Look! The scammer is coming!
Where
Ground Floor
BSides Las Vegas
Duration
53 min
Surveys how Brazilian fraud schemes work, from mule accounts and fake banking pages to social engineering and scam resilience.
Summary
The speaker, a cybersecurity analyst from Brazil, explains why Brazil ranks among the leading countries for online fraud. She points to large public data leaks, a culture of improvised workarounds, and a banking system that relies heavily on instant transfers, payment slips and messaging apps. The history she traces starts with website defacement in the late 1990s and moves to bank robbers who switched to cheap, ready-made attack kits once online banking took off.
The middle of the talk covers how the schemes operate. Criminals open or rent accounts at small digital banks using stolen identity data and purchased selfies, and they recruit car dealers and insiders to push fraudulent vehicle financing through approval systems. She walks through a phishing setup in which an operator watches a victim's session in real time, fake online stores that take payment by payment slip and never deliver, and an email attack that swaps payment barcodes over IMAP. Overlay trojans targeting desktop banking and lookup panels that aggregate personal records round out the examples.
The closing argument is that these schemes persist because of weak deterrence, limited digital education, economic inequality and attackers who keep iterating. For practitioners, the takeaways are that smaller institutions with light onboarding checks are attractive targets, and that social engineering remains the foundation of most of these scams.
Related talks
Track 2·49 min
James McQuiggan
Explains how deepfakes are built, the fraud cases they power, and the human checks that help catch them.
WISP·14 min
Alexis Hancock · Kenyatta Thomas
Argues that mandatory age verification laws weaken privacy and safety for everyone, and offers ways to push back on them.
Ground Floor·24 min
Josh Kamdjou
Shows how generative AI lets attackers build convincing, fabricated email threads for phishing campaigns at scale.

