Brazilian law has rightly established the principle that financial institutions are strictly liable for damages resulting from internal fortuitous events related to fraud and crimes committed by third parties in the context of banking transactions. Precedent No. 479 of the Superior Court of Justice (STJ) articulates this principle and plays a significant role in protecting consumers against systemic failures in identification, authentication, data custody, and transaction security1. The contemporary issue, however, has shifted to another level: whether all digital fraud—especially when committed through social engineering and carried out with the user’s active authorization—can automatically be attributed to a defect in the banking service.
The answer must be no. Strict liability is not full liability, nor is it automatic liability, nor is it universal insurance against all financial losses experienced by consumers in the digital environment. Article 14 of the CDC waives the requirement to prove fault, but does not eliminate the fundamental prerequisites of civil liability. Damage, a defect in the service, and a causal link remain indispensable. Paragraph 3 of the same provision, by expressly preserving the exclusions from liability, confirms that strict liability does not eliminate the need for a causal assessment. Although the legal text uses the expression “exclusive fault of the consumer or a third party”1, contemporary legal doctrine recommends interpreting this scenario as the exclusive act of the victim or of a third party, since the decisive factor is not the subjective censure of the conduct, but its capacity to break the causal link.
Social engineering makes this assessment even more delicate. Unlike classic bank fraud, in which documents were forged, contracts were entered into without the account holder’s knowledge, or transactions were carried out without any involvement from the victim, many current digital scams depend on the active participation of the consumer. The victim enters a password, validates a token, confirms a transaction in an app, provides confidential credentials, installs remote access tools, or knowingly transfers funds to a third party. Even if this action is psychologically induced, it does not become legally irrelevant, since the fraud is not consummated solely by a technological vulnerability in the financial system, but by the behavioral manipulation of the user.
Hence the need for rigorous distinguishing with regard to STJ Precedent No. 479, given that the ratio decidendi underpinning the ruling was established in a context in which the consumer, as a rule, played no role in the actual occurrence of the damage. In other words, the harmful event was carried out by a third party through document fraud or a clandestine operation, without any relevant causal contribution from the victim. In social engineering scams, by contrast, the victim often plays an active causal role, even though they are deceived. The issue is not to pass moral judgment on their conduct, nor to impose on them a technical duty of digital security that is incompatible with consumer vulnerability. The problem is causal: determining whether the harm falls within the typical risk of banking activity or whether it stems from a sufficient external cause, situated outside the provider’s sphere of organization, oversight, and control.
This distinction takes on special significance when the fraud is structured around an ostensibly implausible promise of benefit, as there are situations in which the consumer is not simply led to believe that they are protecting their account, preventing it from being frozen, following supposed bank guidance, or stopping a fraudulent transaction. In fact, the consumer accepts a visibly deceptive offer based on disproportionate gains, extraordinary returns, an unlikely prospect of benefit, a nonexistent bonus, an opportunity incompatible with basic standards of prudence, or a manifestly anomalous financial advantage. In such cases, the fraud exploits not only trust, fear, or a sense of urgency, but also a specific willingness to accept an objectively suspicious promise of gain.
This “specific greed,” understood in a legal rather than a moralizing sense, corresponds to the conscious acceptance of an anomalous promise of financial gain. It can play a decisive role in the analysis of the causal link. This is not a matter of morally censuring the consumer, but of recognizing that civil liability cannot transform financial institutions into universal guarantors against voluntary financial choices made outside the bank’s sphere of control, especially when the transaction was properly authenticated, without system intrusion, without clandestine theft of credentials, and without objective signs that would have warranted a block, delay, or enhanced intervention.
