How does the scam work?

The scam relies on a fake app that simulates different banking apps. This type of program has spread among criminal groups and is sold online to ill-intentioned individuals. At first glance, everything seems normal: a customer makes a purchase at a store and, when it’s time to pay, chooses the Pix method.

The merchant then provides the key or QR code for the transfer, and the fake customer opens their phone to make the payment. However, the scammer opens the fake app, which only simulates the banking app. They go through all the usual steps, filling in the information, amount, and even the necessary password to confirm the Pix.

At least on the surface, the Pix payment appears to be completed. The phone screen shows the process as completed and the receipt available, with all the correct details, even showing a notification on the scammer’s screen. The problem is that the transfer was never actually made. So, if the merchant only checks the scammer’s screen, they will only realize the fraud later, when the criminal is likely already far away, upon noticing that they never received the money.

How to prevent this

Despite the reasons for concern, a simple measure can prevent this type of fraud. Merchants simply need to confirm the transfer through their own methods, such as checking the notification received on their phone. This way, they can ensure that the product is only released after an actual transfer is completed.

Are you afraid of falling victim to an online scam? Then the anti-fraud articles section of StarsPay is perfect for you. By reading the texts, you can stay informed about the most common types of scams and learn how to take the main preventive measures to reduce your vulnerability.

O post Learn How the Pix Scam with Fake Apps Works And How to Avoid it apareceu primeiro em StarsPay.

However, a complex password alone may not be enough to protect an account these days. That’s why many services offer the option of Two-Factor Authentication (also known as 2FA), which adds an extra layer of security to accounts. Learn more about how 2FA works and why it’s important to use this feature.

What is Two-Factor Authentication?

As the term suggests, Two-Factor Authentication requires two steps to verify the user’s identity at login. In addition to the defined password, there’s a second layer needed to confirm legitimacy. Typically, this could be a unique code or number, accessible through a mobile device or a physical security token, or even biometrics, which is becoming increasingly popular, such as fingerprint or facial recognition.

This significantly increases account security. After all, even in a scenario where the password is leaked or someone discovers your password, the scammer won’t be able to access the account. Access is only possible for someone who has the registered device or fingerprint, creating a barrier that is very difficult for fraudsters to overcome.

How Does It Work?

When an account has 2FA enabled, the login occurs in two steps. First, you need to enter your email/username and traditional password. Then, the second verification takes place, forming the second layer of security.

The most common methods involve entering a code received via SMS or WhatsApp, for example. It’s also possible to use specific authentication apps, such as Authy or Google Authenticator. These programs generate a unique access code, so only the person with the device and password can access the account.

Another option is a hardware token. Usually provided by the bank/service itself, this device also generates a unique access code with a limited duration, offering greater security. In the case of biometrics, you need to confirm your fingerprint or facial recognition after entering the password, also preventing unauthorized access.

Extra Precaution

Whenever you have the option to activate 2FA for an account, it’s recommended that you do so. This way, the main methods of password theft become useless to scammers, leaving consumers much less vulnerable. However, it’s necessary to be aware of an extra precaution. Through frauds like fake customer service centers, criminals try to get people to reveal their tokens over the phone or by message.

It’s important to emphasize: a legitimate contact from a bank or any other type of company will never ask you to disclose your password or code in a call or message. Any token you receive should only be viewed by the user and never shared. By taking these precautions, online security is greatly reinforced, making it much harder for those attempting scams.

O post Learn What Two-Factor Authentication Is and Its Importance apareceu primeiro em StarsPay.

While some suggestions are more complex, one simple aspect of online security is setting strong passwords. By following a few principles, it’s easy to create a password that makes it difficult for criminals to hack into your account, for example.

Check out the main tips:

Create long passwords: The longer the password, the harder it is to crack through brute force methods, which involve testing all possible combinations. A length of at least 12 characters is recommended.

Avoid common words or obvious references: Terms like your first and last name, birth date, and basic sequences like “123456” make passwords more predictable and easier to discover.

Use a variety of characters: A mix of uppercase and lowercase letters, along with numbers and special characters (such as @ or $), increases the complexity of the password, making it harder for scammers to crack.

Create unique passwords: Avoid using the same password for different sites or applications, as a data breach in one place could provide access to multiple platforms. Whenever possible, create unique passwords for each site.

Use two-factor authentication: Two-factor authentication adds an extra layer of security beyond the password, whether through a confirmation via cellphone or an authentication app, for example. Therefore, whenever this option is available, it should be used to reduce the risk of unauthorized access.

Change your passwords periodically: It’s important to update your passwords from time to time. This way, if there is a data breach, the information may already be outdated, mitigating the risk.

