Civil Liability and the "Fake Lawyer" Scam

The sophistication of contemporary digital scams challenges traditional models of civil liability. Among them, the so-called “fake lawyer scam” stands out—a scheme that is quietly spreading across the country and that combines, with almost surgical precision, elements of social engineering, the misappropriation of professional credentials, and the exploitation of victims’ emotional vulnerability. This is a fraud that exploits the appearance of legal legitimacy to disorient the target, mimicking the language, rituals, and symbols of the legal profession, with the aim of extorting money through electronic transfers resulting from conduct that misleads the victim.

The criminal narrative typically emerges on messaging apps, especially WhatsApp, where individuals pose as lawyers or fictitious justice system officials, always under the pretext of urgently resolving an alleged legal problem involving the recipient or one of their family members.

To grasp the severity of this phenomenon, consider the fictional case of a college professor who, in the middle of her workday, receives a WhatsApp message from someone claiming to be her lawyer, using the exact same identifying information as the lawyer who had represented her in a civil lawsuit years earlier. The account displays a photo, name, and registration number with the Brazilian Bar Association, giving the appearance of absolute legitimacy. The approach is courteous, formal, and to the point: it refers to the case number of the previously filed lawsuit, attaches the initial complaint, and states that the case was successful, making immediate payment of “court costs” essential for the release of the funds. Subsequently, the scammer begins sending urgent audio messages, forged documents, and truncated excerpts from court decisions. In a mix of euphoria and haste, the victim transfers the requested amount to a bank account specified by the scammer—opened in the name of an unknown third party—through a payment institution with inadequate registration controls. Minutes later, upon attempting to contact the number again, the victim realizes it has disappeared. The real lawyer, contacted later, confirms: it was a scam. Although fictional, this narrative faithfully reflects dozens of real cases reported in recent years across various Brazilian judicial districts, all marked by a dangerous combination of data breaches, emotional manipulation, and security flaws across multiple layers of the digital ecosystem.

The proliferation of this scam—whose execution depends as much on the illegal collection of personal information as on the creation of plausible digital facades—has sparked significant concerns in the national legal debate¹. It is not merely a matter of examining the liability of the direct perpetrators, who are often unidentifiable or belong to criminal organizations that are difficult to trace. The central problem lies in the complex web of intermediaries that, in one way or another, shape the environment in which the fraud takes place: financial institutions, payment platforms, technology companies, social media platforms, and telecommunications providers. Each of these plays a specific role in the risk architecture; each, in its own way, influences—through action or omission—the conditions under which harm can occur.

The phenomenon thus calls for a deeper reflection on the applicable civil liability regime; after all, is the harm limited to an “exclusive act of a third party,” a traditional exclusion from the causal link? Or, on the contrary, are financial and technology institutions subject to the risk inherent in their activities and to the heightened security obligations arising from their position in a data-driven market? In other words: to what extent is the “fake lawyer” scam, for such entities, an unpredictable anomaly or, on the contrary, a statistically predictable, recurring event that is part of the companies’ professional risk?

Recent case law provides important, albeit not always consistent, insights into this dilemma. In a landmark decision by the Special Civil Court of Vergueiro, in São Paulo, São Paulo State, the judge recognized the strict liability of a financial institution that allowed an atypical transfer to be carried out during a video call conducted by the criminals². The bank’s argument—that the incident was solely the result of a third party’s actions—was rejected on the grounds that frauds of this type constitute an internal fortuitous event inherent to banking activities, for which the duty of security is not limited to safeguarding passwords but also encompasses the identification of transactions inconsistent with the consumer’s profile³. The decision aligns with the Superior Court of Justice’s (STJ) established jurisprudence on similar banking scams, notably the “motorcycle courier scam”⁴ and call center fraud (usually associated with spoofing)⁵, in which it is emphasized that the predictability of the modus operandi shifts the risk to the service provider.

Another decision by the TJ/MT emphasizes that legitimate lawyers cannot be held liable for the actions of criminals, insofar as they are also victims, just as much as their clients themselves. Any civil liability of attorneys for the unlawful acts of third parties would result in true double punishment: on the one hand, the moral damage resulting from the misuse of their name and image; on the other, a financial penalty in the form of monetary damages that, in theory, they would still have to bear.⁶

More complex, however, is the solution adopted by the 4th Civil Court of Santos, in which the judge held a number of parties jointly and severally liable: financial institutions, a payment platform, a technology company, and even intermediaries responsible for identity verification⁷. In that case, it was determined that the fraud could not be separated from the inadequate registration review that allowed the opening of a fraudulent account; the absence of mechanisms to detect atypical transactions; and the digital ecosystem that, lacking effective filters, enabled the scammer to approach the victim. By broadening the concept of the supply chain, the ruling recognizes that digital platforms can function as de facto suppliers and are therefore subject to the liability regime under the Consumer Defense Code (CDC).

