Five security realities reshaping how companies operate in Brazil

Operation Hidden Carbon (Operação Carbono Oculto), launched on August 28, 2025, investigated fraud in Brazil's fuel sector. The Federal Public Prosecutor's Office reported suspected involvement by different criminal organizations, including infiltrated PCC members. It described shell companies, investment funds and payment institutions being used to conceal beneficiaries and move proceeds through businesses in the fuel chain.

The investigators' account connects fuel distribution and logistics with financial structures used to conceal ownership. For a buyer, it illustrates why the identity on a registration document is only part of understanding who controls a supplier.

What this means for you: when assessing a supplier, identify who owns and controls the business, check the parties receiving payment, and investigate material changes or inconsistencies. Keep those checks proportionate to the relationship and the concerns identified.

The 2025 Brazilian Yearbook of Public Security recorded 44,127 intentional violent deaths in 2024, a rate of 20.8 per 100,000 inhabitants. Its MVI category combines intentional homicide, robbery resulting in death, bodily injury resulting in death and deaths caused by police intervention. It is not a count of all violent crime.

Table 1 reports 2024 state rates of 8.2 in São Paulo, 22.1 in Rio de Janeiro, 36.2 in Pernambuco and 45.1 in Amapá, per 100,000 inhabitants. These are state averages, not rates for the cities bearing the same names or probabilities that a traveler will be attacked.

What this means for you: use the national and state figures as context, then assess the actual destinations, routes, timing and activities of the visit. A state ranking cannot settle whether a particular hotel, journey or meeting location is suitable.

For November 2025, Check Point Research reported an average of 3,048 weekly cyberattacks per organization in Latin America, compared with 2,003 globally. The regional figure was 17% above November 2024. This is vendor-reported organizational telemetry for Latin America, not a Brazil-only measure, a count of successful breaches or a measure of attacks on traveling executives.

The volume gives a reason to include digital access in planning, but does not identify which travelers are most exposed. CERT.br separately recommends two-step verification and a different password for each account.

What this means for you: before departure, confirm how travelers will access company systems, recover a lost account and report a compromised device. Enable multifactor authentication where available and establish an independent way to verify unusual payment or access requests. Agree these arrangements with the company's IT and finance teams.

The State Department's Brazil advisory reproduced on its Judicial Assistance page is dated May 29, 2025 and says it was updated to add a kidnapping risk indicator. It also reports a kidnapping for ransom involving U.S. travelers. The current travel-advisory history dates the indicator addition to May 29, 2026. These official pages disagree on the year. The 2025 reproduction supports referring to that dated warning; the date on which the indicator was first introduced remains uncertain.

The 2025 text also warns about foreigners being targeted through dating apps or at bars before being drugged and robbed. It recommends vigilance near banks and ATMs and a communication plan with family, an employer or a host organization.

What this means for you: agree pickup locations and driver identification, review the itinerary with the people supporting the visit, and set a check-in and missed-contact procedure. Avoid displaying valuables and remain alert to unsolicited social approaches. Assess additional protection against the circumstances of the visit.

Table 19 of the 2025 Yearbook recorded 2,166,552 fraud reports (estelionato) in Brazil in 2024. Its notes state that this total includes conventional and electronic fraud. The figure measures police-recorded reports across those categories.

One documented pattern is the false bank-service-center scam. The Central Bank of Brazil warns about callers or messages impersonating bank staff and directing people to perform supposed security procedures or payments. Its guidance is to confirm the contact through the bank's official channels.

What this means for you: give travelers a known contact for financial requests and a way to verify unexpected instructions independently. Agree who can approve an exceptional payment and how to report a suspected scam. Physical travel arrangements and account protection need to be planned together.

These sources describe different things: an investigation, police-recorded deaths and fraud reports, organizational cyberattack telemetry, and travel guidance. Their figures cannot be combined into a single measure of risk to an executive.

For a company planning work in Brazil, the practical task is to connect that context to the actual visit: where people will go, who will support them, what information and funds they can access, and how a concern will be reported. Review those arrangements when the itinerary or local conditions change.