Use biometric services: Nowadays, it is quite common to access apps and devices through biometrics, whether by fingerprint or facial recognition, for example. This type of method can prevent unauthorized access.

O post Learn Tips for Creating Strong Passwords on the Internet apareceu primeiro em StarsPay.

In the same period, 1,680 people have their mobile phones stolen and another 2,500 purchase products online that are never delivered. The survey included 2,508 respondents and was conducted across all regions of the country between June 11 and 17. The estimated financial loss to the population is R$ 25.5 billion over 12 months, just from scams involving Pix or fake invoices, for example.

Articles from StarsPay provide insights into some of the most common types of fraud currently encountered, with criminals devising increasingly sophisticated methods to deceive the public. Schemes like the fake customer service scam or the incorrect Pix transfer have become more prevalent in recent months, along with other types of fraud that also demand attention.

The survey also indicated that the actual number of cybercrimes is likely higher since only 30% of respondents reported filing a police report after falling victim to a Pix or fake invoice scam. For those who had their phones stolen, the number rises to 55%, still far from the total number of actual cases.

Another result of the survey was the identification of the profile of individuals most frequently targeted by online crimes through messages and/or phone calls. The most common victims earn between 5 and 10 times the minimum wage, have completed higher education, and live in cities with more than 500,000 inhabitants.

In July, the Central Bank of Brazil announced new measures to increase the security of Pix, setting limits on transactions conducted on unregistered devices. Additionally, for those looking to protect themselves from the main types of scams, StarsPay’s anti-fraud articles offer various essential tips for staying safe in the digital environment.

O post Research Points to High Number of Financial Scam Attempts in Brazil apareceu primeiro em StarsPay.

Knowing the main methods used by scammers can greatly reduce the chances of being deceived online. That’s why StarsPay has an antifraud article section filled with tips and information about the most common scams. After the “fake customer service center” scam went viral, fake parcel messages have now become a hot topic on social media.

How Does the Scam Work?

The victim receives a message, usually via SMS or WhatsApp, claiming that a parcel is being held at customs and requires the payment of a fee for release. Nowadays, with so many online purchases, it’s common for people to be expecting a parcel, which lends credibility to the fake message.

The text also includes a link with domains that may seem legitimate, such as “rastreios.online” or “pedidocorreios.online,” for example. However, when clicking the link, the user is taken to a fake page resembling the official postal service, where a Pix code (a popular Brazilian payment method) must be paid for the parcel’s release. In reality, the money is sent to the scammers’ account, completing the scam.

Scammers benefit from the fact that many people are awaiting parcels, the similar appearance of the malicious page, the domain with tracking-related words, and the fee amount, which is usually not very high, helping the user to “let their guard down.” The good news is that avoiding this type of scam is very easy with some basic precautions.

How to Avoid It

First, always remember: any unexpected message received with a link or call from an institution should be viewed with automatic suspicion. These are the most common methods used by scammers today, but such companies do not send messages and links through these methods. Even if everything seems legitimate, remember that scams are becoming more sophisticated every day, so caution is always advisable.

If the user really wants to check the status of a parcel, the postal service has its own app and website. According to a note published by the postal service itself, after the increase in occurrences of this type of scam, “the app allows you to track parcels and pay import taxes, among other services.”

In other words, never trust a received link. When in doubt, go directly to the app or website, preferably by typing the address in your browser and checking the credentials to ensure you’re in the right place. Check out other important tips to protect yourself against online scams and learn about the “wrong Pix” scam, which has also become popular.

O post How to Avoid the Fake Parcel Message Scam apareceu primeiro em StarsPay.

The new general rule defined by BCB Resolution No. 402 will apply to access devices (cell phones or computers) used to initiate Pix transactions. Starting November 1 of this year, transfers initiated through unregistered devices will be limited to R$ 200 per transaction and up to R$ 1,000 per day. Transfers above this amount will be available only for devices previously registered by the customer.

“In order not to inconvenience users who already use a specific device, this registration requirement applies only to access devices that have never been used to initiate a Pix transaction,” says the statement, which also explains the motivation for the change. “This measure minimizes the probability of fraudsters using devices different from those used by the customer to manage keys and initiate Pix transactions. This will make it more difficult for fraud in which the malicious agent obtains, through theft or social engineering, people’s credentials, such as login and password.”

The Resolution also defines new procedures for banking institutions to increase the security of electronic transfers. Three points were described in the BC’s statement:

• Use a fraud risk management solution that includes security information stored at the Central Bank and is capable of identifying atypical Pix transactions or those not compatible with the customer’s profile;
• Provide, through an electronic channel widely accessible to customers, information about the precautions customers should take to avoid fraud;
• Verify at least once every six months if their customers have fraud markers in the BC’s database.

