50 million scam messages in six months: your brand could be the bait

What Serasa reported today

Serasa Experian released its first-half Fraud Map today, September 15, 2026. Between January and June, the survey identified more than 50.7 million scam-related messages in Brazil. That works out to an average of 3.2 per second, which is why the headline says "three per second."

It sounds like a number from another planet, but it tells a very practical story. This isn't just people getting weird text messages. A good share of these scams use fake ads, profiles, pages and apps to look legitimate. And many of those disguises copy real brands, from big companies and small ones alike.

Here is the most useful part of what the report found:

• 20,840 fake ads, profiles, pages and apps were identified in the half-year, up 27.2% from the first half of 2025.
• The breakdown: fake ads account for 62%, fake profiles for 19% and fake pages for 18%.
• Fake pages grew 107.1% compared with the previous year, with more than 20 new fraudulent sites per day.
• Fake ads reached 12,900, about 70 per day, up 19.5%.
• 2,100 messaging groups tied to fraudulent content were identified.

These numbers come from a press release by Serasa itself, republished by Folha de Pernambuco and Convergência Digital. Since the data is the same in all three places, I count it as a single source. You can see the original text in the sources at the end.

There is also an earlier Serasa figure, published by MobileTime on June 18, 2026, that adds context. In the first quarter, there were about 10,000 fake profiles, pages and apps, up 8.3%. According to the same survey, 51% of the economically active population has already fallen victim to a scam. And the chat groups used in fraud passed 2,000, with 19.7 million messages in the first three months of the year alone.

Now an honest warning, because we prefer that to selling fear. The release doesn't describe the methodology and doesn't break results down for small businesses. That means we can't say "X percent of small businesses were hit." What we can say is what the landscape looks like: the volume of scams is huge, it's growing, and it increasingly relies on pages and ads that imitate businesses that really exist.

How does a cloned-brand scam work?

A cloned-brand scam usually follows three steps: an ad or message grabs attention, leads to a fake profile or page, and ends in a request for payment. According to Rodrigo Sanchez, director of Authentication and Fraud Prevention at Serasa, a single fraud can run that entire path.

Understanding this sequence helps you find the point where you can interrupt the scam. Let's go step by step.

Step 1: the bait

Everything starts with something that makes the customer stop scrolling. It could be an ad with a price that's too low, a message saying "there was a problem with your order," or an invitation to a deals group. The bait usually uses the name, logo and even product photos of a company well known in the region or the niche.

Fake ads are the biggest slice of Serasa's numbers, at 62% of the total identified. That makes sense: ads are cheap to produce and reach a lot of people fast.

Step 2: the fake page or profile

Whoever clicks doesn't land on your site. They land on a similar page, with the same logo, the same colors and sometimes text copied from your real site. Or they land on a social media profile posing as your brand's "official support."

Here the fake-page figure weighs heavily: up 107.1% in a year and more than 20 new fraudulent sites per day. Building a convincing page is no longer hard work.

Step 3: the payment request

At the end of the line comes the request: pay a Pix to "lock in the promotion," pay a fee to "release the delivery," or confirm card details. The money goes to the scammer's account, and the customer later finds out they never bought from you.

The point almost nobody considers is what comes next. The deceived customer doesn't remember the scammer. They remember your brand's name. That's where they'll go to complain.

Hypothetical example: a pet food store in a mid-sized city has a good reputation in the neighborhood. A scammer creates a profile with the same name and the same cover photo, and advertises pet food at a big discount "today only." Whoever pays by Pix never receives anything. Days later, the real store starts getting furious messages from people it never served.

Why does this matter to a small business?

For a small business, the problem has two sides: your brand can be used as bait to deceive customers, and you yourself can be deceived when buying from a fake supplier or store. They are different risks with different defenses, and it's worth looking at both.

When your brand is the bait

Small brands get copied too. Sometimes precisely because they have a good local reputation and little oversight. The damage isn't only financial. A customer who lost money on a fake profile distrusts you, speaks badly of your company and, even after understanding what happened, comes back wary.

There's also the cost of time. Whoever handles the public starts spending hours explaining that "that profile isn't ours," and that drains energy from what makes a profit.

When you are the victim

The other side is talked about less. Small business owners buy a lot online: packaging, equipment, software, inventory. Fake ads and stores hit this buyer too, and an advance payment to a supplier that doesn't exist can hurt the month's cash.

Rodrigo Sanchez, of Serasa, recommends that companies monitor misuse of their own brand in fake ads, profiles, pages and apps. That's the first side of the equation. The second, buying carefully, we cover further below.

What does Kaspersky's research say about small businesses?

