Fake lawyer scam on WhatsApp: bank ordered to reimburse victim for security breach

A new court decision reinforces the responsibility of financial institutions in protecting their customers against digital fraud. In a recent case, a bank was ordered to fully reimburse an account holder who became the victim of a fake lawyer scam, carried out through the WhatsApp messaging application. The conviction occurred due to the institution’s delay in analyzing and blocking the suspicious transaction, which allowed criminals to empty the receiving account.

The incident exposes a critical vulnerability in the financial system, where the agility of instant transactions, such as Pix, contrasts with the slowness of the security protocols of some institutions. The victim, after being deceived into transferring a large amount under the pretext of paying legal costs, acted quickly to notify his bank, which in turn contacted the institution where the money was sent.

However, the fraud analysis by the receiving bank only began seven days after notification, more than enough time for the scammers to move the funds. Justiça understood that this delay constituted a serious failure in the provision of service, violating the duty of safety and protection established by Código of Defesa of Consumidor.

How the fake lawyer scam is carried out

The sophistication of digital scams has increased considerably, and the fake lawyer fraud is a clear example of this evolution. Criminals begin their action by monitoring judicial processes, which are largely publicly accessible. Using this information, they identify the parties involved, their lawyers and the details of the case, which adds a layer of veracity to the approach. Armed with this data, scammers create fake profiles on WhatsApp, using the photo and real name of the victim’s lawyer, easily obtained from social networks or professional websites.

Read also: Criminals exploit WhatsApp’s function to steal bank details and reset accounts in video calls

Communication is done in a direct and persuasive way. The false lawyer claims the need for an urgent payment to release funds, pay court costs or to guarantee an advantageous agreement. Psychological pressure is a key component, with criminals imposing a short deadline for the transfer, preventing the victim from having time to reason or verify the authenticity of the request. The transaction is generally requested via Pix, due to its instantaneity, which makes it extremely difficult to cancel or refund the amounts after confirmation of fraud.

The failure in security and the responsibility of the financial institution

Brazilian legislation is clear when defining the obligations of financial institutions. According to Código of Defesa of Consumidor and resolutions of Isso means that, regardless of fault, they must respond for damages caused by fraud arising from their operations.

Learn more: Cloned accounts on WhatsApp are soaring and experts reveal how to protect data and regain access

In the case in question, the judicial analysis distinguished responsibility between the banks involved. The victim’s bank was not to blame, as the transfer was carried out using a personal password and valid authentication mechanisms, initially characterizing the account holder’s exclusive fault.

However, the responsibility fell entirely on the financial institution that received the resources. The seven-day delay in initiating the verification procedure for the fraud report was considered unacceptable negligence.

Security protocols, such as Mecanismo Especial of Devolução (MED) of Pix, require almost immediate action to preemptively lock funds in suspicious accounts. By failing to fulfill this duty, the receiving bank allowed the crime to take place, becoming co-responsible for the victim’s financial loss.

Understand the case: You could be the next victim of the fake lawyer scam via WhatsApp, learn how to protect yourself

Understanding the court decision on the case

The sentence that condemned the receiving bank was based on a consolidated understanding in the higher courts regarding the risk theory of the activity. Essa doctrine holds that whoever profits from an economic activity must also bear the risks inherent to it. In the banking sector, transaction security is a fundamental pillar, and any failure in this system that results in loss to the consumer generates the duty to compensate. The judge responsible for the case highlighted that financial institutions have advanced technology to monitor suspicious activities in real time, such as transfers of atypical amounts to newly opened accounts or those with little transaction history. The bank’s inertia in using these tools effectively was the determining factor in the conviction. The decision also exempted the messaging platform from any liability, a common position in these cases. Foi understood that the application only functioned as a means of communication and did not present security flaws that contributed to the scam. Responsibility, therefore, was attributed to whoever has control over the financial flow and the mechanisms to block it: the banking institution.

Criteria for sentencing and the issue of moral damages

The victim also claimed compensation for moral damages, arguing the psychological damage and stress caused by the fraud. Contudo, the request was dismissed by the magistrate.

The understanding was that, although the situation caused annoyance and material damage, there was no proof of a serious offense to the personality, honor or dignity of the victim that would justify extra-patrimonial compensation.

This approach aims to avoid trivializing the institution of moral damage, reserving it for situations that actually go beyond everyday unpleasantness. The conviction, therefore, was restricted to the return of the amount transferred, plus monetary correction and interest, in addition to the payment of procedural costs and legal fees, set at 10% of the value of the case.

Strategies to protect yourself from digital fraud

The main weapon against this type of scam is distrust. It is essential that consumers question any urgent payment request received through messaging apps, even if the contact appears legitimate.

More on this story: Criminals steal WhatsApp profiles using fake security code to extort contacts

Before making any transfer, it is essential to verify the veracity of the request using a different and already known communication channel, such as a telephone call to the law firm’s official number.

The role of technology in prevention

Adopting digital security measures, such as activating two-step authentication on WhatsApp and other applications, adds an extra layer of protection that makes it difficult to access accounts and clone profiles, practices often associated with these scams.