In the case of customers who have fraud markers, institutions must treat them differently, “either by ending the relationship or using a differentiated time limit to authorize transactions initiated by them and the precautionary blocking of received transactions,” says the statement. The BC’s note also clarifies that the agency will continue developing solutions to combat fraud and scams, focusing on the population’s security. “These improvements are part of the permanent security agenda discussed with leading financial market experts in the Strategic Security Group, coordinated by the BC within the Pix Forum,” says the text.

O post Central Bank Announces Changes to Increase Pix Security; Learn More apareceu primeiro em StarsPay.

A type of scam that has recently gone viral, for example, is the “wrong Pix,” whose operation and prevention are explained in this article. You can also find articles on the most common types of scams involving Pix, a guide with general rules for protecting yourself from online scams, and the main forms of online payment fraud. Now, it’s time to learn about the “Fake Customer Service” scam.

How Does It Work?

This scam is also known as “voice phishing” or “vishing” and involves deceiving the victim through a phone call, in which the criminal pretends to be a representative of a legitimate company to obtain confidential information. Scammers use various methods to gain the trust of their targets. On the other hand, the good news is that simple measures can prevent this type of fraud.

It all starts with receiving an unexpected call. The caller ID might even show the number of a legitimate customer service center because criminals can mask this type of information. After answering, the person is informed that they need to perform some operation or verification on their account. To appeal to emotions, the “attendant” may create a sense of urgency and danger, saying, for example, that the account has been hacked or that a high-value purchase has been made in the user’s name.

At this point, the scammer might even provide real data about the person, such as their address or the number of a document, obtained through the illegal purchase of a database. Seeing that their information matches what was given, the victim begins to trust that they are indeed speaking with a legitimate customer service center. This is when the scam is applied, with the scammer asking for sensitive information such as passwords, verification codes, and account numbers. If the target provides such data, the criminals can carry out fraudulent transactions or make purchases in their name, for example.

How to Protect Yourself

As with anything involving this type of scam, a healthy dose of skepticism is always valid. Upon receiving a call, the user should immediately be aware that they might be speaking with a scammer, as companies like banks rarely call a customer in this manner. If they do call, they will never ask for confidential information. Thus, the number one rule in such cases is to never disclose sensitive information during a call.

If you receive such a call, hang up, and if you want to confirm if something is wrong, wait five minutes and then make a call yourself to an official customer service number. Never make transfers or click on links received through messages, whether via SMS or apps. Always be skeptical, and if in doubt, end the call. Any offer that seems too good to be true is probably part of a scam.

O post Fake Customer Service Scam: Learn How to Protect Yourself apareceu primeiro em StarsPay.

This is one of the services offered by StarsPay, which provides a KYC provider. Through instant validation of user documents, client sites can ensure that everyone complies with best practices in compliance and anti-money laundering (AML), one of the main points of importance for KYC.

The procedure is mandatory for many companies dealing with financial services, being an important part of compliance, meaning the fulfillment of current regulations in each sector. For companies planning to operate with sports betting in a newly legalized market like Brazil, it is essential to stay up to date with best practices.

What Is the Importance of KYC?

The main objective of KYC is to ensure that each user is indeed a real person, with their identity and personal data known to the company. Thus, the importance of the process is to prevent fraud, money laundering, and other illegal activities, as it allows understanding who is accessing the platforms and their transactions.

KYC generally involves collecting basic information about the customer, such as name, address, date of birth, and identification number (like CPF in Brazil). Through the receipt and analysis of documents, it may also include verification of identity cards, passports, proof of address, and, in some cases, financial history. Other options like facial verification and biometrics have also gained popularity recently.

By verifying the identity of customers and monitoring their activities, financial institutions can identify and report suspicious transactions to the relevant authorities. This helps curb activities like money laundering and terrorist financing. Besides complying with current legislation regulations, companies avoid potential reputational risks that could occur if they were used for illegal activities.

Data Care

To protect themselves from potential fines from regulators or misuse by users, platforms require consumer data and monitor transactions. At the same time, users have the right to have their data protected and their privacy maintained.

Thus, one of the challenges of KYC is protecting this data from unauthorized access, leaks, or theft, which can lead to severe legal consequences. In Brazil, for example, the General Data Protection Law (LGPD) addresses this issue. Beyond legal issues, user trust in brands is also at stake, highlighting the importance of careful data handling.

O post Understand What the KYC Procedure Is and Its Importance apareceu primeiro em StarsPay.

StarsPay has provided numerous resources to help online service users prevent fraud. For example, offering practical measures that consumers can take to avoid scams, more important tips to prevent online fraud, how not to fall for a famous Pix scam, and a golden rule when receiving phone calls.