This understanding has both merits and risks. On the one hand, it represents progress in the effort to distribute the burden of the digital environment’s structural flaws among all actors who profit from it. It provides enhanced protection for consumers and acknowledges that contemporary informational vulnerability demands stricter standards of care. On the other hand, however, it raises a red flag: is it legitimate to hold a messaging platform civilly liable for the criminal acts of third parties when no specific algorithmic failure or unlawful act resulting from the misuse of the moderation process has been demonstrated? Would it be appropriate to impose on banks and fintech companies a “digital policing” role so broad that it transforms them into universal guarantors against any and all socially widespread fraud?

The answer is not straightforward. In another recent precedent, from the 3rd Civil Court of Atibaia, São Paulo, for example, the court rejected the liability of telephone carriers for damages resulting from the scam, limiting its ruling to requiring them to provide subscriber registration data for the investigation⁸. The central rationale was that, although such companies are part of the communications environment in which the fraud occurs, there was no evidence of a defect in the provision of the service, which precludes the automatic imposition of liability. This understanding, while prudent, reveals the difficulty of striking a balance between the need for effective protection and the risk of unduly inflating civil liability.

In light of these precedents, the discussion regarding the “fake lawyer scam” requires a sophisticated approach. It must be recognized that the classic model of liability for acts of third parties proves insufficient in scams that materialize due to a chain of failures throughout the entire digital circuit⁹. It is not enough to ask who committed the fraudulent act; it is essential to investigate who could have prevented it by implementing security measures appropriate to the risk posed by the activity from which they derive economic benefit. This is not about turning banks and digital platforms into absolute guarantors, but rather about requiring those who profit from the digital environment to make a proportional investment in mitigating the risks that this same environment creates.

For this very reason, local chapters of the Brazilian Bar Association (OAB), such as those in Rio Grande do Sul¹⁰ and Pernambuco¹¹, have been adopting, respectively, administrative and judicial measures aimed at implementing mechanisms to make the digital environment safer. At the same time, the National Council of Justice (CNJ) itself has begun to establish new layers of protection, such as two-step verification, precisely to reduce vulnerabilities and discourage an environment conducive to fraud.¹²

It is undisputed that the so-called “fake lawyer scam” has not only been profitable for those directly involved in the scheme, but also—and especially—for those who, through seemingly lawful means, obtain manifestly unlawful gains. This is a case of deliberate blindness that must be addressed: under the pretext that the illegal act is committed by third parties, certain companies contribute to maintaining an environment conducive to irregularities.

In this scenario, strict liability based on internal fortuitous events, the risk inherent in the activity, and qualified safety duties emerges as a relevant instrument, though not unlimited, for characterizing a special form of strict civil liability¹³ that combines the provisions of Article 14 of the CDC, applicable by virtue of the categorical connection rule of Article 45 of the LGPD to the case, but in an irrefutable interplay of legal sources with the provisions of Articles 44 (sole paragraph), 46, and 49, all of the LGPD.

In certain cases, such as that of the Vergueiro Special Civil Court, the bank’s failure is evident: failing to detect atypical transactions, ignoring repeated patterns of fraud, and failing to adopt double-checking mechanisms are omissions incompatible with the current state of the art. In others, such as the Santos case, broadening the chain of liability can be interpreted as a necessary step forward, but also as a dangerous expansion of the concept of “de facto supplier,” undermining legal predictability.

The challenge lies precisely in calibrating liability in a proportional, rational, and technically sound manner¹⁴. Civil liability, when addressing scams of this nature, must avoid both the reductionism that absolves all intermediaries under the pretext of “third-party acts” and the maximalism that transforms every participant in the digital ecosystem into a jointly and severally liable party. The balance lies in a thorough analysis of the conduct—or omission—of each agent: whether the financial institution neglected known security protocols; whether the platform allowed the circulation of notoriously aggressive fraudulent profiles; whether the identity verification system failed in a significant way; whether, in short, there was a concrete defect in the provision of the service.

None of this eliminates the need for criminal prosecution of the direct perpetrators of the scam. But civil liability, rather than functioning as a punitive tool, should serve as a mechanism for the efficient allocation of risks, making the agents who profit from digital activity bear the cost of the negative externalities it produces. In an age of hyperconnectivity, the “fake lawyer” scam is not a mere chance occurrence; it is a structural phenomenon that demands equally structural responses. It is up to the law, with caution and technical rigor, to establish the parameters for such liability—without dogmatism, but with the awareness that the protection of victims cannot be left to chance.