A Kaspersky survey interviewed 1,800 IT and security professionals in 18 countries, including Brazil, and 616 of them work at small and medium-sized businesses. Of those, 86% reported at least one security incident in the past year, and 14% said they had none.

An important caveat: this is not a Brazilian rate. It's an international sample, with Brazil among the countries. It shows a trend; it doesn't support saying "86% of Brazilian companies." Here, we won't invent a breakdown the survey didn't make.

What the data shows

Among companies with fewer than 500 employees, the survey produced a few numbers that help show where the risk lives:

• Of those who suffered the most damaging incident, 22% had a financial loss.
• The most common targets were customer data (32%), sensitive internal information (28%), employee credentials (25%) and business strategy (23%).
• The most affected departments were IT (50%), IT security (46%) and accounting or finance (24%). On average, three departments were compromised at the same time.
• Small businesses suffered more attacks through customer service channels (21%) than medium-sized (15%) and large (17%) ones.

In an earlier release, dated August 12, Kaspersky listed the routes most used against small businesses: phishing (20%), software flaws (17%) and external remote access (16%). In the same material, 75% of companies said they had increased their security budget.

What this changes for you

Two points deserve attention. First: customer service is an entry point. If a scammer poses as a customer, or poses as you, the channel you use to sell becomes the channel through which the problem arrives.

Second: customer data is the number one target. This connects to the cloned-brand story. Whoever has a customer list, a business WhatsApp and purchase history holds valuable material, and that material can be used to build very convincing scams.

Hypothetical example: a scammer with access to a clothing store's customer list can send a message citing the person's name and their last purchase. The message says there was a payment error and asks for a new Pix. Since the details match, the customer believes it.

How do you know if your brand is being cloned?

You find a clone by monitoring, with a simple routine, where your company's name appears outside your official channels. According to Serasa, companies should track misuse of their brand in fake ads, profiles, pages and apps. You don't need an expensive tool to start.

A ten-minute weekly routine

It's worth setting a fixed time, preferably on Monday, and doing the same check every time. In our experience, what kills monitoring is relying on remembering when there's time. A calendar entry solves it.

A lean checklist:

1. Search for the company name on Google, in quotation marks, and look at the results beyond the first page.
2. Search for the name together with words like "promotion," "official," "fake," "scam" and "complaint."
3. Look for the name on the social networks you use and the ones you don't. A fake profile shows up where you aren't.
4. Search Instagram, Facebook and TikTok for variations of the name, with a swapped letter, a number in the middle or "official" at the end.
5. Check the platforms' ad libraries, where they exist, searching for the brand name.
6. See whether your website's domain has similar versions, with a hyphen, a different ending or a swapped letter.
7. Read recent customer messages. When someone asks "did you send me this?", that's a warning sign.

Your customers are your best sensor

The fastest monitoring usually comes from the people who buy from you. Make it easy for customers to alert you: a button on the site, a dedicated email address or a line on your business WhatsApp saying "if you received something strange in our name, let us know here."

Agree with your support team that any report like this is a priority, and that every report goes to one person, who keeps screenshots and links. Without that record, it's hard to prove what happened later.

What should you do the day you discover a clone?

When you find a fake profile, page or ad, the order matters: record the evidence, report it to the platform, warn your customers through official channels and then review your defenses. Acting fast helps, but acting in the right order keeps you from losing the evidence.

First, keep the evidence

Before reporting, take full-screen screenshots. Note the exact address (URL), the profile name, the date and the time. If the ad has a link, copy it. If there are conversations with harmed customers, ask for permission to keep those too.

This matters because, after the report, the page may disappear. Without proof, you have no way of showing what happened to a lawyer, to the police or to the platform itself, if the first answer is negative.

Second, report it on the platforms

Most platforms have a form for reporting an ad, profile or page that impersonates another person or business. Use each one's official channel, send the evidence and, if you have a trademark registration or an official site, mention it.

Be specific. "This profile uses our name and logo to ask for payment" works better than "this is a scam." And report each item separately: the profile, the ad and the landing page.

In some cases the response takes a while. In those moments, pushing through the official channel and asking for help from an intellectual property or digital law attorney can speed things up. I won't promise a timeline, because it varies by platform and by case.

Third, warn your customers through official channels

Talk to your audience before the rumor runs faster than you. Publish a short notice on the networks you actually use, on the site and, if you have a contact list, by WhatsApp or email.

A good notice has four parts:

• The fact, without drama: "We identified a profile that uses our name and isn't ours."
• How to recognize the official one: website address, correct social handles, customer service number.
• What we never ask for: for example, payment through a link sent in a message outside the official site.
• What to do: if you paid, contact us and file a police report.

