Brazilian Feedbacks & Comments

[Eudes]

Topic suggestion: Brazilian feedback and comments

Revolut in Brazil is pretty new and when entering on a new market there’s always some regional adaptation needed because each country have their own particularities.

Account:

Revolut BRL account is on a exchange house (if I’m not wrong) and at this moment seems to be the same account number to everyone and only know to where send the money by associate the sender to the account, basically I can only send money to my Revolut account from another bank account belonging to myself, what limits the account usage.

Would be essential an individual account number to compete with another banks on everyday use.

Several smaller regional payment apps offer it from the beginning.

When revolut get their own bank license or just use their current partner, but supporting individual account number to their accounts, would be helpful to use was an actual everyday account.

Debit card:

Like I told on others past comments, foreign debit card are recognized was a “prepaid credit card” in Brazil, this have the advantage of being able to use the card online on apps/websites, unlike Brazilian debit card that rarely does that but because is recognized was a “credit card” it may not be accepted on some smaller places that only accepts “Brazilian debit card” (Visa Electron or MasterCard Maestro)

Most card in Brazil are “dual function”, so credit and debit on the same plastic, that’s why when paying on card the clerk always ask if is debit or credit, if you say “debit” (the machine will be expecting a Visa Electron or Maestro) and mostly will give a error message) I only remember seeing PagSeguro terminals doesn’t error out the transaction and finishing it on whatever function the card have.

(I may or may not used it to pay on credit on places that only accepts debit)

Would be nice an option to have a card with dual function (Visa Debit and Visa Electron) so would be recognized was a debit card in Brazil.

Debit card part #2

Something understandable but really annoying on revolut debit card is that to use it I need first to convert the account balance to a foreign currency, would be nice on a everyday account to have a balance in BRL and use it without converting to another currency first, and save 1.1% of IOF (taxes).

Maybe like another banks who offers international accounts here, having a Brazilian card and an international one, one for local usage and another for travel/foreign use.

PIX the instantly payments and bank transfers

PIX is something magical, instantly bank transfer and payments 24/7/365, would be nice having an individual PIX key, to receding from another persons instead of only myself, but also to pay for goods and services, some smaller places give up on accepting even debit cards and only takes PIX since is without fees (without from personal accounts, business could be charged, but aren’t since if one bank charges for it, other will offer from free and clients/business will migrate, like they do on credit card machines, isn’t uncommon to see several machines from different providers on the same commerce).

If a foreign open a BRL account and get a PIX key (may be an randomly generate one, an e-mail address or a phone number, or one of each) it may simplify the experience by having a PIX button on their BRL account and pay (or receive) instantly from/to Brazilian persons or business

Withdraw and local ATM deal

Some busy topic I saw a discussion about what ATM to use in Brazil, Bradesco seems to be the preferable one but would be nice revolut doing some deal with “Banco 24 Horas” (that beside being called bank, is the biggest ATM network in Brazil, belonging to an association of the biggest Brazilian banks), because nowadays you may only see a bank ATM on their own branches and Bank 24 Hours ATM are everywhere, supermarkets, pharmacies, malls, gas stations, bus stations.

On my Brazilian account I use those ATM without a card, just by selecting my bank on a list and scanning my fingerprint, since I don’t carry my debit card because I use Apple Pay everywhere for everything and it’s extremely rare needing a plastic card.

And a direct deal with the biggest ATM network in Brazil could be advantageous, like allowing switch the card PIN or maybe even depositing some local currency on Revolut account.

On some fancy malls and airports those ATM even offers to withdraw in dollars and Euros.

Metal cards

I would love a metal card, just to use where contactless/Apple Pay isn’t accepted (rare but happens sometimes), but the price of a metal card on revolut (€15/month right?) in Brazil would be too much for just having a debit card.

On similar prices where we could get a Black ostentatious card “without limit” (if the credit score allows), I would considering a one time payment for a metal card but a monthly payment only if was a fancy credit card with some benefits that were useful to me.

Credit card

We Brazilian loves credit cards, for a different reason than the North Americans, since everything here is more expensive (at least double) of the same thing on other countries, we use our credit card to pay on installments directly on the card, like I toke my car to the mechanics for maintenance and was charged R$725 in 3 installments on my credit card, so each month it charges me R$ 241,66 without interest.

Paying annual fee for a credit card isn’t something most people like since if we kick a tree probably 7 different cards without annual fee will fall from there

Something preferable that most banks do is having a monthly fee on the card but doesn’t charging it if spending (and paying on time) a high monthly value or having a certain amount on the bank balance or investment.

Investment and savings account

I would love to earn some interest on my foreign balance in revolut, would be nice being able to invest in something (sort of long term) on foreign currency but investments are complicated and saving account would be interesting, but since savings account outside Brazil earn almost nothing (compared with Brazilians ones) something that earned interest daily or monthly would be attractive.

[SG.Mandal]

I have created a new topic for you as promised @Eudes.

