In fraud against a financial institution, three questions decide the case: how they got in, who helped, and where the money went. The examination answers all three with preserved evidence, in time to recover funds.
Fraud at a bank, fintech or payment institution rarely has an obvious culprit. The same applies to the Banking as a Service provider, the institution that lends its licence and its infrastructure so that other companies can offer accounts, cards and Pix under their own brand. The first suspect is the intruder, and the intruder almost always becomes the sole focus of the investigation. An institution with mature security does not rule out at the outset the participation of an employee, through negligence or as an insider. The attacker's way of operating shows whether there was help from inside.
The examination reconstructs the fraud from the records: internal systems, APIs (the interfaces through which systems talk to each other), authentication logs, Pix transactions, customer records and devices. It shows how the access happened, in what order and by whom, and follows the money to its destination.
The attack almost always arrives from behind a VPN. In some cases the actor uses more than one layer of proxy, intermediate servers that hide the origin of the connection. But overconfidence has its price: a connection failure goes unnoticed, the real IP leaks and shows up in the records of the attack.
The attacker gets in through an employee's identity, through an exposed API or through a third-party system, and bypasses MFA authentication. In one case, hundreds of Pix transfers went out by script against the internal API. The examination shows the first access and every movement; it identifies the test accounts used to validate the operation, the rules the criminal adopted to set the individual amounts and the ceilings that do not trigger alerts, and the interval between transactions.
The script repeats itself: a trusted device is added, phone and e-mail are changed in the customer record, a test Pix follows and then a virtual card is used contactless. In many cases, the criminal calls the victim and quotes confidential data that only the institution would have, which convinces the victim that the caller works for the bank. The customer then follows procedures that let the actor register a new trusted device; from that point, the fraud is launched.
Intrusion into the victim's own handset is also recurrent. The means vary, but the pattern is phishing: a call from someone posing as the bank, the card issuer or another company the victim deals with, or a link that installs a remote access program on the phone. With the captured credentials, the criminal activates the account on a device he controls. To the bank, the fraud appears to come from the customer's legitimate device.
In phone phishing, the actor warns that something is wrong with the account: payments made or suspicious entries the customer needs to check. The story changes with the victim, but the criminal always finds a reason to see the customer's screen. He asks for a WhatsApp video call or, when he senses the victim is obliging, talks them through installing a remote access program.
The insider has three profiles: the opportunist, who saw the gap; the co-opted, who accepted a commission; the coerced, who acted out of fear. He hands the attacker how the system works, the best moment, the MFA code. There are also those who commit fraud from inside, changing limits and generating virtual cards through the processor's API.
An employee's credential in the fraud does not prove the employee was involved: well-planned phishing delivers the same credential. The examination tests the hypothesis and separates the real trace from the illusory and the forged. Clearing a suspect with evidence protects the employee and redirects the investigation.
The money leaves in fractions below the alert thresholds. It passes through shell sole-trader registrations (MEIs) and through legitimate companies, but it generally concentrates in certain branches and banking correspondents, and leaves through cryptocurrency exchanges. Part goes to decoy accounts, which only hinder the tracing. The examination separates the mule paid by commission, the account opened improperly and the decoy account.
With the account-opening documents supplied by the bank, the examination compares the fingerprint collected when the account was opened with that of the person listed as the holder. The mismatch shows the account was opened in the name of someone who did not know.
Some people sign, receive the money in their own account and later say it was a scam. Almost always the recipient took part, but not as a rule. The examination comes before enforcement: if a later examination shows the customer was also a victim, the institution, already harmed, still answers for moral damages.
There is also the fraud born inside the branch. To hit targets, the employee has an inattentive customer, usually elderly, sign more papers than needed. With them, he takes out a loan on the customer's account and, some time later, renews the same loan. The employee never touches the money. The credit enters the account without the victim noticing, and only much later does she realise the pension no longer covers her expenses: the instalments of a loan she never wanted debit ever larger amounts. The examination reconstructs the contracting and the renewals from the system records and the signatures, and shows who carried out each operation.