Avoid blaming the customer who fell for it. Whoever was deceived is already embarrassed. A welcoming tone brings the person back and also makes clear that your company wasn't involved.

Fourth, review your defenses

After the scare, ask: how did the scammer get material to copy? If it came only from your website and public social networks, there isn't much to do beyond monitoring. But if the scam cites real orders, customer names or correct amounts, there may have been a data leak, and then the matter is more serious.

In that case, change passwords, turn on two-step verification where it doesn't exist yet and check who has access to your systems. If you suspect a leak of customers' personal data, it's worth talking to a professional who understands LGPD about the next steps.

Hypothetical example: an online store discovers a cloned page that uses its name and photos. Instead of just reporting it, the owner saves the screenshots, warns customers by email and Stories, and puts a notice with the official address in the site footer. Days later, customers who receive the fake link already know how to check it.

How do you avoid being the victim when buying from suppliers?

Before paying a new supplier, confirm that it exists outside the ad you saw: documents, address, references and an independent contact channel. Fake-store scams only work because rushing beats checking. Ten minutes of verification usually costs less than a lost Pix.

Checklist before paying a new supplier

• Check the CNPJ in the Receita Federal public lookup and see whether the legal name, the business activity and the address match what the site shows.
• Be wary of prices far below market, of "today only" and of pressure to pay on the spot.
• Look for complaints under the name and the CNPJ on complaint sites and in the search engine itself.
• Check the age of the site. A very recent domain, with few pages and no physical address, deserves caution.
• Call a number you found on your own, not the one that came in the ad or the message.
• Confirm the payment account. The payee's name should match the legal name. If the Pix goes to an individual with no relation to the company, stop.
• On the first purchase, pay less upfront or prefer protected methods, such as a card, if the supplier accepts it.
• Ask for references from other customers and, preferably, talk to one of them.

Beware of the "supplier who changed accounts"

This is a classic that hits companies of any size: an email or WhatsApp arrives saying the old supplier changed bank accounts and that the next payment should go to another one. The contact looks like the usual one, but it's a scammer imitating the supplier's style.

The golden rule is simple. A change in payment details is only valid with confirmation through a second channel, for example a call to the phone number you already had on file. Nobody should change a payment account based on a message alone.

Hypothetical example: the finance team at a print shop receives an email from the "paper supplier" saying the account has changed. The employee calls the old number, kept in the records, and discovers the supplier sent no notice at all. The payment doesn't go out, and the scam dies right there.

How do you protect the team and the cash from the inside?

A good part of the defense doesn't depend on sophisticated technology: it depends on habits. Kaspersky points to phishing as the most used route against small businesses (20%), and phishing is fought mainly with attentive people, well-protected passwords and a clear way to confirm requests for money.

Two-step verification on everything that matters

Two-step verification asks for a second step beyond the password, such as a code on your phone. Even if someone discovers the password, they can't get in without that second step. Turn it on for:

• the company email, which is usually the key to everything else;
• online banking and payment accounts;
• social networks and ad accounts;
• the admin panel for the website, online store and domain;
• the WhatsApp Business app and other customer service channels.

If you have to choose where to begin, begin with email. Whoever controls your email can request a password reset on almost everything.

Short, frequent training

Security training doesn't have to be a two-hour lecture. Quick conversations work better. In our experience, a real scam example, shown in five minutes at a weekly meeting, teaches more than a manual.

A few topics to repeat from time to time:

1. How to recognize a suspicious link before clicking.
2. Why you should never send a password or verification code by message, even to "someone from the company."
3. What to do when you receive an urgent payment request.
4. How to report that someone clicked on something strange, without fear of a scolding.

That last point is more important than it looks. People who fear punishment hide the mistake, and the scam grows in the dark.

One rule for money: two people, two channels

Set a simple rule for unusual payments, such as a new supplier, an account change or an amount above the usual: one person requests, another approves, and the confirmation happens through a different channel from the one that brought the request. It looks like bureaucracy, but it's the kind of brake that stops a mistake from becoming a loss.

Special attention to customer service

Kaspersky's survey showed that small businesses suffer more attacks through customer service channels (21%) than medium-sized and large ones. So think about who answers your customers and what that person can do.

Whoever handles customers should have access only to what they need, without full access to every customer's data. And they need to know they should never confirm complete personal data to anyone who calls or writes without validating their identity first.

Which common mistakes leave a company more exposed?

The most common mistakes aren't technical: they're habits. A company that ignores its own name on the internet, is slow to warn customers or uses the same password across several systems leaves the door open. The good news is that almost all of them can be fixed without spending much.

