Caixa restores R$ 5,000 limit for lottery-shop transactions after cyber incident

Caixa Econômica Federal has restored the transaction cap at lottery retailers after temporarily cutting it to R$ 2,000 following instability in the network system. For PSPs and acquirers watching high-volume cash-in/cash-out points, the important part is simple: when the back end wobbles, limits move fast, and the operational fallout lands on the merchant network first.

1. On Monday afternoon, 27/7, Caixa said it had restored limits of up to R$ 5,000 for services at casas lotéricas — specifically, payments of bills from other banks and deposits. The bank had previously reduced the cap to R$ 2,000 after a system instability tied to a cyberattack on the network.
2. The announcement came in a notice signed by the CAIXA team, which said the limit restoration applied to “services” for other-bank boletos and deposits. In other words, the restriction was not just a technical nuisance; it directly controlled how much money could move through the lottery-shop channel.
3. The restriction period caused operational disruption across part of the network. According to a sector representative cited by BNLData, some outlets were left unable to operate for up to a day and a half. That is the practical risk for payment intermediaries in these setups: when the rail is frozen, the merchant is effectively offline.
4. The same source said lottery shops that had unauthorized debits on their accounts did not suffer financial losses, because Caixa separated that movement and no impact hit the units’ finances. The harm, according to the account, was operational — the time they could not serve customers.
5. Reports of abnormal activity began circulating around 15:00 on 22 June in category messaging groups. The alleged attack reportedly hit hundreds of lottery shops simultaneously, with unauthorized boleto payments reaching as much as R$ 500,000 in a single unit; one shop in São Paulo said it had processed more than R$ 300,000 in boletos since the irregularities began.

Caixa has not issued an official statement about the cyber incident. For high-risk operators, the takeaway is that even a channel with a very specific function — bills, deposits, and cash access through lottery shops — can see limits rewritten quickly when transaction integrity comes into question.