Security
MED 2.0: Brazil's new Pix fraud refund rule takes effect
Since February 2, the mechanism handling Pix fraud disputes gives 80 days to contest and refunds within 11 business days of confirmed fraud. That changes the exposure for anyone receiving payments.
February 09, 2026|5 min read
What changed since February 2
MED 2.0, the new version of Central Bank Resolution 493/2025, took effect on February 2, 2026. The mechanism handles Pix fraud disputes, giving up to 80 days to contest a suspicious transaction, refunding the payer within 11 business days after fraud is confirmed, and chain tracing — meaning the money is tracked through wherever it passed, even after being forwarded on.
For a business receiving Pix payments, this changes exposure: a sale that seemed final can be reversed months later, if confirmed as fraud at the source.
Why this matters for sellers, not just direct victims
If a customer pays your business via Pix with funds from a fraudulent source, and that fraud is confirmed within the dispute window, the amount can be blocked or refunded — even if your business acted in good faith. Chain tracing means the money is followed beyond the first transaction.
That's not a reason to stop accepting Pix — it's a reason to have a clearer sales record process, especially for higher-value transactions.
What to adjust in your sales process
Three things reduce exposure: keep a simple record of each high-value Pix sale (date, product, customer name), so you can prove the transaction if it's questioned later. Second, be wary of payments well above the agreed amount followed by a request to refund the difference — a classic scam pattern that exploits urgency. And watch account activity closely in the days right after a high-value sale, since a dispute can come in within the 80-day window.
Where Diglion comes in
Diglion helps small businesses set up a sales and record-keeping process that reduces exposure to payment disputes, without slowing down checkout for good-faith customers.
Sources consulted
- Jusbrasil, Golpes do Pix: Evolução Recente das Fraudes Digitais e Respostas Jurídicas, retrieved 2026-02-09.
Ransomware is still rising in 2026 — and service businesses are targets
Corporate deepfakes: the scam your company has not seen yet
Generative AI security: risks that do not have names yet
Pentest: when to hire and what to expect from the report
Practical LGPD for teams without a dedicated DPO
Security for IoT devices in operations
Next step
Want to turn this topic into a real project?
Diglion helps diagnose the context, design the path, and build technology with product, architecture, and execution moving together.
Talk to a specialist