The Brazilian state of São Paulo is experiencing a 40% jump in so-called lightning kidnappings. A lightning kidnapping is when a kidnapper detains a victim for a short amount of time, just enough to extract a small ransom payment from the victim or the victim’s relatives.
Who’s to blame? According to law enforcement officials, Brazil’s new payments system, PIX, is at fault.
PIX is a new payment system installed in 2020 by the Banco Central do Brasil, Brazil’s central bank. It provides instant payments between individuals and retailers. This instantaneity has attracted lightning kidnappers.
Brazil’s situation seems odd, but it’s actually quite common to see a big jump in fraud and crime with the debut of systems that allow for fast payments. Bad guys are attracted to speedy payments. The faster the better. As a consequence, faster payments usually means more crime. Any increase in crime is unfortunate, but societies generally tolerate at least some of this increase because the benefits of real-time payments more than outweigh the costs.
How lightning kidnappers extract ransom
Lightning kidnappings aren’t new to Brazil. In the past they were carried out by ATMs. A victim was brought to a succession of ATMs and forced to withdraw all of the cash from their accounts.
With PIX, Brazilian kidnappers have a new set of options. Not only can they empty the victim’s bank account at an ATM, they can also contact the victim’s family and friends and request that they send money via PIX to the victim’s account, and then cash that out, too. Since PIX payments settle instantly, the kidnappers needn’t wait long to be paid, thus reducing their risks of being apprehended by the police.
Alternatively, criminals can set up fake bank accounts, and force victims to send electronic payments via PIX to these accounts before cashing them out.
Prior to PIX’s introduction, Brazil ‘s central bank provided Brazilians with two electronic payments options: TED (Transferência Eletrônica Disponível) and DOC (Documento de Ordem de Crédito). With DOC, funds don’t arrive in the recipient’s account until the next day, much like how ACH works in the United States. A TED payment is quicker–it might take a few hours to show up. But TED closes at 5PM and on weekends.
Neither fits the needs of a lightning kidnapper. To cut down on the risk of being apprehended, lightning kidnappings must be carried out quickly, and preferably at night. Both TED and DOC are either closed when needed or too slow for a would-be kidnapper. PIX, on the other hand, is a perfect fit.
Not just Brazil
Brazil isn’t the only country where fast payments and crime are interlinked. When the UK introduced Faster Payments in 2008, a payments network that allowed for near real-time payments, fraud spiked by 132%. A scammer might pretend to be calling from a bank’s fraud team, for instance, and request that the victim move money via the Faster Payments system to a “safe” account. Rapid settlement allowed scammers to make off with money before the victim could notify their actual bank to freeze the payment.
In 2016, the Bangladesh central bank’s account at the New York Federal Reserve Bank was hacked. The Fed’s bank-to-bank payments system, Fedwire, is instantaneous. Once fraudsters had control of the Bangladesh central bank’s account, they could immediately start transferring funds out. The money quickly made its way to fictitious U.S. dollar accounts in the Philippines, at which point it was withdrawn as cash.
In the U.S., faster check-cashing requirements are linked to more check fraud. As I wrote in a previous article, all checks that are deposited in the U.S. must be made available for withdrawal by the business day after the day of deposit. This creates a timing gap between the withdrawal of funds and the actual verification of the check, which can be exploited by fake check scam artists. Slowing down check withdrawals would reduce fraud. But there are good reasons why we don’t do this, as I’ll explain below.
Faster payments means more crime
There is a fundamental tradeoff between payment speed and crime. The faster that a payment is finalized, the broader the scope for criminal activity. Speed, after all, makes it safer for criminals to make off with the proceeds of crime. It also increases the range of attacks that criminals can pull off and the types of victims it can target.
The slower a payments system, the less conducive it is to bad actors. Slowness allows for better surveillance of payments, freezes, and reversals.
Of course, speed is also useful for law-abiding citizens. Instantaneous payments take out some of the guesswork of slower settlement, making it easier to plan one’s financial affairs. Bills can get paid off quickly, before their due date. Relief and disaster payments arrive rapidly. Retail purchases can be consummated immediately. The benefits of fast payments typically outweigh the costs of extra crime.
Administrators of real-time payments networks can fight back, too. The UK, for instance, recently introduced Confirmation of Payee, which allows banks to check the name of the recipient to ensure that a payment is going to the correct account and not a scammer.
Australia’s recently introduced real-time payments system, the New Payments Platform, requires 95% of payments to be processed within 15 seconds. Banks can divert the remaining 5% of payments that it deems to be a high risk for fraud and screen them for additional vetting.
As for the Banco Central do Brasil, it too is fighting back. It introduced a default 1,000 BRL ($200) transfer limit between individuals between the hours of 8pm and 6am, the most common times for kidnappings. Users can increase these limits, but changes take at least 24 hours to go into effect, thus thwarting lightning kidnappers.
Implementing modifications like these allow administrators to select a slightly different spot on the tradeoff curve between speed and crime. By building in various frictions or fail-safes, they make real-time payments a little bit less ubiquitous while simultaneously impairing criminal usage.
But there are limits to how far these modifications can go. The only way that the Banco Central do Brasil could completely end PIX-based lightning kidnapping would be to slow the entire system down. That would mean cutting regular Brazilians off completely from the benefits of real-time payments.
