Brazil has embraced digital payments faster than almost anywhere else in the world. That growth is a success story, but it has created an entirely new risk landscape that payments companies and online platforms cannot afford to ignore.
That was the throughline of LegitScript’s recent webinar on fraud and compliance trends across Brazil and Latin America. Read the key takeaways, and then watch the webinar on demand.
July 30, 2026 | by LegitScript Folks
The Fraud Problem in Brazil and Latin America
The numbers tell a clear story. Brazil’s suspected digital fraud rate reached 3.8% in the first half of 2025, ahead of the 2.8% average across the Latin American countries analyzed by TransUnion. In 2024, Brazil’s financial sector reported R$10.1 billion in fraud-related losses, and for every real stolen, banks spent up to R$4.49 on response and recovery. Fraud is now estimated to cost the country between 0.35% and 0.4% of GDP.
E-commerce tells a similar story. Latin America lost 4.6% of annual e-commerce revenue to payment fraud, compared with 3.1% in Europe, 2.9% in Asia-Pacific, and 2.4% in North America, according to Statista. Merchants in the region are responding by spending 19% of e-commerce revenue on fraud management, nearly double the rate in Europe and the U.S.
The takeaway: Brazil’s fraud rates look high in isolation, but they track closely with the country’s rapid, world-leading adoption of digital banking and payment rails like Pix. Growth and risk are moving together — and that means compliance has to keep pace with both.
Rules and Regulations Impacting Payments Companies and Platforms
Brazilian regulators have responded to this growth with an aggressive regulatory push. Recent measures include:
- Normative Instruction No. 2,278 (August 2025), which brings payments companies and fintechs under the same anti-money laundering obligations as traditional banks, including risk-based KYC and ongoing transaction monitoring.
- BCB Resolution No. 501 (September 2025), which requires banks and payment institutions to reject transactions to accounts with well-grounded suspicion of fraud before settlement.
- MED 2.0 (February 2026), which strengthens Pix’s fraud recovery mechanism, enabling tracing and blocking of fraudulent transfers across up to five layers of accounts.
Card networks are moving in the same direction. Mastercard’s Merchant Monitoring Program (MMP) and Visa’s Acquirer Monitoring Program (VAMP) both require acquirers to conduct pre-transaction merchant scans, extend monitoring into password-protected areas of merchant websites, and demonstrate continuous oversight across the full merchant lifecycle. Regarding card brand fines, LegitScript’s own enforcement data shows healthcare-related violations, driven largely by telemedicine and GLP-1 products, as the dominant category through 2026, with adult content violations tied to unguarded generative AI tools close behind.
Brazil’s Marco Civil da Internet, the country’s “Internet Bill of Rights,” adds another layer. Recent updates hold platforms liable for failing to prevent fraud, scams, and crime, and they now explicitly cover the use of AI to generate non-consensual intimate images. The message for platforms and payments companies alike: The safe harbors that once protected against third-party content are narrowing, and the obligation to monitor is only expanding.
Problematic Products and Services Trending in LATAM
The panel’s core insight here: high-risk merchants rarely operate in isolation. They’re connected through domains, registrars, phone numbers, payment infrastructure, and social presence — and understanding those connections is what separates surface-level review from real investigation.
A few patterns stood out:
- Online betting. As Brazil’s betting laws tighten and prediction markets like Kalshi and Polymarket face restrictions in multiple jurisdictions, bad actors are adapting alongside legitimate operators. One recent Brazilian investigation uncovered a scheme that moved roughly R$50 billion through illegal betting platforms, using a mix of real and fabricated business entities. Authorities took down around 10,000 illegal websites in just three months.
- GLP-1 and telemedicine. Demand for drugs like semaglutide has outpaced legitimate supply, opening the door to both new business models and new fraud. Brazilian regulator ANVISA identified imported pharmaceutical ingredients sufficient to produce roughly 20 million doses of semaglutide, a volume incompatible with legitimate market demand.
- Violative content hiding in plain sight. A polished, professional storefront is not a signal of low risk. LegitScript’s investigators pointed to merchants selling restricted or illegal products, such as poppers, through clean, high-converting websites that look no different from any legitimate retailer.
- Fragmented commerce. The customer journey rarely stays on one platform. It often moves from a storefront to WhatsApp to Pix and back again, which means real risk visibility requires following the transaction well past checkout.
- Merchant migration. When a storefront is taken down, the operation frequently reappears under a new name within days. LegitScript has tracked networks of more than 70 related websites tied to a single illicit operation, each one shut down and replaced in turn.
Across every example, the same four questions recur:
- Who is really behind this merchant?
- How do they operate?
- What else are they connected to?
- And how has that changed over time?
How Companies Are Better Mitigating Their Risk
Managing this landscape requires a risk strategy that covers the full merchant lifecycle, not a single checkpoint. LegitScript’s approach breaks down into three stages:
- Policy and regulatory tracking, so that internal policy evolves alongside new rules and enforcement trends rather than reacting to them after the fact.
- Accurate, scalable underwriting, using pre-integrated KYB and KYC data and policy-driven automation to catch bad actors before they ever reach a portfolio.
- Ongoing monitoring, because a merchant’s risk profile is never static. Continuous, expert-verified scanning is what catches business model changes, transaction laundering, and criminal network connections after onboarding.
The goal isn’t to eliminate risk entirely; it’s to understand it well enough to manage it, and in some cases to use that knowledge as a foundation for safely expanding into new, higher-risk categories. That’s the difference between treating compliance as a cost center and treating it as a growth engine.
Bottom Line: Digital Commerce Is Global
Brazil and Latin America are not an isolated case. As one jurisdiction tightens enforcement, bad actors and problematic products move to the next one, which means the lessons from this region apply well beyond it. Companies that build risk management into every stage of the merchant lifecycle, and that treat identity, behavior, relationships, and change as ongoing signals rather than one-time checks, will be the ones positioned to grow safely as this landscape keeps shifting.
Want to see how LegitScript’s Risk & Policy Advisory, Merchant Underwriting, and Merchant Monitoring solutions apply to your portfolio? Reach out to our team to learn more.
The full webinar recording is available on-demand.
