“The focus is principally credit card fraud, as well as banking fraud,” explains Alfredo Oliveira, a threat analyst for Trend Micro in Brazil. Brazilian programmers and hackers working in these areas have ways of siphoning money from accounts that are far less common in other parts of the world, like re-writing QR codes on boletos (a popular payment type in Brazil – for more details, see image below) to intercept payments for things like household bills. “It’s incredibly creative and quite unique,” said Oliveira.

Source: EBanx

Fraud and exploitation

The most common sales on Brazil’s dark web, according to Trend Micro’s research, are related to personal finances and information. Programmers for hire can provide technology to allow access to compromised credit cards or personal identifying information (PII) querying, both of which can result in individuals falling victims to credit fraud or identity theft. Other common themes are bump-ups to cable television (CATV) and internet access plans.

With approximately 40 percent of the population using online banking services and inadequately protected national databases, Brazilians are somewhat easy targets. And, according to internet security firm Kaspersky, Brazil is the target for more than half of all cybercrimes in Latin America, with new threats occurring every 33 seconds.

This means that fraud is a pretty frequent occurrence for Brazilians, according to research carried out in 2016 by the credit-checking firm Seresa Experian. Over the first four months of the year, there was an average of 4,700 fraud attempts per day in Brazil – a total of 587,518. According to the report, the main methods were purchases of cars and electronics, opening bank accounts or businesses, or seeking credit using false or stolen identities.

Although Seresa says that this data represents an 11 percent decrease from the previous year, this is most likely related to Brazil’s recession. With fewer consumers looking for credit, their analysis concluded, cybercriminals simply didn’t have as many opportunities. That isn’t to say that cybercrime levels are low: according to a whitepaper from Norton Cybersecurity Insights, Brazil received the fourth-highest number of cyber-attacks in the world during 2016, with criminals siphoning a total of $103 billion from 42.4 million Brazilians. Small and medium-sized businesses are the principal targets, often extorting illicit payments from victims in order to regain access to stolen data.

For Brazilian cybercriminals, anonymity isn’t that important

But Frederico Ceroy, president of Brazil’s Institute of Digital Law (IBDDIG), believes that other online crimes are far more frequent – and far more insidious. Like petty theft, threats have also migrated from the offline world to online. But Ceroy explains that unlike theft, it’s much harder to measure and even harder to regulate without attacking the right to freedom of speech.

“Nobody researches about Mrs. Maria who is threatened by Mr. José on social media. But this is a threat, which is a crime,” Ceroy explains. “This is the bulk of online crimes in Brazil, but it doesn’t impact the economy so there isn’t the same amount of interest in conducting investigative studies.”

In terms of the cybercrimes that concern Ceroy the most, which cover everything from online death threats to the targeted deployment of fake news on social networks, most Brazilians aren’t particularly bothered by anonymity. Many may not even be aware that making such threats online is even a crime – although arrests have been made in extreme cases. Nor is it just those who write the threats that could be punished; those who ‘like’ or ‘share’ particular content on social media, such as content including racial slander, could also find themselves being prosecuted.

But even financially-motivated cybercriminals in Brazil behave unusually compared to elsewhere in the world, according to Oliveira. “Nowadays, Brazilian cybercriminals don’t worry about hiding themselves in the deep web,” explained Oliveira. Often, Trend Micro’s research found, programmers would use social networks to brag openly about the spoils of their efforts – some even posting photos of their haul.

Oliveira says many also continued to buck the trend when it came to payments, eschewing bitcoin, crypto-currencies and even the use of the deep web for payments. “In the majority of investigations we do here, transactions are done on Facebook, Skype, and WhatsApp,” he said. “It has a lot do with the culture of impunity that exists here. There are people who have been arrested and released more than 20 times.”

While Ceroy believes that both online threats and the spread of fake news will remain problematic in the coming years, he believes that identity-related crimes will continue to pose a significant threat to Brazilians. “The future of cybercrime, without a shadow of a doubt, is data leaking,” he said. “Not a single week passes without another significant data theft somewhere in the world. This is related to personal security – but also to national security.”