Brazil’s September fraud reports: why the denominator matters

The brief

CERT.br’s live statistics now include September 2026. The Brazilian incident-response centre lists 3,120 voluntary notifications in its fraud category out of 40,735 total notifications for the month: 7.66%. In August the corresponding figures were 3,039 and 77,918, or 3.90%. Source: CERT.br’s live monthly table and category definitions.

The share nearly doubled while the category count rose only modestly. Our conclusion is to keep the numerator and denominator together whenever presenting a risk statistic. These reports do not measure how many people were defrauded or the prevalence of fraud in Brazil. For a professional firm using public statistics to explain a communication risk, the useful discipline is to show what was counted, how it was reported and what the figure cannot establish.

The full record

The September row of CERT.br’s 2026 table records 3,120 fraud-category notifications, compared with 3,039 in August. Total notifications across all categories fell from 77,918 to 40,735. The published fraud shares are 3.90% and 7.66%, respectively. Source: CERT.br’s live monthly table and category definitions.

Why the denominator changes the story

Calculated from those published counts, the fraud category increased by 81 notifications, about 2.7%. The total fell by about 47.7%. A headline saying that fraud “nearly doubled” would therefore misdescribe this comparison: it is the category’s share of a smaller total that nearly doubled. Underlying counts: CERT.br.

What the category means

CERT.br describes these as voluntary notifications from incident-response teams, network administrators and users. Its fraud category includes phishing and malware used to steal information or credentials. The figures are not a count of proven financial losses or unique victims, and the changing flow of reports does not establish a population trend. Source: CERT.br’s live monthly table and category definitions.

Our analysis: preserve the definition with the number

A statistic often travels further than its method. A figure copied into a client presentation may lose its reporting period, unit or qualification along the way. Treat those details as part of the claim itself. A reviewer should be able to see the original table, the selected row and the calculation without searching through a separate research conversation.

For a chart comparing months, show absolute counts beside percentages and explain what the denominator contains. If the source changes a category or reporting method, flag that before drawing a trend line. Avoid comparing voluntary incident notifications with regulator warning counts as if both measured the same phenomenon.

A useful editorial check

Ask a colleague to restate the proposed headline using only the chart and its note. If the restatement turns “share of reports” into “chance of being defrauded”, revise the presentation. The distinction matters when readers use public evidence to decide what deserves attention.

This dataset can support a precise account of reports received by one centre. It cannot, on its own, quantify the demand for a communication product or demonstrate that a particular control works. Those questions require separate evidence.

We read CERT.br’s live 2026 monthly table and definitions on 12 October 2026, after its dynamic charts loaded. This is a September data snapshot; we did not establish the update’s first-publication time. Calculations: (3,120 − 3,039) / 3,039 = 2.665%; (40,735 − 77,918) / 77,918 = −47.721%. Percentages in the table are rounded. Counts describe voluntary notifications, not unique victims or population prevalence. We have not attributed the changes to a particular cause.

1. CERT.br incident statistics, monthly table January–September 2026 and category definitions