Identity Fraud in Brazil: How to Defend Yourself Against It

Brazil is seeing an increase in online identity fraud. According to research by Sumsub—based on 4.3 million verification procedures performed in Brazil—the most affected industries include payments, investment, trading, gambling, and crypto.

Sumsub’s research also found that 88% of IDs forged in Brazil are printouts. This may be explained by regional differences in the country’s ID documents, with fraudsters using this inconsistency to forge documents more easily.

Meanwhile, 80% of identity fraud attempts in Brazil occur at the verification stage. And the most popular type of identity fraud in Brazil is synthetic, meaning that it combines real and fake data to fabricate an identity to be used for signing up with various online services.

Brazil lags in certain technologies, creating favorable conditions for fraudsters. For example, more than half of documents forged in Brazil do not contain Machine-Readable Zones (MRZs), which makes them especially easy to fabricate. 

Among Brazilian ID documents, passports are the most forged (1.2% of all passports have signs of forgery), while driving licenses are least likely to be forged (just 0.18% of forgeries).

To confront the spread of identity fraud, the Brazilian government of Brazil introduced a new form of identity cards that include QR codes, which is planned to be fully integrated by March 2023. 

In the face of increasing fraud and incoming regulations, companies operating in Brazil need to employ a range of antifraud technologies to quickly evaluate document authenticity. In this article, we explain identity fraud in more detail, what the main forgery techniques are, as well as preventative technologies. 

What is identity fraud?

Identity fraud is the process of using a stolen or forged identity in criminal activities. The Brazilian Penal Code highlights several fraud types:

Identity theft means “using, as one’s own, a passport, voter registration card, reservist booklet or any other’s identity document or giving it to others so that they can use it, a document of that nature, own or third party.” The penalty is imprisonment from four months to two years, or a fine if the violation doesn’t constitute a serious crime.

False identity means “assigning oneself or attributing a false identity to a third party to obtain an advantage, for one’s benefit or someone else’s benefit, or to cause harm to others.” The penalty is imprisonment from three months to one year, or a fine if the violation doesn’t constitute a more serious crime.

Falsification of personal documents means to “falsify, in whole or in part, a private document or alter a true private document.” For this crime, the penalty is imprisonment from one to five years and a fine.

Сredit card fraud is considered forgery according to the Brazilian Penal Code. Article 208 stresses that “the credit or debit card is equivalent to a private document”.

What types of identity fraud occur in Brazil?

Brazil is considered a major contributor to global online fraud, as one of the biggest producers of spam, trojan viruses, and phishing. The country is also significantly affected by malware.

Online identity fraud is seriously impacting markets in Brazil, including crescent online retail, telecom, finance, and banking. According to Serasa Experian, the telecom sector ranks as the most affected by identity fraud with 35.5% of total cases, followed by banks and financial institutions.

Below we’ve listed the most common identity fraud types occurring in Brazil, according to Sumsub’s experts: 

Synthetic fraud is the most popular type of identity fraud in Brazil. It’s performed by combining real and fake names and CPFs (“Cadastro de Pessoas Físicas”, Portuguese for “natural personal register”) to create false identities. A CPF is an individual number that allows the Brazilian Revenue Service to identify taxpayers; it can be required to purchase real estate, obtain utility services, open a company, and more.

By creating fake identities, fraudsters can obtain new phone numbers and register accounts with financial institutions, retail, or e-commerce platforms. Since this type of fraud uses non-existing identities, there’s no individual victim who could bring attention to the scheme, leaving companies with less ability to detect it. 

Data theft occurs through the creation of fake websites that imitate real storefronts to steal personal data through malware. Stolen credit cards, passwords, and documents can then be used to buy products, take out bank loans, and more.

Counterfeit bills/bank slips fraud induces victims to download fake bills seemingly issued to them—for instance, by hacking into email correspondences. Sometimes fraudsters can even make the victim believe they have an unpaid debt.

Self-fraud or friendly fraud involves credit card purchases made by someone with the intention to ask for a chargeback, either by claiming they didn’t receive the product or that they were charged for a product they didn’t buy at all. Self-fraud is when the fraudster uses their own credit card to do this, while friendly fraud is when a fraudster uses their friend’s card. 

Financing with forged documents occurs when a fraudster pretends to be another person by fabricating documents or using someone else’s documents to purchase real estate, obtain financing, open shell companies, etc.

Identity theft and fraud statistics in Brazil

Sumsub’s analytics team examined over 50,000 fraud attempts at various verification stages and came to the following conclusions.

