As 16.5 million revelers flood São Paulo’s 627 official street parades this week in what organizers call the largest Carnival operation ever mounted, criminals are matching that ambition with increasingly sophisticated fraud networks that blend old-school pickpocketing with artificial intelligence.
The scale is staggering. Brazil’s banking sector reported R$10.1 billion in fraud losses in 2024, while Pix-related scam losses jumped 43% to R$2.7 billion, according to Febraban data. Between January and September 2025, the Association for the Defense of Personal Data and Consumers recorded 28 million Pix fraud cases, 2.7 million online shopping scams, and 1.6 million WhatsApp frauds. Brazil now ranks second globally in cyberattack volume, absorbing 700 million attempts annually.
During Carnival 2025, São Paulo state logged 3,678 cellphone thefts and robberies — one every two minutes — while Rio de Janeiro saw a 46% surge in phone crime compared to the previous year. A stolen unlocked phone is no longer just a hardware loss; it is a gateway to banking apps, social media accounts, and instant Pix transfers that empty accounts in minutes.
One Scam Every 2.4 Seconds: How AI-Powered Crime Is Crashing Brazil’s Biggest Party
Deepfake fraud grew 126% in Brazil in 2025, with the country generating 39% of Latin America’s synthetic media. Police in Rio Grande do Sul arrested four suspects last October behind a R$20 million scheme using AI-generated videos of Gisele Bündchen to run fraudulent Instagram ads. Voice cloning now requires just seconds of audio to produce calls indistinguishable from a real person.
Conservative commentators have framed the crisis as evidence of inadequate law enforcement and judicial leniency, while progressive voices point to systemic digital exclusion and the absence of robust consumer protection infrastructure. Both sides agree on the urgency: the ADDP reports that fraud has become “a structured industry, with organized gangs and ready-made fraud kits.”
São Paulo’s response this year includes 5,200 military police officers daily, plainclothes agents embedded in parades, and a Meta partnership enabling verified notifications to flagged devices through the SP Mobile program, which has already recovered 17,500 phones. The Central Bank has introduced Pix device registration limits and a voluntary CPF block for new account openings.
Yet for the millions dancing through the streets, protection ultimately comes down to individual vigilance: lowering Pix limits before leaving home, disabling contactless payments, avoiding public Wi-Fi, and accepting that the phone might be safer left behind entirely.