Arrastão Digital: The New Era of Robbery in Brazil — Phone Unlocking, Forced PIX, and How Locals & Tourists Can Stay Safe
For decades, Brazil has battled physical street crime—pickpocketing, motorbike theft, arrastões on the beach, and robberies in high-traffic areas. But a new trend has emerged that blends physical robbery with digital extortion.
It’s called Arrastão Digital.
This modern form of crime goes beyond simply stealing your phone. Criminals now force victims to unlock their devices on the spot, often at knifepoint or gunpoint, and then use instant digital payment systems—especially PIX—to drain bank accounts within seconds.
This threat affects:
Brazilian residents, who rely on PIX for daily financial life.
Foreign tourists, who often don’t understand the risk and may unknowingly set up PIX accounts for convenience.
Today’s blog breaks down:
What arrastão digital is
How criminals carry out these attacks
Why PIX and phone unlocking are central to the threat
Why tourists are increasingly targeted
The red flags and patterns to watch for
How to protect yourself—before, during, and after an attack
What NordBridge recommends as part of modern converged security
What Is Arrastão Digital?
Arrastão Digital is a hybrid robbery, where criminals:
Physically detain the victim
Force them to unlock their phone
Open their banking apps
Transfer money via PIX or other digital methods
Reset the phone or steal it afterward to prevent tracking
This allows criminals to steal far more than the value of the device.
Instead of reselling a stolen phone for R$300–R$600, they can extract:
PIX transfers
Digital purchases
Bank withdrawals
Access to email for password resets
Access to WhatsApp for fraud attempts
Identity theft opportunities
This combination makes arrastão digital one of the most lucrative and dangerous street crimes in Brazil today.
How Criminals Execute Arrastão Digital — Step-by-Step
The attackers follow a clear process:
1. Target Selection
Criminals look for victims who are:
Distracted
Using their phones openly
Walking near curbs
Alone at night
In transit (Uber drop-offs, scooter/bike riders)
Speaking a foreign language
Drinking or leaving nightlife areas
Tourists are especially vulnerable because they often:
Hold phones loosely
Use them for navigation
Don’t read local warning signs
Carry premium smartphones
2. Physical Confrontation
Attackers often operate in pairs or groups.
Common scenarios:
Motorbike pulls up beside the victim
Group surrounds victim near a sidewalk
One attacker grabs the phone while another presents a weapon
Victim is escorted to a darker or quieter spot
The goal is immediate psychological domination—fear ensures compliance.
3. Forced Unlocking of the Phone
This is the critical moment.
Criminals force the victim to:
Enter their unlock PIN
Disable biometric locks
Open banking apps
Open PIX
Navigate to “Transferir”
Enter pre-prepared PIX keys (CPF, email, phone #, or random keys)
Some criminals demand the victim disable:
“Find My iPhone”
Google device tracking
Device PIN reset protections
They know these features make recovery easier.
4. Digital Theft via PIX
PIX transfers take seconds.
Criminals typically:
Send multiple transfers of small to medium amounts to bypass suspicion
Use drop accounts (“laranjas”)
Immediately forward money to secondary accounts
Buy crypto or gift cards to obscure the trail
Delete the PIX history afterward
For tourists who set up PIX:
Criminals may exploit unfamiliarity
Tourists don’t know how to reverse or lock accounts
Banks may flag foreign accounts more slowly
5. Post-Theft Actions
Depending on the criminal group:
They may:
Steal the phone anyway
Reset the device
Remove the SIM card
Access WhatsApp for additional scams
Use stored passwords to compromise email
Attempt additional transfers before victim freezes accounts
This creates a longer tail of digital harm—far beyond the initial robbery.
Why PIX Is Central to This Crime
PIX has revolutionized Brazil.
It’s fast.
Free.
Instant.
Ubiquitous.
But its strengths are also vulnerabilities in a robbery scenario.
PIX enables:
Immediate, irreversible transfers
No banking hours
No limit on weekends
Fast laundering through chains of accounts
Access through any phone with unlocked banking apps
Criminals don’t need to resell stolen goods.
They simply steal money directly with low forensic risk.
Why Tourists Are Increasingly Targeted
Many foreign visitors set up PIX accounts because:
They want to pay like locals
They find it easier than handling cash
Vendors often only accept PIX
They heard it’s “safe and convenient”
They don’t understand the risks
But tourists face more danger because:
1. They don’t know Brazilian robbery patterns
They may be caught completely off guard.
