Background
Eliana Simone Marques, an elderly consumer, fell victim to a “WhatsApp scam” (golpe do WhatsApp), a form of social engineering fraud in which an imposter posing as her son convinced her to authorize transfers via PIX and to execute a personal loan agreement (Crediário Itaú contract no. 00000251439490-3) totaling R$ 6,210. Marques filed a declaratory action seeking to void the loan and recover the transferred funds, alleging that the bank’s failure to implement adequate security measures and identify atypical transactions made the fraud possible. She emphasized her status as an elderly consumer entitled to heightened legal protection under Brazilian law.
At trial, the lower court ruled in Marques’s favor, declaring the loan unenforceable and ordering the bank to return the funds. The São Paulo Court of Appeals reversed, concluding that the fraud constituted an “external fortuity” (act of a third party that breaks the chain of causation) and that the consumer bore exclusive responsibility, despite the bank’s security alerts. The appellate court invoked the exception to liability found in Article 14, § 3º, II of the Consumer Protection Code (Código de Defesa do Consumidor, or CDC). Marques then appealed to Brazil’s Superior Tribunal de Justiça (STJ), arguing violations of multiple statutory provisions and seeking to establish a jurisprudential precedent on bank liability in social engineering fraud.
The Court’s Holding
The STJ did not know (did not accept for review) Marques’s special appeal. The court invoked multiple procedural doctrines to decline jurisdiction. Most significantly, the court applied Súmula 7 of the STJ, which provides that the Special Appeal procedure cannot be used to re-examine facts or evidence. Here, determining whether the bank breached its duty of security and whether the fraud constituted internal or external fortuity would require precisely such a re-examination. The bank’s liability turns on contested factual details: whether its alerts were adequate, whether the transactions truly appeared anomalous, and whether the consumer’s age and cognitive status placed her under heightened risk—all factual questions unsuitable for resolution through special appeal.
The court also applied Súmula 284 of Brazil’s Federal Supreme Court (STF), holding that Marques’s invocation of Articles 104, 166, and 169 of the Civil Code lacked adequate legal reasoning. Those provisions address formality requirements and vices of consent in contract formation, but Marques’s actual claim rested on bank service defects under consumer protection law, not contract vices. The opinion criticized the appeal as conflating distinct legal theories. Finally, the court ruled that because it had blocked Marques’s “law violation” branch of appeal (alínea a) on procedural grounds, it could not entertain her separate argument based on jurisprudential divergence (alínea c) on the same underlying question.
Key Takeaways
- Banks have affirmative duties to implement security mechanisms, identify atypical transactions, and provide heightened protection to elderly and other vulnerable consumers—but disputes over whether the bank discharged these duties remain fact-intensive and unsuitable for appellate review where fact-finding is forbidden.
- An “external fortuity” defense (attributing loss solely to a third party’s criminal act) can shield a bank from liability if the lower court finds no service defect or breach of the duty of care, and the STJ will not revisit that factual conclusion through special appeal.
- When a consumer fails to challenge a trial court’s findings of fact through the proper appellate channels at the state level, the STJ’s review is severely constrained by procedural bars (Súmula 7); appellants cannot manufacture a federal question if the real dispute is over evidence and inferences.
- Invocation of Civil Code provisions on contract formation will fail if the appellant’s actual legal theory relies on CDC consumer protection principles; lawyers must carefully ground arguments in the correct statute and articulate the logical connection between legal norm and factual predicate.
Why It Matters
This decision reflects an important limit on appellate oversight of banking fraud cases in Brazil. While the STJ and lower courts have recognized that financial institutions owe special duties to vulnerable consumers—particularly the elderly—and must implement reasonable security and transaction-monitoring systems, those duties remain largely judged on a case-by-case, fact-specific basis. The STJ’s refusal to review Marques’s case means that no precedent was set on the precise contours of the bank’s liability when a consumer receives alerts, the bank requires confirmation, and then the consumer authorizes the transaction anyway, all while being manipulated by a fraudster impersonating a family member.
For practitioners advising consumers defrauded via social engineering, this decision underscores the importance of building a robust factual record at trial and, if necessary, pursuing appellate review at the state level before seeking review at the STJ. The decision also signals that Brazilian courts will generally defer to appellate findings of “external fortuity” and exclusive third-party liability unless a lower court plainly erred or ignored statutory requirements. Financial institutions, meanwhile, may take some comfort that even where transactional security protocols were in place (here, alerts and confirmation requests), courts may still find that fraud stemmed from causes beyond the bank’s control—though the opinion leaves open the possibility that different facts (e.g., a complete absence of security measures, or evidence that alerts were insufficient for an elderly consumer) could yield a different outcome.