Brazil currently occupies a paradoxical position in the global cybersecurity landscape. On one hand, it is a leader in financial innovation, with PIX being one of the world's most advanced and widely adopted instant payment systems. On the other hand, it is also a prime target for digital criminals who exploit the system's speed and convenience to execute scams on an industrial scale. The latest vector of this threat is fueled by generative artificial intelligence and deepfakes, which have ushered in a new era of fraud where “seeing is believing” is no longer sufficient.
The numbers reveal the scale of the challenge. In 2024, the Central Bank of Brazil recorded nearly R$ 5 billion in losses from PIX fraud, a 70% increase compared to the previous year. In the same period, crimes involving deepfakes grew 822% in Brazil, a rate five times higher than that observed in the United States. Globally, Deloitte projects that losses caused by AI-powered fraud will jump from US$ 12.3 billion in 2023 to US$ 40 billion by 2027. This is not an abstract threat: just a few seconds of audio are enough to clone voices and generate fake videos in real-time, capable of deceiving even experienced professionals.
Recent cases expose the destructive power of this combination. In early 2024, a financial employee in Hong Kong transferred US$ 25 million after a video conference with deepfakes of his CFO and colleagues. The episode involving the British multinational engineering firm Arup, with similar losses, was cited by the World Economic Forum as a paradigmatic example of AI-amplified social engineering. In Brazil, the Civil Police of the Federal District dismantled a R$ 50 million scheme that used deepfakes to access bank accounts. The common denominator is sophistication. These are no longer poorly written messages or artificial voices, but rather interactions perfect in form, and dangerously false in content.
Faced with this new frontier of fraud, traditional defenses (such as passwords, tokens, or even facial biometrics) become vulnerable. The voice can be cloned, the face can be recreated, but there is something that even the deepfake most realistic cannot accurately imitate: human behavior in the digital environment. This is where behavioral biometrics comes in, a technology capable of analyzing subtle interaction patterns such as typing rhythm, screen pressure, mouse trajectory, application switching, and browsing cadence.
In practice, these patterns function as an “invisible protection” that distinguishes a legitimate user from a fraudster, even when the latter possesses correct credentials or uses convincing images and audio. Behavioral biometrics solutions already analyze billions of monthly sessions in different countries and have shown significant results: in a major Latin American bank, for example, the adoption of this technology reduced social engineering scams by 67%, without generating additional friction for the customer – combining greater security with convenience.
Behavioral signals also help identify ongoing manipulation. One example is “induced urgency,” detected when there are rapid clicks followed by long pauses, typical of someone receiving external instructions during a transaction. Another is the presence of atypical actions, such as copying and pasting sensitive data, a behavior recorded in 30% of fraud cases versus less than 1% of legitimate sessions. By identifying these anomalies, the system can interrupt the transaction or trigger additional checks before settlement.
The risk of talent scarcity for Brazilian leadership
If defensive technology advances, there is an obstacle that threatens to compromise its effectiveness: the lack of qualified cybersecurity professionals. According to Fortinet, the global gap is 4 million positions, with 750 thousand in Brazil. The scarcity is so severe that the latest Gartner report points to the lack of talent as the main barrier to adopting new technologies, cited by 63% of IT leaders, ahead of even cost and risk concerns.
This shortage has direct implications for the ability of banks, fintechs, and technology companies to implement and calibrate solutions like behavioral biometrics. Without specialists to adjust models, interpret alerts, and integrate defense systems into critical flows like PIX, the risk is that part of the investment in technology loses effectiveness. The country that has become a global reference in combating AI fraud may see this leadership weaken if it does not accelerate the training and retention of talent.
The future of banking cybersecurity requires solutions based on machine learning and data-driven decisions, still distant from the reality of most financial institutions. The challenge of handling thousands of variables in real-time in PIX highlights the importance of technologies capable of creating institution-specific models, already adopted by hundreds of banks and companies worldwide, and which are becoming essential tools to combat digital fraud at scale.
The problem requires a systemic approach, such as expanding training programs, encouraging market-recognized certifications, relaxing hiring criteria to attract diverse profiles, and promoting collaboration between companies, government, and academia. More than ever, cybersecurity is an economic and strategic issue. With the popularization of deepfakes and generative AI, the challenge has ceased to be merely technical and has also become human. Without qualified people, technology does not deliver its full potential.
Brazil today is a global showcase in the fight against digital fraud and a constant testing ground for security solutions. If defenses work here, with the volume and diversity of attacks we face, they can work anywhere. But maintaining this position requires something beyond cutting-edge technology and agile regulation; it requires massive investment in people. In the battle against the triad formed by PIX, generative AI, and deepfakes, the winner will be the one who can identify, in real-time, what even the most sophisticated forgery cannot hide: the unique way each person interacts in the digital world.
