Got scammed or had your account stolen?

The message looked like it came from a gaming friend, the link promised free coins, and two minutes later the account was no longer yours. Or the Pix payment (Pix is Brazil's instant payment system) went to a store that never existed. If the question now is "what to do if you get scammed", take a breath: you can act, and the order of the steps matters. CERT.br, the Brazilian computer security incident response team maintained by NIC.br, sums up the rule: if you fell for a scam, act fast, because that reduces the damage and prevents more victims. This guide, for Pathfinders aged 10 to 15 and their families, starts with a rule that applies to everyone: whoever falls for a scam is a victim, and victims tell an adult.

🚨What to do if you get scammed: what comes first?

The booklet Golpes: Caiu? Veja o que Fazer (Scams: Fell for One? Here's What to Do), published by CERT.br in May 2026, starts with cutting off contact with the scammer. If they insist, ask for more money or make threats, stop replying: don't send more money or information, don't negotiate, and block the profile or number. Every extra message can expose new data.

The second step is the one teenagers find hardest: telling an adult. Many people hide it out of embarrassment, and the scammer takes advantage of that silence (asking you to keep a secret is one of the scam warning signs listed by CERT.br). Choose a trusted adult, whether a parent, guardian, Counselor or Director, and tell them everything. That adult is the one who deals with the bank, the card and the police report.

For families, the advice is to take the news without scolding: the talk about the mistake can wait, because right now everyone is on the same team.

Steps from the CERT.br booklet Golpes: Caiu? Veja o que Fazer (May 2026, in Portuguese); telling an adult and the split by time are the editors' additions.

🔐Account hacked: what to do to get it back?

If you typed your password into a fake page or gave it to the scammer, CERT.br advises changing it immediately on every account where you used it, turning on two-step verification, rejecting login approvals you didn't start and ending sessions open on other devices.

Start with your email. CERT.br's booklet Autenticação (Authentication) explains that a break-in to your email can lead to break-ins on other accounts if that email is used to recover passwords. Use a long password (the guide suggests three random words), and a different one for each service.

If the scammer has already changed the password, use the platform's official help center, and only that. Google has a recovery page (accounts.google.com/signin/recovery), and the Instagram Help Center points to instagram.com/hacked for a hacked profile. On WhatsApp, according to the WhatsApp Help Center, registering your number again with the six-digit code logs out the other devices; if the intruder set a two-step verification PIN, you may have to wait seven days.

In games, use only the official support. Anyone offering to recover your account on the side, for a fee or by asking for your password, gets the CERT.br rule for anything involving money or data: it's a scam until proven otherwise.

💸Can you get your money back if you get scammed through Pix?

Sometimes, and the odds improve with speed. The Mecanismo Especial de Devolução (MED, Special Return Mechanism), from the Central Bank of Brazil, is the Pix feature for returning money in cases of scams, fraud and operational failures, and CERT.br points to it as the fastest route for anyone who bought from a fake website, paid an altered QR code or was tricked into making a transfer.

The account holder disputes the transaction in the Pix area of the bank's app, which must offer this function, or through official channels. According to the Central Bank's MED guide (version 4.3), the transaction must be no more than 80 days old, and the bank opens the recovery request right after the complaint, without requiring a police report at that point.

A fake store that never delivers is covered; a real store that was late or sent the wrong model is not, because a commercial dispute goes to the courts. A Pix sent by mistake to the wrong key is also left out. And the refund depends on the money still being there: since February 2, 2026, when version 2.0 of MED became mandatory, the system also follows the money into the accounts it was passed on to, but if it is gone, as a rule the banks are not required to cover the loss with their own funds.

For a credit card purchase, dispute it in the card issuer's app and ask for the card to be blocked, as CERT.br advises. The Brazilian Federation of Banks (Febraban) adds that notifying the bank immediately allows it to block the app and the access password.

Source: Central Bank of Brazil, guide to Pix return procedures with emphasis on MED, version 4.3 (in Portuguese).

🗂️What evidence should you keep, and how do you file a police report online?

Before deleting anything, gather the evidence: links, messages, screenshots, profile names, phone numbers and receipts, plus case numbers, the names of the agents who helped you, dates and times, as CERT.br lists. This material is used to request a refund, file the police report and go to court or to consumer protection agencies.