________________

---

1. SOUZA, Bernardo de Azevedo e; JACOB, Raphael Rios Chaia. Golpes digitais: como identificar, prevenir e agir contra ameaças virtuais. São Paulo: Thomson Reuters Brasil, 2023, p. 33-36.
2. MIGALHAS. Banco restituirá cliente vítima de golpe do falso advogado no WhatsApp. Migalhas Quentes, São Paulo, 17 jun. 2025. Disponível aqui. Acesso em: 03 dez. 2025.
3. This understanding is reinforced, in fact, by Precedent 479 of the Superior Court of Justice (STJ): “Financial institutions are strictly liable for damages resulting from internal fortuitous events related to fraud and crimes committed by third parties in the context of banking transactions.”
4. The “motorbike courier scam” is a type of fraud in which criminals pose as bank employees and convince the victim—usually an elderly person—that their card has been cloned or is at imminent risk. After creating a sense of urgency and fear through phone calls that appear legitimate—often using personal information obtained from data breaches— the scammers instruct the person to hand over their bank card to a supposed “bank courier,” who will pick it up for “cancellation” or “forensic analysis.” Once in possession of the card and the PIN—obtained under the pretext of “verification”—the gang makes withdrawals and purchases. Recent case law from the Superior Court of Justice (STJ) has held that, except in exceptional situations where the victim is solely at fault, this fraud constitutes an internal fortuitous event—that is, a risk inherent to banking activities—thereby imposing strict liability on financial institutions when they fail to demonstrate effective mechanisms for preventing, authenticating, and blocking atypical transactions. In this regard, certain precedents from the Third Panel are essential reading: (i) REsp 1.995.458/SP, Third Panel, decided on August 9, 2022, DJe August 18, 2022; (ii) REsp 2.015.732/SP, Third Panel, decided on June 20, 2023, DJe June 26, 2023; and (iii) AgInt in AREsp 2.201.401/RJ, Third Panel, decided on May 29, 2023, DJe June 1, 2023.
5. Telephone switchboard scams, also known as the “fake switchboard scam” or “fake operator scam,” consist of a social engineering scheme in which criminals impersonate bank employees, typically through phone calls that very convincingly mimic the financial institution’s official numbers (spoofing). The fraudster informs the victim that alleged suspicious transactions have been identified and, under the pretext of “technical support” or “bank security,” tricks the consumer into providing sensitive information such as passwords, authentication codes, tokens, card numbers, or authorizations, often instructing them to stay on the line, discard the card, or hand it over to a supposed courier. Once these authentication credentials are obtained, the scammer makes transfers, purchases, or withdrawals in the victim’s name. Like the practice mentioned earlier, this type of fraud has frequently been classified by the STJ as an internal fortuitous event, as it stems from risks inherent in banking activities and the structural vulnerability of the customer service system, imposing on financial institutions a heightened duty of care and strict liability when they fail to demonstrate effective mechanisms to prevent atypical transactions or fraudulent communications. On this point, see the ruling in REsp 2.222.059/SP, Third Panel, decided on October 7, 2025, DJe October 13, 2025. On this topic, see also SOUZA, Bernardo de Azevedo e; JACOB, Raphael Rios Chaia. Golpes digitais: como identificar, prevenir e agir contra ameaças virtuais. São Paulo: Thomson Reuters Brasil, 2023, p. 133-144.
6. DIÁRIO DE JUSTIÇA. Cliente cai no golpe do falso advogado e processa patrona: “foi a única que acessou dados”. 02 dez. 2025. Disponível aqui. Acesso em 03 dez. 2025.
7. TRIBUNAL DE JUSTIÇA DO ESTADO DE SÃO PAULO – TJSP. Instituições bancárias e de tecnologia indenizarão vítimas de golpe do falso advogado. Notícias TJSP, 16 set. 2025. Disponível aqui. Acesso em: 03 dez. 2025.
8. DATACERTIFY. WhatsApp, fraudes digitais e como coletar provas de forma segura. DataCertify, 22 ago. 2025. Disponível aqui. Acesso em: 03 dez. 2025.
9. In this area, measures to manage security incidents involving personal data are essential and can be effectively implemented through best compliance practices; see ROCHA, Henrique. Gestão de crises digitais, incidentes de segurança, comprometimento de dados pessoais e dados financeiros. In: CRESPO, Marcelo (coord.). Compliance no direito digital. São Paulo: Thomson Reuters Brasil, 2020, p. 224-225.
10. OABRS. Golpe do Falso Advogado: OAB/RS reúne empresas de telefonia e propõe medidas de combate. 01 dez. 2025. Disponível aqui. Acesso em 03 dez. 2025.
11. OABPE. OAB-PE ingressa com duas ações civis públicas contra o golpe do falso advogado. 02 dez. 2025. Disponível aqui. Acesso em 03 dez. 2025.
12. CNJ. Acesso em duas etapas a serviços do Judiciário evita golpe do falso advogado. 13 out. 2025. Disponível aqui. Acesso em 03 dez. 2025.
13. DRESCH, Rafael de Freitas Valle; FALEIROS JÚNIOR, José Luiz de Moura. Special strict civil liability in Brazil's General Data Protection Law. Brazilian Journal of Law, Technology and Innovation, v. 2, n. 2, p. 98-128, jul./dez. 2024, p. 120-123.
14. SAMPAIO, Marília de Ávila e Silva. Fraudes bancárias e a proteção de dados do consumidor. In: MARQUES, Claudia Lima; MARTINS, Fernando Rodrigues; MARTINS, Guilherme Magalhães; BESSA, Leonardo Roscoe (coord.). 5 anos de LGPD: estudos em homenagem a Danilo Doneda. São Paulo: Thomson Reuters Brasil, 2023. p. 303.