Home // COURSES // FRAUD AND DIGITAL CRIME

Fake profiles and offensive content: taking it down and reaching the author

A fake profile uses the client's name and photo to ask his contacts for money. The client wants the page taken down today. You want to know who is behind it.

The course

Why this course

Preserve before removing, the Marco Civil da Internet (Brazil's Internet Civil Rights Framework) after the Supreme Court ruling, and the technical path from the platform to the subscriber.

Fake profiles and offensive posts call for two things: taking them down and finding out who did it. Done in the wrong order, one destroys the other. A page removed before it is preserved takes with it the account identifier and the timestamps the examination would need.

The path to the author is technical and has a deadline. The platform reports which IP address the access came from; the connection provider reports who was using that IP. Without the source port and the right time zone, the carrier returns a list of subscribers.

In 2025 the STF (Brazilian Federal Supreme Court) changed platform liability and, in June 2026, settled the final thesis. The course shows what was decided, how to preserve before removing, what the request for records must list and how to read the providers' replies.

Length2 hours
TrackFraud and digital crime
FormatIn person or live online, open class or in-house. Taught in Portuguese, under Brazilian law
Who it is forDigital, civil, family, corporate and criminal law lawyers; in-house legal teams.
InstructorAdriano Vallim, Forensic Expert and Digital Crime Specialist
CertificateCertificate of attendance stating the course hours, for every participant

I want this course

Pick as many courses as you like: they are kept and arrive ticked on the registration form.

By the end, you will be able to

What changes in your next case

  • Preserve the profile and the post before removal, with the account identifier, time and hash.
  • Choose the removal route after the STF ruling: notice, court order or the regime for non-consensual nudity.
  • List in the request for records the provider, the account, the period and the fields that lead to the author.
  • Demand the IP address, source port, date, time and time zone, and explain why one without the others fails.
  • Cross-check the platform's and the carrier's replies against the events of the case.
Programme

2 hours, block by block

0:00
Opening: the race against the retention period 15 min
  • Hacked email accounts
  • What self-service tools do not show
  • The six-month clock
0:15
Preserve before removing 25 min
  • What to record from the page and the profile
  • Technical capture, certified capture and notarial record (ata notarial)
  • What a screenshot does not show
0:40
Removal after the STF ruling 20 min
  • Art. 21 as the rule for unlawful content
  • Inauthentic accounts, honour and replications
  • Private messages and paid ads
  • Non-consensual nudity
1:00
From profile to subscriber 40 min
  • Application providers and connection providers
  • Shared IP, source port and time zone
  • The request under the Marco Civil, art. 22
  • Exercise: reading the platform's reply
1:40
Questions and cases from the audience 20 min
  • Cases from the room and a review of the sheet
Cases in class

The cases used in class

REAL CASE · ANONYMISED

Hacked email accounts and the race against the retention period

A lawyer had the passwords of her accounts with three providers changed by a third party, who downloaded and deleted files. The self-service tools showed only a short window of access. The examination preserved what existed and showed what to request from each provider and from the carriers. The technical opinion supported the claim for specific performance, within the six-month retention period.

Related page →

REAL CASE · ANONYMISED

Hundreds of suspects and no source port

A company suffered fraud through an intrusion into its systems. The access came from a few IP addresses, each shared by thousands of mobile lines. Once the times were cross-checked, hundreds of suspects remained: without the source port, there was no way to single out the author.

Related page →

REAL CASE · ANONYMISED

The AI-generated voice

An audio clip on social media told a false story in a person's voice. The examination showed that the voice had been generated by artificial intelligence and preserved the posts so that authorship could be investigated.

Related page →

Practice and materials

Ready to use the next day

Hands-on exercise

In pairs, the class receives a platform's simulated reply (illustrative example): access to a fake profile with IP, port and time in UTC, and the posts in Brasília time. In 15 minutes, each pair converts the times, marks the matching access events and fills in the request to the connection provider.

Materials provided
  • Profile and post preservation checklist: what to record before removal.
  • Removal chart after the STF ruling: the regime for each type of content.
  • Technical sheet for the request for records: the fields for the platform and for the carrier.
  • Expert questions on authorship from records: for the expert report and the providers' replies.
Questions on the topic
After the STF ruling, does the platform need a court order to remove content?
As a rule, no: for crimes, unlawful acts and inauthentic accounts, notice under the Marco Civil, art. 21, is enough. For crimes against honour, a court order under art. 19 applies, without preventing removal by notice.
Does the IP address reported by the platform identify the author?
Not on its own. The IP leads to the holder of a connection, and only with date, time, time zone and, on shared networks, the source port. And the holder may not be the person who typed. The expert report states how far the trace goes.
How long do I have to request the records?
As a rule, six months for application records and one year for connection records (Marco Civil da Internet, arts. 15 and 13). The police or the Public Prosecutor's Office may request longer retention.

Laws and rulings discussed

Marco Civil da Internet, arts. 10, § 1º, 13 and 15 (Brazil's Internet Civil Rights Framework)  ·  Marco Civil da Internet, arts. 19, § 1º, 21 and 22  ·  STF (Brazilian Federal Supreme Court), final thesis on Themes 987 and 533  ·  STF, news item of 17 June 2026  ·  STF, news item of 26 June 2025  ·  STJ (Brazil's Superior Court of Justice), REsp 2.170.872  ·  CPC, art. 384 (Brazilian Code of Civil Procedure)  ·  CPP, art. 38 (Brazilian Code of Criminal Procedure)

See also

Digital Authorship and Subscriber Data Disclosure →   Forensic Services in Digital Law and Technology →   Forensic Services in Media, Entertainment and Deepfakes →   Representative Cases →   See all courses →

Bring this course to your firm

Open class or in-house for your team, in person or online. Tell us the group size and preferred date: you will hear back within 24 business hours.

I want this course

The technical evidence your case requires. The authority courts respect.

Initial feasibility consultation at no cost. Reply within 24h on business days.
Request an Examination