BTW, thanks for sharing your feedback with us.

SG | Community Team

[Eudes]

Thank you very much
(Sorry to bother you with this)

Here a new development, Revolut got it’s Brazilian bank license (at least for offering credit)

Banco digital Revolut obtém licença do BC para criar sociedade de crédito direto

Now it’s may no longer use Bexs for receiving money and also can offer credit, I just hope that when starting to offer credit cards, it issues a separated card from the debit one, because some places when asking if is for charging on debit or credit “accidentally” select debit “by mistake” when I say credit (it’s rare but happens) and my preference are opposite to most people who likes to having one card for everything and I prefer to have credit and debit on two separated cards.

[SG.Mandal]

Thanks for sharing that with us @Eudes.

[Eudes]

Something that I forget but also be really nice to have, choosing how your name is written on the card.

Since I have a stupid really long name (100% my father fault), I like to shorten where it’s possible, but also would be useful to people who legal/birth name wasn’t how they want to be named anymore.

Could even be useful if I was traveling with someone and wanted to request a second debit card on that person name.

[Eudes]

“Top up” thru Apple Pay doesn’t recognize Brazilian debit cards

When sharing the link to “top up” or receive money it’s was very nice, to be able to use Apple Pay!

other Brazilian fintech (aka Nubank) also had something similar but their link only showed the data from a bank transfer, this was before PIX, nowadays it’s just a QR code that auto-fill the payment data by PIX.

I really like that on Revolut it shows the option to pay with a card or using Apple Pay and Google Pay, it’s so much easier to just tap a button instead of putting all card data.

But my happiness was short
It didn’t recognize any Brazilian card (not even the one who is only debit, what I understand since most Brazilian debit card aren’t allowed for on-line transactions, the few who works have a deal between the bank issuer and the store).

But a friend in Germany had 2 or his 3 cards compatible without any problem.

Would be nice Revolut also supporting some Brazilian card, on https://applepaydemo.apple.com/ it even shows the option to select debit or credit with Brazilian cards

When Revolut only denies all cards (except their own)

I also had a friend trying with his debit card issued in USA and guess what, also refused/denied thru Apple Pay So it’s available only to European debit cards?

I understand that supporting credit cards may be dangerous since some people may try to use it to get like a temporary loan from “themselves” or just gamble the system to get “free” points/miles on their credit cards (that’s why most Brazilian banks doesn’t give any points/miles when their cards are used on “payment apps” since some people abused this a lot)

But since Revolut not yet supports PIX from third party accounts, would be nice/faster having a “payment link”

[Eudes]

A thing that’s very common on Brazilian fintechs, credit cards and even on big banks is offering a “RFID tag” for automatically pay on tollbooth and parking

And for business accounts, offering a credit card machine (maybe the “Tap to Pay” for receiving payments using the smartphone) would be essential for everyday transactions together with supporting PIX.

and by supporting PIX I don’t mean the basic support of having an “key” for receiving it, I mean the full support of generating unique QR CODE with the value for charging and having confirmation of the transaction on real time, because some persons using fake apps generate the confirmation receipt of a PIX transaction and if the clerk doesn’t pay attention on the bank notification app to see if the transaction really goes thru will get scammed.

That’s why some places won’t accept PIX, or on the best cases will accept it only on the credit card machine because it will show/print a transaction receipt as proof of payment.

I scam I saw last year was generating a QR Code for paying with PIX but when paying the person changed the value to R$ 0,01 and the Point of Sale/credit card machine recognized the payment without validating the value, I believe nowadays it was already validating both but is something to be aware of!

PIX is amazing and for small businesses is essential not only for receiving payments but also for paying instantly employees and suppliers.

[SG.Mandal]

Thank you for sharing your input with us @Eudes. We really appreciate it.

However, I would request you to kindly remove the pictures with card details as this is a public forum and we recommend not to share any kind of personal details here for safety purposes. I hope you understand.

SG | Community Team

[Eudes]

What pictures of card details?

The last 4 digits on the wallet?

That’s pretty much useless since would need the others 12~16 other digits + valid thru date and CVV.

[Frank]

That’s not how fraud works. Card not present transactions are a common form of fraud (no date and CVV necessary) and some attacks use brute force to try out numbers. The first 8 digits of your card are shared with plenty of other cards from the same issuer and can be reliably guessed. With publishing 4 more digits you’re close to having revealed your whole number.

[SG.Mandal]

Ahh! I was about to type the same. Thanks a lot @Frank.

@Eudes, brute force attack is a real thing, my friend. As this is a public forum, we don’t want to take any kind of risk with our users’ personal details.

P.S. : I have deleted the images containing your card details.

SG | Community Team

[Eudes]

I believe you guys exaggerated a little,

my cards doesn’t allow no presencial transactions with the plastic number (those are allowed only on specific virtual cards) and the BIN for my itaú cards, because it’s probably the biggest card issuer in Brazil are vastly diverse.

