Sinqia Hack Exposes Fragility of Instant Payments and Consumer Risk

On 29 August 2025, cyber attackers breached Sinqia, a Brazilian fintech platform owned by Evertec. Using stolen vendor credentials, the hackers injected a string of fraudulent interbank transfers amounting to roughly R$710 million into Sinqia’s Pix environment.

This is not the first time the Pix environment has been hacked using compromised vendor credentials. The recurrence suggests that attackers are intentionally targeting vendors rather than individual banks.

While banks traditionally have security integrated, the interconnected architecture of the Pix environment concentrates risk in third-party providers.

Two attacks within months of each other highlight the need for escalating vendor-centric controls and oversight, not just bank-level defences.

Due to quick intervention, Brazil’s central bank and law enforcement agencies were able to block a large portion of the flow of the fraudulent transactions.

But the episode exposed a systemic tension between the benefit instant payments hold for users, and the payoff in terms of compressed time to detect and stop theft.

The Cost of Convenience

Pix is a payment system that lets users instantly transfer money in Brazilian real between participating institutions. These include hundreds of Brazilian banks and fintech companies.

Introduced by the Brazilian National Bank in 202, Pix is used widely across Brazil, with hundreds of millions of user accounts and massive daily transaction volumes.

The Pix environment allows users to settle transactions instantly and irreversibly, no matter the time of day. It has become particularly popular in industries like iGaming although its card payment methods are typically used by players.

However, with fast payouts and seamless access always something players look for, payment services like Pix are growing more popular,   typically route through acquirers and issuers and include authorization holds.

Card networks and payment rails allow chargebacks and dispute windows that can reverse some fraudulent moves. However, Pix, on the other hand, lacks that built-in reversal window, making rapid containment of fraudulent activity essential. 

How the Attack Happened

Attackers obtained legitimate credentials belonging to an IT vendor that serviced Sinqia and then used these to gain authenticated access into Sinqia’s Pix-facing systems.

The attack targeted the connectivity layer between banks and the central Pix switch, not a protocol weakness in Sinqia’s fintech service. Once inside, the criminals submitted legitimate-looking interbank transfer instructions that were accepted by the rails.

Late on 29 August, Sinqia detected unauthorized activity in its Pix connections and halted all processing of payments. But because Pix settles instantly and irreversibly, some transfers were executed before manual controls could act on the breach.

Within hours, Evertec notified investors, and Sinqia brought in external forensics teams. The central bank disconnects Sinqia from Pix to prevent further settlement activity, while authorities begin to freeze and trace substantial sums.

Two institutions in particular that were reported as targets were HSBC Brazil and the fintech company Artta. The banks where transactions did go through say consumer deposit accounts were not drained. Luckily, the impact remained at the interbank settlement level.

Regulatory Reaction and Policy Moves

Following the earlier incident where another attacker was arrested in July, and the second attack on the Pix environment in August, Brazil’s central bank moved towards accelerating tighter oversight for fintech infrastructure providers.

Some of the new measures they’re putting in place include transfer caps, faster licensing deadlines for providers, and enhanced prudential rules.

Financial industry regulators in Brazil are pushing for stricter operational requirements and more frequent audits of vendor security. Brazilian authorities also signaled a need for better inter-institutional data-sharing to detect cross-provider anomalies.

Operational and Technical Fixes Under Consideration

In the aftermath of the attack, mandatory multi-factor authentication and strict role-based access will be instituted for any entity with Pix credentials.

Sinqia has also undertaken segmented, isolated rebuilds of some of its critical Pix-facing infrastructure to limit lateral movement.

In addition, they are considering pre-execution risk scoring that will pause or flag unusually large or rapid batches for human review, and a real-time anomaly detection system.

At the user level, transactions will have to be authorized through confirmation prompts and temporary holds on high-value transfers.

The company will also institute strong vendor SLAs and contractual security obligations tied to licensing and supervision, as a measure to prevent compromised account information.

Global Context and Comparisons

In Africa, cybercrime accounts for more than 30 percent of all reported crimes in Western and Eastern Africa, according to INTERPOL’s 2025 Africa Cyberthreat Assessment Report.

Instant payment rails elsewhere in the world, such as India’s UPI, the UK’s Faster Payments, and the U.S. FedNow/ RTP, face similar trade-offs and will do well to learn from the Pix incident.

FedNow and RTP have reported relatively low fraudulent incidence so far, but then, the platform hasn’t been as widely adopted yet.

As instant payment transaction volumes grow globally, attackers have stronger incentives to industrialize fraud and target weak links. Cross-border flows further complicate recovery of theft and create potential money laundering pathways for stolen funds.

Conclusion

Subsequently, Sinqia began rebuilding the Pix interfaces inside an isolated, hardened environment that is pending bank approval.

Forensic work and regulatory tracing continue to seek clarification on exactly which transactions were executed and which were intercepted. Federal police and financial investigators continue to trace funds, pursue recovery, and make arrests where possible.

Following the incident, Sinqia said it would only reconnect the Pix environment after completing extensive technical fortification and a regulatory review.

Policymakers have emphasized that the speed and convenience the Pix platform is known for should be balanced with the new control frameworks.