PhaaS, Pix, authority lures and NFC with AI: four fraud hypotheses for 2027

How to read and review these scenarios

Each scenario separates a hypothesis, its necessary assumptions and observations that could evaluate it. The horizon is 2027; the sources concern earlier periods. No unmeasured losses, victim numbers or growth rates are assigned.

Report selection depends on researcher visibility and provider publication choices. More entries may reflect better coverage rather than more attacks. The Atlas methodology and country coverage review explain why the corpus is not a regional census.

Confidence remains the author’s judgement: medium for the first two scenarios, low to medium for the third and low for the fourth. These labels are not percentages. A review without new reports may reduce available support but does not by itself disprove a hypothesis.

Horizon 1: platforms over binaries

Hypothesis. A growing share of fraud observed by security teams will involve phishing platforms and modular kits, not only conventional trojans. This depends on viable delivery channels and operating economics.

Evidence. Group-IB reports over 350 domains for the combined Aclaraciones Banciaras and Balonx campaigns, not one product alone. Netcraft’s Haozi research describes over $280,000 received by a wallet for advertising and intermediary services; that is not a LATAM banking-loss estimate.

Signal. Record incidents with an identified panel, template or kit but no malware sample. Assessing a growing share requires comparable incident classifications, not counting articles or domains as independent fraud events.

Review condition. The earlier version proposed disproof if 2027 reports continued to attribute most fraud to trojans. That comparison requires comparable coverage and denominators; isolated publications cannot establish it. The Balonx/BREEZE COMET analysis also distinguishes customer targeting from institutional access.

Horizon 2: Pix and Android

Hypothesis. Mobile payments and Android will continue to attract fraud tooling. This assumes continued adoption and abuse opportunities, not that every digital payment is compromised.

The Pix Management Report 2023–2025, page 14, reports nearly 80 billion transactions in 2025. Those are payments, not fraud incidents. The article preserves 31 Android families in the later Atlas snapshot and 28 in the September 17, 2026 snapshot—documentary counts, not transaction volumes.

Signal. New sources describing automated transfers, app abuse or banking impersonation with sufficient behavioural detail. “Pix” in a family name does not establish every capability. The Android/Pix analysis separates those mechanisms without adding their counts as infections.

Review condition. Verifiable shifts in adoption, distribution or controls may weaken the premise. A malware dataset’s size does not measure the probability of fraud in a transaction.

Horizon 3: trust as a surface

Hypothesis. Messages impersonating authorities, employers or merchants will remain relevant alongside bank impersonation. This assumes that digital procedures, benefits and commercial relationships retain their value as lures.

The original material cites Grandoreiro campaigns using SAT, CFE, AFIP and SARS identities, and Blind Eagle cases using Colombian judicial references. These are historical examples, not a current-activity statement for every lure. The Windows banking-trojan review separates families, operators and source periods.

Signal. Preserve a campaign’s first contact, not only its final form. A message that does not initially name a bank can still lead to credential theft or another stage; the path requires evidence.

Review condition. Assess whether newly observed cases, classified comparably, cease using these lures. Low-to-medium confidence acknowledges scattered examples rather than predicting behaviour in every country.

Horizon 4: NFC and AI in local development

Hypothesis under review. Monitor expansion of NFC-relay tools with AI-assisted development. Not every convergence is unprecedented: Cleafy’s May 2026 report already describes indicators consistent with AI assistance in DevilNFC and NFCMultiPay. These are provider assessments, not original attribution.

Page 6 of the Central Bank report places incorporation of contactless Pix into its regulation in June 2025. That payment product and NFC card relay are not automatically the same mechanism or proof of an incident against Pix.

PromptSpy and Balonx’s automated vishing remain comparative examples in their dedicated articles. They do not demonstrate that one operator integrates all those capabilities. Original confidence remains low: the anticipated expansion, mechanism and market still need to be defined.

Signal. A primary report identifying payment instrument, country, period, relay mechanism and the evidence for any AI claim. Broad references to LATAM or assisted coding cannot replace these details.

Review condition. No such report means no corroboration in the reviewed set, not disproof of the possibility. A revised hypothesis needs editorial approval of its scope, not an intuitive confidence recalculation.

What the next review must record

Record the new source, the assumption it changes and the observation it adds. Separate partial support, contradictory evidence and documentary absence. Syndication of one source is not independent corroboration.

The four hypotheses remain monitoring aids, not operational findings or probabilistic forecasts. This exercise creates neither a regional fraud rate nor evidence of a newly discovered campaign.