New version of Pix returns mechanism tracks funds tracking | Finance

The Special Returns Mechanism (MED) 2.0, which begins voluntary use on the 23rd of this month and becomes mandatory on 2nd February, will attack exactly this point, but sector bodies still see important security issues to be resolved, such as the system’s immediacy for high-value transactions.

MED currently only works for the account that first received the fraudulent Pix. The problem is that when a customer complains, this account is almost always empty. “The evolution of MED 2.0 is precisely about avoiding and suppressing this triangulation,” said Fernanda Larranja, vice president at Zetta.

According to the Central Bank (BC), MED 2.0 will map the path of funds following a fraud and share this trail with relevant authorities, allowing for refunds within 11 days of a dispute.

In reality, this mechanism targets the “modus operandi” of criminals, who quickly disperse funds across multiple accounts. “MED 2.0 will block funds at the underlying layer,” said Leandro Vilayne, president of the Brazilian Bankers Association (ABBC), adding that funds would pass through up to five different accounts within five minutes.

Ivo Mósca, Director of Innovation, Products, Services and Security at the Brazilian Banking Federation (Febraban), recalls that there was a technology agreement between BC and Febraban to accelerate the development of MED 2.0. Mosca expects there will be high demand for institutions to participate, even if compliance is initially voluntary. “In the first few weeks, we will see primarily large institutions coming on board and connecting to MED 2.0.”

Restricting instantaneous transfers through high-value Pix is ​​one of the priorities for associations in this sector. The payments sector’s technical forum, which brings together ABBC, the Brazilian Association of Credit Card Services Companies (Abecs), the Brazilian Association of Payment Institutions (Abipag), the Brazilian Internet Association (Abranet), Febraban and Zetta, has sent a proposal to BCs to hold large sums in remittance accounts.

Villain said the measure does not attack the first transfer, but the subsequent transfer. “The settlement is guaranteed, the transaction is made and irreversible, but the funds are blocked there (destination account) to see if there are any fraud alerts. This is for high-value transactions. There is no impact for the majority of the population.”

If the funds are already traceable, one of the bottlenecks remains the use of orange accounts, which are not yet subject to specific regulations. Vilain said there is already an organized account rental market. “People are earning R$200 to R$250 a week.”

The argument being defended by the association is that it provides more legal certainty against the forced closure of accounts used for fraud, even if the owner claims ignorance. “If he (the person renting the account) uses it inappropriately to facilitate a crime, he can no longer participate in the Pix system,” the ABBC president argues.

Initiatives are underway, such as BC’s Protege Mais, which allows customers to decide whether to accept opening an account in their name. This functionality should continue to be extended to Pix keys.

In the hacker attacks that occurred this year, the market understands that the vulnerability was not in PIX’s infrastructure, but in its human connections.

In July and August, two major hacker attacks on financial systems became public. The first and largest attack hit C&M, an information technology service provider (PSTI) that connects financial institutions to the Pix system. The misappropriation of value from accounts held by C&M’s client institutions is estimated at more than R$1 billion. The company said a similar attack occurred at Sinqia, also a PSTI, in August, resulting in the embezzlement of R$710 million. Both incidents occurred using legitimate credentials to access the system, but they were used inappropriately.

“Pix itself is a very secure system. Pix has an issue rate of 0.01%, which is lower than other configurations in the system,” said Zetta’s Laranja. “There’s nothing wrong with the Pix system. It’s an encrypted system where transactions on all sides are very secure. The problem is social.”

Diego Pérez, president of the Brazilian Fintech Association (ABFintechs), agrees that Pix is ​​a secure infrastructure, stressing that the weaknesses found were in access to the system. “It’s a very solid structure,” he says.

Regarding the new minimum capital requirements announced by BC last week, Perez said there is a strong possibility that companies will have difficulty raising capital, which could result in merger and acquisition activity. The president of ABFintechs said that he understands that this step is necessary, but is concerned about the impact on competition.

“We do not support over-innovation that does not guarantee the security of the system, but the moment you increase capital requirements too much, you are pushing further towards slowing down innovation and competition,” he says.

The measures announced this week represent a change in the logic for calculating the minimum capital required for financial institutions. This rule now takes into account the type of activity rather than the type of institution. As a result, requirements have been raised for different types of entities, such as banks, cooperatives, and payment institutions.

In announcing the measure, Ayrton de Aquino, B.C.’s director of inspections, said innovation and security must go hand in hand. “There is no attack from the central bank board on the innovation process. We remain firmly committed to the innovation challenge of the financial system. But we also need to approach this innovation challenge on the basis of security,” he said.