Bill proposes suspension of instant payments in Brazilian state as crime surges | ZDNet

As crime increases in Brazil, a new bill is proposing the suspension of instant payments system Pix in the state of São Paulo.

If signed into law, the proposals put forward by the São Paulo Legislative Assembly prevent financial services providers and payment institutions from processing payments through Pix until the Brazilian Central Bank introduces mechanisms to ensure consumer safety.

According to the project, the Assembly can vote to revoke the law if he Central Bank presents a technical security report that demonstrates the measures have been implemented. The objective is to prevent situations such as the so-called lightning kidnappings, whereby consumers are forced to make instant transfers to criminals while being held ransom.

Introduced in November 2020 as part of a broader modernisation of the Brazilian financial services environment – which also includes ongoing initiatives such as Open Banking – Pix has more than 104 million registered users and processed more than 1.6 billion transactions since it was introduced.

Around 75% of the transfers carried out via Pix in its first year of operation took place between individuals. According to the Central Bank, the system enabled financial inclusion at a significant scale: around 40 million Brazilians who had never made a money transfer before did so through the instant payments system.

Transfers are made through a Pix “key”, which acts as a sort of nickname associated to user’s full account details, aimed to simplify the payment process. A Pix key could be a user’s mobile phone number, tax registration number, email address, a randomly generated alphanumeric string or a QR code.

On the other hand, the convenience introduced by the instant payments system created loopholes for criminal action, prompting the Central Bank to impose limits on the value of transactions made between 8pm and 6am and on weekends. Other measures included a precautionary block on the receipt of transfers for up to 72 hours in cases of suspected fraud, as well as a special return mechanism, which scam victims can resort to.

The author of the bill that aims to suspend Pix in the state of São Paulo, congressman Campos Machado, noted that banks did not anticipate that “the enormous ease and convenience [Pix offers] to users would also bring dexterity to criminals, who have discovered the comfort and speed of using it to their advantage”.

The debate over instant payments in a context of increasing crime follows the first major data protection incident involving Pix, in October. A leak of more than 395,000 Pix keys under the custody and responsibility of the Bank of the State of Sergipe (Banese), which were likely obtained through social engineering or phishing techniques.