The Central Bank (BC) announced, this Monday (22), in Brasília, adjustments to improve Pix’s security mechanisms. The changes aimed at combating fraud and scams will come into effect on November 1. BCB Resolution No. 403 was published on the institution’s website.
According to the new general security rule, in cases where the electronic access device to Pix – such as a smartphone or computer – is not registered with the bank, transactions cannot be greater than R$200. When switching to an unknown cell phone, the daily limit for instant transactions via Pix cannot exceed R$1,000.
For transactions outside these limits, the new Pix access device (cell phone or computer) must be previously registered by the bank customer to carry out money transfers via Pix, such as in cases where the user changes devices.
In a note, the Central Bank explained that this registration requirement only applies to devices that have never been used to initiate a Pix transaction, so as not to cause inconvenience to customers who already use a specific electronic device.
The objective is to minimize the likelihood of fraudsters using devices other than those already used by the customer to manage keys and initiate transactions in this instant payment model, when the customer’s login and password are stolen or known.
Safer payment
The Central Bank also determined measures that financial institutions must – starting in November – apply to ensure security in electronic transfers of funds in bank accounts:
• adopt a fraud risk management solution that includes security information stored at the Central Bank and that is capable of identifying atypical Pix transactions or those that are not compatible with the customer’s profile;
•make available – on an electronic channel with broad access to customers – information on the precautions that customers must take to avoid fraud;
• at least once every six months, banks must check whether their customers have fraud flags in the Central Bank database.
“Participants are expected to treat these customers differently, either by terminating the relationship or by using a different time limit to authorize transactions initiated by them and by placing a precautionary block on transactions received,” the BC added in a note.
