A name on the screen is not the same as protection

RC/FP/2026/T.8 · Letter from the table · 22 May 2026

To the Fair Play Council

I am writing from Porto Alegre, and I want to bring into this discussion what I hear from owners in my Portuguese-speaking community. The stories are not all identical. The sentence I hear most often is: “I saw the warning, but I did not know what else I could do.”

Here is one episode, translated from the kind of account people share with me. On 16 April, an owner received an email that appeared to continue an ordinary exchange with a supplier. It said the bank details for an outstanding invoice had changed. The message arrived during a busy week, referred to the right invoice, and asked for payment that day. The owner transferred R$ 8,740 by Pix on 17 April.

The Pix confirmation screen showed the recipient’s name. It was not the supplier’s name. The owner noticed the difference, but understood the message to mean the supplier had changed how it received payments. There was no second person available to check the details, and the invoice was due. This is not a story about someone who never looked. It is about a small owner who saw a clue, weighed it against a plausible explanation and a deadline, and made the wrong decision.

On 20 April, after contacting the supplier through a previously used channel, the owner learned that its payment details had not changed. The owner contacted the bank and asked it to try to recover the Pix. The bank explained that it could open a request through Brazil’s Special Return Mechanism, known as MED, for suspected fraud. MED gives participating institutions a route to seek a return and block funds where possible. It does not guarantee that the money will still be there, or that the customer will be reimbursed. The owner also made a police report and kept the email, invoice and transfer records.

I share this account because the gap between “there is a mechanism” and “the money comes back” is where many small businesses are left alone. Pix is designed to move money quickly. A fast payment is useful when everything is right; it is painful when a fraudster has made the false instruction look ordinary. Once the money has moved, the owner may have to explain the same event to a bank, the police and the intended recipient, while continuing to meet payroll and pay genuine invoices.

Brazilian Pix users are shown recipient information before confirming a transfer. That matters: a visible mismatch can give someone a chance to stop. But a name displayed on a screen is not, by itself, a reliable identity check for a hurried person. Nor does it tell the customer what happens after a suspected fraud is reported. Owners need warnings that are clear enough to act on, a route to contact their bank immediately, and a serious effort to trace and recover the funds.

What the proposed fix would change

I support FP-001, the Business Fraud Standard. I understand its central asks to be that banks and payment providers verify payee names, act quickly to recall fraud payments, and reimburse small businesses harmed by authorised push payment and business email compromise fraud, including across borders. Those are practical protections, not a promise that no one will ever be deceived.

For an owner making a transfer, a meaningful name check should do more than display a name and leave the person to decide what a mismatch means. It should make a mismatch plain and give a simple way to pause and verify the change. For a person reporting fraud, the provider should take the report promptly, contact the other institution through a working channel and explain what is being done. The process should not depend on a small business knowing the right technical term, or on the owner having spare hours to chase several organisations.

And when a business has acted in good faith and followed reasonable security steps, the loss should not automatically become its private burden simply because the payment was authorised. “Authorised” describes the button that was pressed; it does not describe whether the instruction was genuine. A fair standard should set out how reimbursement decisions are made, give reasons when a claim is refused, and include cross-border cases rather than treating distance as a reason to stop trying.

I do not think every case can be recovered. Sometimes funds will already be gone, and sometimes the evidence will not support a claim. But a clear standard can still change what happens: fewer customers left guessing, faster contact between providers, a better chance of stopping onward transfers, and a more consistent answer for small firms facing the same kind of fraud.

Please keep listening to owners who are not fluent in the language of banking operations. In Portuguese, people often describe these events as “a golpe” or “uma fraude,” but the practical questions are very specific: Who can I call now? Can the payment be stopped? What proof do you need? When will I hear back? A standard should be understandable at that moment, not only after the loss has become a file number.