Would be the same was I telling my 4 last digits of my phone number and good look trying to call me.

[Frank]

Just google this if you want more info about this. „Brute force credit card fraud“ is a good start for a search. There are also ways to circumvent security settings with compromised POS terminals, for example. Some of the regulations in card networks allow merchants to accept transactions that are considered more risky if they accept liability. Sure, you can then start chargeback procedures, but scammers expect this.

Credit card issuers use account ranges, worldwide. Roughly, the first for digits define the network, and then the following digits issuers, regions and card programs. So the brand of your card gives scammers with access to a BIN database a pretty good idea in which region to start. BINs are not protected, Mastercard even publishes a BIN directory on their website for everyone to download. The last for digits of your card are the digits you should protect the most.

[Eudes]

Knowing the first 6 digits (BIN/IIN) and the last 4 digits of a credit card number can theoretically significantly narrow down the possibilities.

However, without additional information, such as the remaining digits and any validation algorithms, it would still be extremely challenging to accurately guess the complete card number.

Credit card numbers consist of multiple factors, including checksums and other security measures, to prevent easy guessing or brute-forcing.

And bank security systems (not only from the card issuer point of view but primary from the payment processor provider, aka the credit card machine) also would detect a merchant trying this and block before it could get much far.

Would be easier reading a card number from a compromised PoS than guessing the card number from the last 4 digits.

[Frank]

Just google it, you will find out that brute force is a real thing and costing the industry real money.

Or head over to the thread here about fraud with Revolut’s disposable cards. Most likely, Revolut’s platform suffered from brute force attacks. Revolut redesigned the app and changed the process how disposable cards are now issue to address this problem.

PS: Account ranges are longer, not just the traditional 6 digits of the BIN. BINs can also be 8 digits nowadays. Mastercard’s public (!) BIN directory lists account ranges with 10 digits.

[Frank]

Here’s some data:

CNP fraud activity has rapidly increased/shifted industry-wide since the start of the pandemic. According to reporting from Insider Intelligence, card-not-present fraud (CNP) accounted for an estimated *$5.72 billion in U.S. losses in 2022

One key contributor to this rise has been the increasingly bold use of BIN attacks, one of the most common types of CNP fraud.

Source, from April 2023

[Eudes]

Force brute attack should get easily blocked on the PoS payment provider, here in Brazil this is prevented by charging a fee (or blocking) of the merchant after a few consecutive declined transactions.
Another reason most merchants here have more than one PoS providers.

If revolut didn’t catch those fraudsters, it was a revolut problem that not everybody is affect.
I don’t mean to be rude, probably revolut learned their lesson with that and it improved security for everybody.

By my experience usually those happens more easily on small issuers/fintech because bigger issuers/banks have more experience dealing with it.

My cards by default doesn’t allow on-line transactions on their plastic numbers (forced to use virtual cards, mostly one time use cards), and the Brazilian ones refuses foreign transactions unless informed/authorized first and still have the chance of being blocked if the security sector of the bank/card issuer suspect something because its too much outside the regular user transactions.

Last time a card of mine had a fraudulent transaction was just after the issuer being bought by a big bank and fired everybody, probably someone “printed” the cards list before leaving, but the transaction was blocked by the security/fraud prevention simply by asking me to confirm it when I was sleeping, in the morning seeing the notification and declining responsibility of this transaction they send me another card by mail, it didn’t disturbed my usage because I had their virtual card on Apple Pay and if I had used the plastic card 3 times was too much.

One thing I saw somewhere and would be a lot useful to prevent CNP fraud, creating a virtual card for specific services.

Let’s say I create a virtual card for use on Amazon and locked that card for that merchant, if it detected any transaction outside that merchant should block it and ask for user to allow or denies it.

Would be nice also setting a specific limit for a virtual card, let’s say I create a card just for use on Netflix and set a limit, if they increase their price without warning it would get denied because is over the limit.

[Frank]

Your options are limited to block all card not present transactions if bad merchants are involved. They exploit loopholes in card networks. CVVs are unchecked, and payments aren’t authorized as e-commerce.

Scammers are more advanced than you might think. They circle automatically through different merchants to avoid being detected. They’re not “bombing” one merchant with thousands of authorization requests. The goal is to identify one active account, and then they narrow down the search.

You can set limits for virtual cards in Revolut’s app (I am assuming it’s the same for the Brazilian app).

[Eudes]

Talking about scammers, in Brazil they put a fake ATM over a real ATM, inside a bank branch ATM fraud in Brazil- Patriot Group - YouTube

[Frank]

Sophisticated ATMs aren’t the only thing it seems.

This article is from 2019. But don‘t expect this to be outdated. We know that fraud numbers went up during the pandemic.

Brazilian fraudsters are using a distributed tool to obtain CVV data |...

Similar fraud attempts happen worldwide, this is obviously not exclusive to Brazil.