Brazilian organized crime is expanding its operations from the physical world into cyberspace. Organizations such as the First Capital Command (PCC) are incorporating digital tools and methods into their criminal structures, leveraging their networks, financial resources, and logistical capabilities to diversify their activities and penetrate the illicit digital economy. Drug trafficking, extortion, and money laundering are now joined by phishing, bank fraud, identity theft, and scams involving Pix, the instant payment system operated by the Central Bank of Brazil. According to the Global Anti-Scam Alliance’s (GASA) State of Scams in Brazil 2026 report, between March 2025 and February 2026, Brazilians were exposed to 34.5 billion scam attempts, an average of 201.6 per adult, with estimated losses of about $4 billion.
“Drug trafficking involves an entire physical chain: production, transportation, borders, storage, distribution, territorial disputes, and constant exposure to seizures and confrontations. In the digital environment, a criminal can simultaneously reach thousands of victims in different states or countries without having to be physically close to them,” Flávio Diniz, president and director of the Intelligence Center at the National Institute for Combating Cybercrime (INCC), told Diálogo.
The transformation has also taken on an international dimension. According to The Exodus Road Brasil, the Brazilian branch of an international nongovernmental organization dedicated to combating human trafficking, victims rescued from a scam compound in Cambodia reported forced labor, threats of torture, and intimidation by individuals who, according to their accounts, were linked to the PCC.
For security forces, this expansion into digital crime adds to the complexity of countercrime operations. An operation can be planned in one country, physically carried out in another, and affect victims in many others, while proceeds can move through digital payment systems and parallel financial networks before being laundered. The response must therefore integrate financial and cyber intelligence, along with faster international data sharing, to identify those responsible, reconstruct criminal networks, and freeze illicit proceeds before they can be dispersed or concealed.
The scam industry
According to the Global Initiative Against Transnational Organized Crime (GI-TOC), digital scams generate hundreds of billions of dollars annually for criminal organizations worldwide. So-called scam centers have proliferated particularly in Asia and Africa and operate like criminal enterprises, capable of carrying out fraud on a global scale and rapidly moving operators, technologies, and financial flows across jurisdictions.
In July, INTERPOL released the results of Operation First Light 2026, during which authorities arrested 82 people and dismantled a scam call center in Eswatini, Africa. Inside, authorities found a fake Brazilian Federal Police station designed to deceive victims in Brazil, a modus operandi similar to one uncovered in March in Cambodia, where a casino was used as a front for an online scam center.
“It is precisely this operating model that attracts domestic organized crime because it carries the same DNA as the factions,” Brazilian security and digital crime expert Victor Alfa told Diálogo. It is “a highly scalable business model that can be managed from anywhere in the world” and “easily connects with the parallel financial network that criminal groups have already built using fintech companies.”
Increasingly structured forms of organized fraud are also emerging in Brazil, where criminal networks can exploit a vast pool of potential victims, digital payment systems, and illegally obtained personal data. In São Paulo, in January 2026, the Civil Police’s Operation Título Sombrio uncovered a scam call center in the heart of the city’s financial district, with 400 computers and about 100 employees. According to police, the criminals used illegally obtained data to contact primarily older people, promising to recover supposed credits and convincing them to make payments through Pix.
“The real problem lies in the ecosystem: the combination of exposed data, irreversible transfers, and a sense of impunity. The weakest link ultimately is human persuasion, not technology,” Alfa said.
AI and cryptocurrencies
Artificial intelligence (AI) and cryptocurrencies are also reinforcing the architecture of cybercrime in Brazil. While AI increases criminals’ ability to identify and manipulate victims, cryptocurrencies facilitate the transfer and concealment of proceeds. This combination lowers barriers to entry into cybercrime while increasing its profitability and reach.
In the past, sophisticated cyberattacks required specific technical expertise. Today, many of these capabilities can be automated or purchased as services, allowing criminals to focus on exploiting victims and monetizing attacks.
“AI is a force multiplier for criminal capabilities that lowers the level of technical expertise required to enter the cybercrime market,” Diniz said. “The criminal does not necessarily have to be a programmer. They can use tools developed by third parties.”
Within the fraud ecosystem, AI comes into play during the victim-targeting phase: voice cloning, deepfakes, and highly convincing advertisements make it possible to create highly targeted scams on a massive scale. “Scams are no longer limited to messages riddled with grammatical errors and can use victims’ names, habits, and personal information,” Alfa said.
Cryptocurrencies, by contrast, come into play during the asset-concealment phase. Money, often initially stolen through Pix, can be converted into cryptocurrency and transferred across different blockchains, wallets, and digital platforms, passing through multiple transactions and jurisdictions. Once introduced into the same laundering network, proceeds from different criminal activities can be mixed, making it difficult to determine whether a particular sum originated from drug trafficking, cybercrime, or other illicit activities.
Operation Exchange illustrates this convergence. In July, the operation targeted an organization linked to the PCC and accused of laundering money through cryptocurrencies and other financial mechanisms. According to authorities, the group allegedly moved more than $1.94 billion through cryptoassets, cash transportation, banking transactions, and transfers between individuals and companies.
Crime-as-a-service
The dark web adds another layer of complexity through so-called crime-as-a-service, a marketplace where stolen data, credentials, and access are sold through online forums and encrypted channels. For groups with capital, logistical networks, and money-laundering structures, this makes it possible to integrate cybercrime into existing criminal structures without having to develop all the necessary technical capabilities in-house.
“The cybercrime market operates in a modular fashion, where some groups purchase ready-made tools such as stolen databases, website-cloning kits, and accounts registered to straw owners,” Alfa said. According to the expert, the faction contributes only what it already knows how to provide: capital, money-laundering logistics, and extensive reach. “Monetization distributed among thousands of victims makes individual cases difficult to trace and generates revenue that is highly resistant to law enforcement.”
Concrete signs of this market are already emerging in Brazil. In August 2026, the Federal Police carried out Operation Watchdog against an individual accused of hosting and distributing infostealers, programs designed to steal passwords, credentials, and financial data.
The risk emerging from the convergence between IT specialists and Brazilian criminal groups is “the commodification of offensive capabilities.”
“The criminal ends up buying cybercrime the way a company buys software,” Diniz said. The dark web thus lowers the barrier to entry into cybercrime and allows criminal organizations to purchase capabilities instead of developing them. As a result, security forces face growing difficulty reconstructing the chain connecting those who develop the tools, carry out the fraud, and launder the illicit proceeds.
Fighting crime at internet speed
When confronting transnational digital crime, the priority, according to experts, is not only to identify the operators but also to disrupt the financial flows underpinning the entire criminal architecture. The Central Bank of Brazil’s Special Return Mechanism allows victims to request, through financial institutions, that funds associated with fraud be blocked for review and possible reimbursement, while INTERPOL’s I-GRIP system enables authorities to coordinate the transnational tracing and freezing of illicit proceeds across borders.
“We need to expand rapid blocking and reimbursement mechanisms […],” Alfa said, along with stricter controls over cryptocurrency platforms. But the central problem is speed. “Digital money crosses borders in fractions of a second, while investigations move bureaucratically and are constrained by physical jurisdictions,” he said.
The response must therefore shift from reaction to anticipation, integrating police, financial intelligence agencies, regulatory authorities, and international cooperation. The objective is to quickly detect anomalies, connect seemingly unrelated transactions, and neutralize financial nodes before the proceeds can be concealed.
“The threat is no longer represented by isolated criminals, but by a criminal ecosystem in which different organizations buy, sell, and share capabilities,” Diniz concluded.
