americas, helping fraud teams use data to catch real threats without blocking genuine customers, and this is the balance that matters more than ever on Pix.