When identity fraud occurs in Brazil

The absolute majority of identity fraud attempts in Brazil occur at the ID verification stage (80%).

Proof of address (POA) verification makes up almost 15% of all fraud. This verification step is mandatory for all regulated companies under the Brazilian Central Bank (BACEN) and the Securities and Exchange Commission (CVM). Electricity and telephone bills and bank statements are primarily accepted as PoA, and fraudsters forge them by inserting false data (name, date of issue, and address) into them.

All other fraud cases (5%) are attempts to deceive liveness and selfie checks. The main methods that fraudsters use here are deepfakes, masks, and pre-recorded videos. 

Main techniques for forging IDs

Document printouts are the most common type of ID forgery in Brazil (87.5%). However, in most cases, it’s quite easy to recognize such forgeries, as fraudsters don’t crop them the right way.

Physical ID forgeries (approximately 7.5%) come second. This is when fraudsters try to physically alter document photos and data. These can be distinguished from originals by examining colors, fonts, and paper quality.

Digital ID forgeries account for about 5%. Fraudsters use various image editing programs (such as Photoshop) to alter documents. Such forgeries can be distinguished from originals by differing fonts and sizes, a large amount of noise in the photo, etc. 

How companies can deal with identity fraud

Online identity fraud is a growing challenge for companies operating in Brazil. To avoid the reputational and financial risks associated, it’s critical to understand the prevailing fraud patterns. Below, we’ve listed some recommendations for reducing identity fraud when doing business in Brazil.

At the ID verification stage, it’s essential to pay special attention to the user and consider blocking them if at least one of the following occurs:

• Their document is a printed copy;
• There are white margins around the edges of the document;
• The document is unevenly cropped;
• The photo of the document is of poor quality;
• The colors and fonts of the document differ from the standard;
• There are traces of glue around the photo or other signs of insertion;
• The paper quality of the document looks abnormal;
• There is no perforation or mandatory security features;
• The data on the document doesn’t match MRZ data.

Companies should use biometric technology (i.e. liveness) for face identification. Unlike selfies, biometrics can ensure an applicant’s physical presence and document ownership, as well as detect advanced fraud vectors such as deepfakes, hyper-realistic masks, and high-resolution videos.

Additional red flags to watch out for during verification process include:

• The country issuing the document does not match the user’s country/IP address;
• Verification steps are performed with abnormal timing;
• The location of the uploaded photo does not match the location of verification;
• The liveness check result indicates that the user’s age does not match the one stated on the ID;
• Uploaded photos were taken prior to the verification process;
• A frequently used IP address is detected.

Finally, companies should cross-check users through local databases. In Brazil, it’s recommended to validate applicant CPF numbers via SEPRO databases.

If you want to learn more about the state of identity fraud in Brazil and how to fight the spread of forged documents in the country, download Sumsub’s 2022 Fraud Report on Brazil.

FAQ

• What is a Brazilian identity card?

  The Brazilian Identity Card (Carteira De Identidade) is the official national identity document issued by the Brazilian federative units. While the cards look similar to each other across the country, federative units can introduce minor visual changes.

• What will the new Brazilian Identity Card look like?

  Brazil took major steps to prevent the spread of identity fraud by adding a QR code to identity cards issued from August 2022, and plans to finish the integration process by March 2023. Existing cards that don’t include the QR code will be valid until 2032.

• What is considered a forged document?

  A forged document is anything falsely presented as an authentic document.

• How to identify a fake ID card

  The fastest way to identify a fake ID card is by employing an automated verification system. Sumsub’s solution includes the following tools that can simplify the verification process:

  • Screenshot and screen recapture check ensures that genuine photographs are submitted rather than screenshots.
  • Image-based analysis checks every detail to ensure document integrity: pixel analysis, security features,fonts, and signs of graphic editing (such as Photoshop).
  • Behavioral risk analysis tracks behavioral risk signals associated with the user’s profile such as IP location, device fingerprints, and more.
  • Blocklist search identifies fraudsters by screening them against our 1m+ internal database of known fraudsters.
  • Liveness check ensures that customers are genuinely present and identifies if the user is making a duplicate account.
  • Database cross-check validates the CPF number of the applicant via SEPRO databases as an additional layer of security for Brazil.

• What is the penalty for identity fraud in Brazil?

  According to the Brazilian Penal Code, the penalty for identity fraud crimes can vary between three months to one year of imprisonment, or a fine. If identity fraud is part of a more serious crime, the penalty will increase.