The client calls on Monday: the money left his account by Pix (Brazil's instant payment system) over the weekend, and the bank says he made the transfer. On the other side, the institution found an employee's password in the log and wants a name by Friday.
From the first access to the last destination account: typologies, digital trail, MED (Pix's special refund mechanism) and liability.
Financial fraud comes down to three questions: how they got in, who helped and where the money went. All three are answered in the records: access logs, devices, the trail of each Pix transfer, the opening of the destination accounts. These records have an owner and an expiry date.
Evidence is lost in two ways. The conclusion arrives before the examination, and the employee's credential becomes evidence against him. Or the record disappears before anyone requests it. And the STJ (Brazilian Superior Court of Justice) has been treating the bank's liability as a technical fact: did the transaction depart from the customer's profile? Did the system notice?
The course shows how forensic examination reconstructs the fraud, what to request within 48 hours, how to use the map of destination accounts and what to take to the police without exposing a vulnerability that is still open. Loss calculation is handled by a partner forensic accountant.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
A financial institution blamed employees for a fraud worth millions, spread across thousands of money-mule accounts. The examination showed that the credentials came from planned phishing, with machines infected by malware. The report made it possible to recover funds through the MED and supported civil actions against the destination institutions.
In a fraud worth millions against a fintech, the employee whose account was used presented himself as a victim. The attacker moved through the systems without errors or trial attempts. The examination showed that the employee himself had given the external actor access to the MFA.
One of the account holders denied having opened the account. The examination compared the account-opening documents, provided by the bank, with the person's identity document, including the fingerprint. The account had been opened improperly.
In groups, the class receives the timeline of a simulated fraud (illustrative example): fake call centre, new device, Pix transfers split across three institutions. In 15 minutes, each group delivers the order of priority of the destination accounts, the list of records to request and one expert question on the transaction profile.
Laws and rulings discussed
Brazilian Penal Code (CP), art. 171, § 2º-A and § 2º, VII · Law 15,397/2026, art. 3º · Law 14,155/2021 · STJ Súmula 479 (Brazilian Superior Court of Justice) · STJ, REsp 2,220,333 · STJ, REsp 2,209,868 · STJ, AREsp 3,193,758 · BCB Resolution No. 493/2025 (Central Bank of Brazil) · BCB Resolution No. 559/2026 · Central Bank of Brazil, MED Guide, version 4.3 · Joint Resolution No. 6/2023 · Complementary Law 105/2001, art. 1º, § 4º (banking secrecy)
See also
Financial Fraud and Payment Systems Forensics → Forensic Services in Banking, Capital Markets and Finance → Fingerprint Examination → See all courses →