The causal link is, in this matter, the primary safeguard against the trivialization of strict liability, since the damage may exist, be severe, and result from the socially reprehensible conduct of a fraudulent third party; yet it will still not be legally attributable to the financial institution if it does not stem from a defect in the service. Statement 659 of the Civil Law Conference is particularly apt in noting that the difficulty of identifying the causal link does not justify disregarding its analysis2. In cases of digital fraud, this warning is decisive, as the causal chain typically involves a third-party fraudster, the victim’s behavior, authentication mechanisms, transactional patterns, regulatory monitoring obligations, potential alerts, and systemic responses from the provider.3
The theory of adequate causation provides a relevant criterion. One must ask whether, according to common experience and the normal course of events, the banking service provided was a legally sufficient cause of the damage or whether the result stemmed from an extraordinary circumstance—external or predominantly attributable to the victim or a third party4. Furthermore, the theory of the scope of protection of the legal norm allows us to ask whether the damage actually suffered falls within the scope of protection of the violated norm. The provision mandating banking security does not make the bank an absolute guarantor against all fraud based on human persuasion; rather, it requires reasonable technical standards, proportionate detection mechanisms, risk-based authentication, and appropriate responses to objective signs of anomalies.
Pix, by its very architecture, was designed to be fast, accessible, interoperable, and low-friction. This efficiency does not eliminate security obligations, but it prevents the system from being required to operate in a manner incompatible with its functionality. Financial institutions must maintain transaction monitoring, authentication, alerts, operational limits, preventive blocks, and proportionate responses to objectively atypical transactions. Central Bank regulations even provide for instruments such as precautionary blocking and the Special Refund Mechanism, intended to mitigate fraud5. Such mechanisms, however, do not constitute automatic recognition of civil liability. They reflect duties of prevention, traceability, and response, not a legal promise of infallibility.
Therefore, the service defect must be specifically established. Liability will arise when the transaction reveals a blatant inconsistency with the customer’s historical profile, an atypical concentration of transactions, the instantaneous taking out of a loan followed by the dispersal of funds, the complete depletion of funds within a very short period, an unjustified absence of alerts, authentication failure, failure to act on objective signs of fraud, or noncompliance with regulatory security parameters. In such cases, the provider’s omission may form part of the causal chain and justify full or partial liability for damages.
The situation is different when the transaction occurs in a normal environment, through valid authentication, without any system breach, without any detectable objective anomaly, and after the consumer voluntarily accepts a manifestly suspicious offer presented by a third party unrelated to the financial institution. In this case, the exclusive act of the victim or a third party may sever the causal link. The bank acts as the technical executor of an order voluntarily issued by the account holder, not as the legal cause of the loss; thus, attributing the damage to the provider, in this scenario, would distort the framework of Article 14 of the CDC and transform strict liability for service defects into unlimited financial liability for the consumer’s business decisions.
Between these two extremes lies a middle ground. The appropriate response will not always be the total exclusion of liability or the full liability of the financial institution. When there is a failure on the part of the provider to monitor, warn, or intervene, but there is also a relevant causal contribution by the victim, it is necessary to recognize the contributory act of the victim, with the damages adjusted in accordance with Article 945 of the Civil Code (CC), applied in conjunction with the consumer protection framework6. Compensation must correspond to the extent of each party’s causal contribution. This solution preserves consumer protection without leading to the indiscriminate socialization of losses resulting from grossly negligent individual conduct.
Theme 352 of the National Uniformity Panel7 reinforces this interpretation by recognizing that, in Pix transactions where fraud through social engineering is proven, the liability of financial institutions is strict, but may be excluded when it is demonstrated that there was no failure in the provision of the service or when the harmful event results from an act exclusively attributable to the consumer or a third party. The same guidance acknowledges that the voluntary disclosure—even if induced—of confidential data and banking credentials constitutes a relevant element in characterizing the exclusive or contributory act of the victim, requiring an analysis of the degree of diligence that could reasonably be expected.
Social engineering, therefore, cannot serve as a universal alibi for financial institutions, nor can it be turned into a rhetorical password for automatic liability awards. The legally correct question is not merely whether fraud occurred. One must ask: Was there a service defect? Was there a breach of technical or regulatory duties? Was the transaction objectively incompatible with the customer’s profile? Were there external signs of an anomaly? Did the bank fail to take reasonable measures to issue warnings, block access, or implement enhanced authentication? Did the consumer ignore warnings? Did the victim accept a manifestly fraudulent promise of benefit? Does the damage fall within the scope of protection provided by banking security regulations, or does it result from the consumer’s own decision to put their assets at risk?