Thinking that "small companies aren't targets"

This is the starting mistake. Kaspersky's survey shows that 86% of the small and medium-sized businesses interviewed had at least one incident in the past year, and Serasa's volume of scams shows the environment is hostile to everyone. Being small doesn't protect you, and a lack of vigilance can even help the scammer.

Only reacting after the loss

Many companies only look at security when a customer complains. The problem is that, by then, the scam has been running for days. A short monitoring routine costs little and shortens the time the clone stays online.

Not having a clear official channel

If customers don't know which is your real profile, your site and your number, they have no way to tell the fake from the real one. Keep that information always visible: on the site, in your social bios, in your email signature and on invoices, if it makes sense.

Deleting the evidence or responding on impulse

In anger, it's common for owners to delete comments, block the fake profile or argue publicly. That destroys evidence and can make the image worse. Record everything first and act afterward.

Sharing passwords and access

A password shared on WhatsApp or in a spreadsheet is a classic risk. Kaspersky showed that employee credentials are among the targeted data (25%). Each person should have their own access, and whoever leaves the company needs to lose access the same day.

Paying too fast

Almost every scam depends on haste. "Last unit," "urgent fee," "your registration will be canceled": the urgency exists to switch off your critical thinking. Be wary of any request that can't wait for a five-minute confirmation.

What are regulators doing?

In Brazil, the National Data Protection Authority (ANPD) opened a public consultation on September 9 to update the enforcement and sanctions regulation. It's a topic close to anyone who handles customer data, and worth following, even without getting into the legal details.

The consultation is open from September 9 to October 26, 2026, through the Brasil Participativo platform, and updates ANPD Board Resolution (CD/ANPD) No. 1/2021. An online public hearing is scheduled for September 24. After that, the text goes through the Regulation Superintendence and the approval of the Board of Directors.

The update is aligned with the ECA Digital, Decrees 12,975/26 and 12,976/26 and Law 15,352/26, which turned the ANPD into a regulatory agency. What does this mean in practice for you? That the rules on how the authority inspects and punishes are being revised, and that taking good care of customer data tends to be demanded more and more. For specific decisions, talk to a lawyer.

Quick questions

How many scam messages were identified in Brazil in the first half of 2026?

According to Serasa Experian, more than 50.7 million scam-related messages were identified between January and June 2026, an average of 3.2 per second. The release doesn't detail the methodology, so it's worth reading the number as a trend indicator.

Can my small business really have its brand cloned?

It can. Serasa's report doesn't include a breakdown for small businesses alone, so we can't say how often it happens to them. But Serasa's recommendation is that companies in general monitor misuse of their brand in fake ads, profiles, pages and apps. Doing so costs little.

What do I do first when I find a fake profile with my name?

Take screenshots and note the address and date. Then report it through the platform's official channel and warn your customers through your official channels. Don't delete anything or argue with the fake profile before recording the evidence, because you may need it later.

How do I know if a new supplier is trustworthy?

Check the CNPJ, the age of the site, the complaints and whether the Pix payee's name matches the legal name. Call a number you found yourself. And be wary of very low prices and pressure to pay on the spot. On the first purchase, avoid paying everything upfront.

Does Kaspersky's research apply to Brazil?

Only partly. 1,800 professionals from 18 countries were interviewed, including Brazil, 616 of them from small and medium-sized businesses. The 86% with some incident in the past year is an international figure, not a Brazilian rate. It works as a sign that the risk is common, but not as an exact measure of the market here.

What is two-step verification and where do I start?

It's a second step beyond the password, such as a code on your phone. Even if someone discovers the password, they can't get in without that code. Start with the company email, because it's usually the key to resetting passwords on almost everything. Then turn it on for your bank, social networks, website panel and WhatsApp Business.

Where Diglion comes in

Diglion helps small and medium-sized businesses set up the basics this article describes: a brand monitoring routine, the organization of official channels so customers can tell the real from the fake, two-step verification on critical systems and a written playbook for the day a clone appears, with an owner, deadlines and a customer notice template.

Sources consulted

• Serasa Experian, A cada segundo, três mensagens de golpes foram identificadas no Brasil; volume superou 50 milhões no 1º semestre, retrieved 2026-09-15.
• Folha de Pernambuco, A cada segundo, três golpes foram identificados no Brasil, retrieved 2026-09-15.
• Kaspersky, Kaspersky unveils how the worst cyber incidents hit SMBs over the past year, retrieved 2026-09-15.
• Kaspersky, 86% of small and medium-sized businesses encountered cybersecurity incidents over the past year, retrieved 2026-09-15.
• ANPD, ANPD abre audiência e consulta pública para atualização do regulamento de fiscalização, retrieved 2026-09-15.