Regarding Pix, the Central Bank of Brazil (BCB) states on its website that the system’s security is based on four dimensions. Check them out below in full:

User Authentication

Every transaction, including those related to managing Pix keys, can only be initiated in the secure environment of the user’s banking institution, accessed through a password or other security devices integrated into the mobile phone, such as biometric recognition, facial recognition, or the use of a token.

Transaction Traceability

Due to its technological design, all Pix operations are fully traceable, which allows the identification of accounts receiving funds from fraud/scams/crimes, enabling more decisive action by the police and the judiciary, unlike ATM withdrawals, for example.

Secure Information Traffic

Transaction information is transmitted in an encrypted manner over the National Financial System Network (RSFN), which is a network entirely separate from the internet and where Brazilian Payment System (SPB) transactions are processed. All Pix participants must issue security certificates to transact on this network. Additionally, all transaction information and personal data linked to Pix keys are stored in encrypted form in BCB’s internal systems.

Pix Operating Rules

The Pix regulation includes measures to mitigate fraud risk, such as:

• A provision that Pix participants (financial and payment institutions offering Pix to their clients) must be responsible for fraud within Pix due to failures in their risk management mechanisms;
• Protection mechanisms by the BCB and institutions that prevent scanning of personal information related to Pix keys;
• The possibility for institutions to set maximum transaction value limits based on their clients’ risk profiles. These limits may vary by transaction time, account ownership, service channel, and user authentication method, among others;
• The ability for users, through apps, to adjust the value limits set by institutions. Requests for reductions take immediate effect, while requests for increases are not immediate and require analysis by institutions to verify compatibility with the client’s profile;
• A differentiated maximum time for transaction authorization by participating institutions in cases of unusual transactions initiated by their clients with a high probability of fraud;
• An information center shared with all participants about Pix keys, account numbers, and CPF/CNPJ involved in fraudulent transactions;
• Dynamic QR Code generation allowed only for participants who send specific security certificates to the BCB; and
• Mechanisms that facilitate the blocking and eventual return of funds in case of fraud, such as precautionary blocking and the special refund mechanism.

O post Get to Know the Four Dimensions of Pix Security, According to the Central Bank apareceu primeiro em StarsPay.

This past week, a new scam involving Pix became a hot topic on social media. Therefore, we have prepared another article on the subject of anti-fraud, explaining how the “wrong Pix” scam works and the simple measures that can prevent someone from falling victim to it.

How does it work?

The scam went viral after numerous influencer posts on the topic. It involves the scammers gaining access to personal data, an unexpected contact, and a detail that makes all the difference in convincing the victim. It all starts with a message received from a stranger. This person claims that a Pix transfer was mistakenly made to your account, asking for the amount to be refunded.

At this point, if the contacted person accesses their own account, they notice that they have indeed received an unexpected transfer in the same amount mentioned by the scammer, which adds credibility to the story. The scammer also uses elements of social engineering, highlighting the importance of this money in their budget and earnestly requesting that the amount be transferred to a new account.

Unaware that it is a scam, the victim makes the transfer, believing they are helping someone who made a mistake. It is at this moment that the scammer activates the Special Return Mechanism (MED), a resource created by the Central Bank precisely to combat fraud, claiming that they were a victim of a scam. The request is received by the bank, which analyzes the money movement and notices that the amount received in the victim’s account was quickly transferred to a third account, a common practice in scam cases.

Upon understanding that a fraud occurred, the bank deducts the corresponding amount from the victim’s balance, passing it to the scammer as if it were a legitimate return from an scam. Thus, the person is left without the amount they had received “by mistake” and also loses the same amount as if they had committed a fraud. For example, a person with R$1,000 in their account receives the “wrong Pix” of R$500 and ends up with R$1,500. After making the “refund,” they are back to R$1,000. However, with the activation of the MED and the bank’s analysis, another R$500 would be deducted from their account, leaving a final balance of R$500.

How to avoid it?

The good news is that some simple measures can prevent the user from falling for this scam. First, it is worth noting that any message received from an unknown number should be viewed with great suspicion, especially if the topic involves money, extra income opportunities, or similar subjects. In the vast majority of cases, it is a scam, even if it is less obvious in some cases.

The second point is that upon receiving an unexpected Pix and possibly by mistake, the person should activate the “Return money” option. This refund feature was also created by the Central Bank for mistaken transfers. When activated, it sends the received amount back to the account that sent it. Thus, if the scammer activates the MED, the analysis will show that there was no transfer of the amount to a third account, not constituting a scam and preventing the fraud from proceeding.

O post Know How to Avoid the “Wrong Pix” Scam, Which Went Viral on Social Media apareceu primeiro em StarsPay.