Consumer protection demands dogmatic rigor. Vulnerable consumers must be protected against insecure systems, material omissions, monitoring failures, and information asymmetries exploited by the provider. But vulnerability does not equate to permanent legal incapacity, nor does it authorize the complete neutralization of responsibility for voluntary acts. Indiscriminate compensation for every authorized transfer—including when motivated by an absurd promise of easy gains—creates perverse incentives: it reduces individual caution, increases systemic costs, makes financial transactions more expensive, and compromises the functional rationality of Pix itself.
Contemporary civil liability must preserve its compensatory function without abandoning the principle of causation. In social engineering scams, especially when the victim accepts a visibly deceptive offer in the expectation of a disproportionate benefit, the central issue is not to deny the existence of the scam, but to determine to whom the damage is legally attributable. If there is no bank failure, if the system functions normally, if authentication mechanisms are followed, and if the loss results from the user’s voluntary choice in the face of an objectively suspicious promise, the exclusive act of the victim or of a third party severs the causal link.
The best legal response, therefore, lies neither in the automatic exoneration of banks nor in automatic compensation for consumers. It lies in a concrete, causal, proportional, and technically sound analysis. Only in this way will it be possible to reconcile digital security, consumer protection, objective good faith, the functionality of Pix, the regulatory duties of financial institutions, and individual responsibility in an environment of increasingly sophisticated fraud.
_______
- BRASIL. Lei n. 8.078, de 11 de setembro de 1990. Código de Defesa do Consumidor, art. 14, §3º.
- CONSELHO DA JUSTIÇA FEDERAL. Enunciado 659 da IX Jornada de Direito Civil: “O reconhecimento da dificuldade em identificar o nexo de causalidade não pode levar à prescindibilidade da sua análise”.
- FORNASIER, Mateus de Oliveira; KNEBEL, Norberto Milton Paiva; SILVA, Fernanda Viero da. Phishing e engenharia social: entre a criminalização e a utilização de meios sociais de proteção. Revista Meritum, Belo Horizonte, v. 15, n. 1, p. 116-129, jan./abr. 2020, passim.
- Sobre causalidade adequada e escopo de proteção da norma, cf. ROSENVALD, Nelson; BRAGA NETTO, Felipe. Responsabilidade civil: teoria geral. 2. ed. Salvador: Juspodivm, 2026, p. 951-952; TEIXEIRA NETO, Felipe. Responsabilidade civil objetiva. Indaiatuba: Foco, 2022, p. 199; VICENTE, Dário Moura. Direito comparado. Obrigações. Coimbra: Almedina, 2017. v. II, p. 448-449.
- BANCO CENTRAL DO BRASIL. Regulamento do Pix. Brasília: Banco Central do Brasil, versão vigente. Disponível aqui. Acesso em: 10 fev. 2026; BANCO CENTRAL DO BRASIL. Manual Operacional do Pix – Segurança, gerenciamento de risco e bloqueio cautelar. Brasília: Banco Central do Brasil, s.d. Disponível aqui. Acesso em: 10 fev. 2026.
- BRASIL. Lei n. 10.406, de 10 de janeiro de 2002. Código Civil, art. 945. Sobre reparação integral e vedação à superindenização, cf. SANSEVERINO, Paulo de Tarso Vieira. Princípio da reparação integral: indenização no Código Civil. São Paulo: Saraiva, 2010, p. 58.
- TNU. Tema 352. PEDILEF n. 1054560-45.2021.4.01.3500. Julgado em 12 nov. 2025. Tese fixada sobre responsabilidade civil objetiva em transações via Pix com fraude por engenharia social, excludentes, fato exclusivo ou concorrente do consumidor e aplicação do art. 945 do Código Civil.