In Pix, the Special Refund Mechanism (MED), provided for in the Pix Rulebook (annexed to BCB Resolution 1/2020), allows funds to be returned when there is a well-founded suspicion of fraud. With the so-called MED 2.0 (BCB Resolution 493/2025), the tracing follows the money beyond the first receiving account. The window is short: under the Central Bank's guide, the dispute applies to transactions up to 80 days old.
The examination delivers the map that the MED and the lawsuit need: which accounts received funds, in what order and which deserve priority. The same work grounds the court orders for bank records and for subscriber and connection data: the examination indicates what data to request and from whom; the lawyer takes the request to court. With the clock running, the work can start outside business hours.
The examination also traces the bank movements, account by account. That map helps lawyers recover funds and hands the police the trail for establishing authorship. The report describes the modus operandi: the technique used, the pattern of tests on the accounts and the interval between the Pix transfers sent.
The merchant says the sale went through on card and the money never arrived. He shows the POS receipt, the slip from the card terminal. The question is whether the transaction existed.
The examination joins computer forensics and questioned document examination. On the system side, it queries the authoriser's database and the terminal's history, without exposing other customers' data. On paper, it examines the thermal receipt (the transaction sequence number, NSU; the authorisation code; the card application identifier, AID; typeface, logo and wear) against reference receipts generated on the spot at a certification terminal. It serves payment disputes and fraud against the bank or the acquirer.
CMN Resolution 4,893/2021, the Brazilian National Monetary Council's cyber security rule, applies to institutions authorised by the Banco Central do Brasil (Brazilian Central Bank), except payment institutions. It requires recording and analysing the cause and impact of relevant incidents (art. 3º, IV) and timely communication to the Central Bank of those amounting to a crisis situation (art. 20, III).
It is the institution that answers to the regulator. The examination gives technical support to those demands and reports, for the Central Bank and for the CVM (Brazilian securities regulator); the Simplified Technical Opinion answers the regulator's questions. In Pix, the same opinion, with the forensic analysis of the incident, grounds the request for the data of the accounts that received the money and of those used to disperse it, in the tracing that MED 2.0 (BCB Resolution 493/2025) now allows.
A financial institution was breached. The attackers moved funds from the institution's own balance-sheet account, in a multi-million fraud, and created virtual cards in the names of premium-segment customers.
The traces showed where the accesses came from. The purchases made with the cards became a source of authorship: the cameras in the physical shops recorded the perpetrators' faces and the vehicles they used.
The police identified and formally named those involved.
In a multi-million fraud against a fintech, the employee whose account was used presented himself as a victim.
The attacker's navigation had no errors and no attempts: he knew exactly where to go. The examination showed that the employee himself had given the outside actor the access for MFA authentication.
The expert report proved the participation of the insider who claimed to be a victim.
A financial institution blamed employees for a multi-million fraud, dispersed across thousands of money-mule accounts.
The examination showed the opposite: the credentials came from planned phishing, with machines infected by malware. The destination accounts revealed a pattern of branches and correspondents, accounts opened improperly, mules paid by commission and decoy accounts.
The expert report allowed funds to be recovered through the MED and grounded civil actions against the destination institutions, to identify the holders and the accounts opened improperly.
A merchant was claiming from the institution more than a dozen "uncredited" card payments.
The terminal had almost no transactions in its entire life. On the receipts, the NSU and the authorisation code repeated, the AID was incompatible, typeface and logo differed from the standard and the wear of the paper did not match the date.
All were forged, printed on a portable thermal printer. The procedure was recorded in a notarial deed (ata notarial).
See also
Banking, Capital Markets and Finance → Digital Authorship and Subscriber Data Disclosure → Corporate Investigations and Compliance → Cloud, Identity and DevOps Forensics → Fingerprint Examination → Forensic Handwriting and Questioned Document Examination →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case