In Brazil, the police report, called a boletim de ocorrência (BO), officially records the case and may be needed to dispute fraud and claim insurance. In most cases, according to CERT.br, it can be filed online, with the evidence attached.

Each Brazilian state has its own system. In São Paulo, the Civil Police's Delegacia Digital (Digital Police Station) accepts online reports of "Fraude e Estelionato" (fraud and swindling), with an account created on the website. In Rio Grande do Sul, the Delegacia de Polícia Online has the option "Alguém me enganou" (someone deceived me) and only registers events that took place in the state (except loss and recovery of documents and objects). If your case isn't among the options, go to a police station.

When the victim is a minor, the rule on who files the report depends on the state. In São Paulo, according to the Delegacia Digital's FAQ, the report is filed by a parent or legal guardian, with the minor's details in the victim fields; in other states, check the local Civil Police website.

📣How do you report a scam online and warn the people who know you?

Reporting on the platform helps take down malicious profiles, posts and ads and protects other people, CERT.br explains. Use the report button and encourage other victims to report too: the more reports, the better the chance the profile comes down.

Warn your contacts if one of your accounts was hacked, if someone created a fake profile with your name or if someone is asking for a Pix while pretending to be you. Ask them to confirm by calling the number they already know. CERT.br suggests agreeing on a family code word, a question only you and your family can answer.

A cloned WhatsApp account is the classic case: according to the São Paulo Civil Police guide to electronic crimes, the criminal gets the verification code, takes over the account and asks the closest relatives and friends for money. The advice is to ask friends and family to remove the cloned number from groups and alert mutual contacts, which in the Club includes the Counselor and the Unit group.

For intimidation, humiliation or other online violations, SaferNet Brasil runs the Canal de Ajuda (Helpline), a free online service where a professional offers guidance by chat or email, anonymously and confidentially.

🧹Clicked a scam link or installed the scammer's app: now what?

If someone claiming to be from the bank told you to install an app and you did, CERT.br warns that it may be malware, able to capture data, allow remote access and change amounts and Pix keys. The advice is to restore the phone to factory settings and recover your data from a trusted backup. On a computer, run the antivirus and remove whatever the scammer had you install.

In a 2024 alert, Febraban noted that banks may contact customers to confirm suspicious transactions, but never ask for passwords, personal data, payments or reversals. And an agent who knows your CPF (Brazil's individual taxpayer number) proves nothing: scammers use leaked and public information to seem genuine, CERT.br warns.

Once the scare has passed, keep an eye on statements, card bills, logins and connected devices. On Registrato (registrato.bcb.gov.br), a free service from the Central Bank of Brazil, the adult of the household can check loans, accounts and Pix keys under their own CPF, signing in with a gov.br account at silver or gold level. If money still needs to be recovered or debts taken out by the scammer canceled, the guide recommends filing a complaint with the Central Bank, contacting Procon (the state consumer protection agency) or consulting a lawyer.

The effects of a fraud can be long-lasting or show up only after quite some timeCERT.br, booklet Golpes: Caiu? Veja o que Fazer, 2026 (our translation from Portuguese)

🧭How to avoid scams online as a family and in your Unit?

CERT.br's booklet Golpes: Não se Deixe Enganar (Scams: Don't Be Fooled) lists three warning signs: the message claims to come from someone you know, involves money, perks or personal data, or asks you to act without time to think. The more you expose yourself, the more the scammer learns about you, and the article on social media with purpose helps you decide what to post.

In games, the scam has a familiar face: the prize link, the free skin, the infinite coins, the new friend who wants to trade items outside the game. Roblox, for example, states on its fraud page that there are no official free Robux offers and that it never asks for your password outside the login page. Coins and items only from the official store, with an adult in the loop.

Against in-game scams, a good extra layer is to block unauthorized purchases in the parental controls of the device and of each app; the guide to Brazil's ECA Digital and what changes for families shows what platforms must offer parents in Brazil since March 2026, and the article on what age a child should get a phone and social media helps you agree on the rules.

In the Unit, run a drill: the Counselor reads made-up scam messages and each Pathfinder points out the warning sign and the first step. The guide to the Computers and Internet Honor covers safety practices, and the rules for online contact between leaders and Pathfinders are in the guide to the Pathfinder WhatsApp group. Jesus asked His disciples to be "wise as serpents and harmless as doves" (Matthew 10:16, NKJV).