2. They keep their phones visible
Especially when navigating unfamiliar streets.
3. They often don’t have proper banking security settings
Many have:
Weak phone PINs
Saved banking logins
No 2FA
No app locks
4. Criminals assume tourists carry higher-value accounts
Even if the PIX account is small, criminals know:
Tourists often carry U.S. or European credit/debit cards
Some apps may allow currency exchange
Criminals can pivot into account takeover or email intrusion
5. Panic reduces critical thinking
Tourists may comply more quickly due to fear and confusion.
High-Risk Areas for Arrastão Digital
Arrastão Digital occurs primarily in:
Rio de Janeiro
Copacabana
Ipanema
Lapa
Santa Teresa
Flamengo
Centro
Tijuca
Recreio
Barra da Tijuca
Especially near:
ATMs
Beach kiosks
Nightlife areas
Ubers/taxis pickups
Tunnels and viaducts
São Paulo
Paulista
Centro Histórico
Consolação
Pinheiros
Vila Madalena
Tatuapé
Nightlife zones and transit hubs are especially dangerous.
Red Flags Before an Arrastão Digital Attempt
Watch for:
Motorbikes slowly shadowing you
Groups lingering without clear purpose
Individuals scanning people’s hands/phones
Someone trying to distract or approach unexpectedly
A sudden drop in pedestrian activity
Late-night Uber drop-offs in isolated areas
“Friendly strangers” offering help or conversation
Awareness beats strength in these scenarios.
How to Protect Yourself (Locals & Tourists)
Here are the most effective preventive strategies.
1. Use a Separate, Low-Value Phone in Public
Many locals carry a “phone de guerra”
A cheap device with:
No banking apps
No sensitive data
Limited contacts
Tourists can do the same using:
A secondary Android phone
A prepaid Brazilian SIM
2. Strongly Consider Avoiding PIX on Your Main Device (Tourist Perspective)
Tourists who set up PIX should:
Use minimal balances
Limit banking app permissions
Avoid linking international cards unless essential
If PIX is not absolutely necessary, avoid activating it.
3. Enable App-Specific Locks
Apps like:
Your banking app
Nubank
Itaú
Bradesco
Mercado Pago
…should require:
A separate PIN
Biometric login
Authentication that does not rely solely on the phone unlock
4. Use a Long, Complex Phone PIN
Avoid:
1234
000000
Birthday
Repeated digits
Use 6–12 digits, ideally random.
5. Don’t Keep Phone Visible While Walking
Especially:
Near curbs
In nightlife zones
During Uber drop-off/pickup
Use:
Earbuds
Wrist straps
Neck lanyards (but keep phone inside shirt)
6. When Robbed: Don’t Fight
Comply.
Hand over the device or unlock it if forced.
Your life is worth more than your phone or your money.
7. After the Attack: Act Fast
Immediately:
Freeze financial accounts
Use “Find My iPhone” or Google’s “Find My Device”
Remotely lock or wipe the phone
Change passwords for email, banking, social media
Notify your bank
File a police report (BO)
Notify your consulate (tourists)
Speed reduces damage.
NordBridge Security’s Perspective
Arrastão Digital is a perfect example of Converged Security:
Physical robbery
Digital exploitation
Behavioral manipulation
Financial crime
Identity theft
NordBridge helps:
Individuals secure digital environments
Tourists navigate high-risk regions safely
Businesses and hotels educate guests on risk
Executives protect personal and financial data
Organizations design training around phone safety, PIX security, and situational awareness
Victims respond and recover from digital harm
This is the kind of threat that modern security must address holistically—not just with cameras or police presence, but with intelligent, behavior-focused strategies.
Brazil is an extraordinary country—but like all major global cities, it requires informed safety practices.
Education turns targets into prepared individuals.
#NordBridgeSecurity #CyberTy #MyGuyTy #ArrastãoDigital #PIXSecurity #BrazilSecurity #RioSecurity #StreetCrime #DigitalRobbery #CyberPhysicalConvergence #SituationalAwareness #TouristSafety #ResidentSafety #MobileSecurity #FinancialSecurity #UrbanSafety #BrazilTravel #RioDeJaneiro #CrimePrevention #ConvergedSecurity
About the Author
Tyrone Collins is a security strategist with over 27 years of experience. He is the founder of NordBridge Security Advisors, a converged security consultancy focused on the U.S. and Brazil. On this site, he shares personal insights on security, strategy, and his journey in Brazil.