A CPF leak does not create a single problem and, therefore, there is also no single button capable of neutralizing all misuse. In 2026, the most useful answer is to separate prevention from detection: some tools can stop specific hires before they happen; others serve to discover relationships, lines or operations that have already appeared in your name.
The difference became more important after the launch of BC Protege+, in December 2025. The Central Bank service added a preventive barrier for certain types of accounts. The Registrato continues to be a consultation tool, and the Prepaid Registry continues to help locate prepaid mobile lines linked to the CPF. They complement each other, but are not equivalent.
The rule of thumb: block where there is blockage and monitor the rest
If your CPF or other personal data has been exposed, the first thought is to identify which risk each tool covers. BC Protege+ acts before certain new contracts in the financial system. The Registrato looks at financial records already reported to the Central Bank. The Prepaid Register shows which providers have active prepaid lines associated with the CPF consulted.
This avoids two false feelings of security. The first is to believe that activating BC Protege+ "freezes" the CPF for any fraud. Does not freeze. The second is to treat a clean query in the Registration or Prepaid Registration as proof that nothing can happen later. These queries are snapshots of specific bases and should be repeated when there is reason to follow up on an incident.
BC Protege+: what it really blocks
BC Protege+ is free and allows you to register, in Meu BC, that you do not wish to open certain new accounts or be included as a holder or representative in accounts covered by the service. The Central Bank informs that the protection extends to the opening of a current account, savings account and prepaid payment account, in addition to inclusion as a holder or representative in these accounts.
In practice, before concluding a contract of this type, the institution must consult the option registered for the CPF or CNPJ. If protection is active, covered employment cannot proceed. Citizen access requires a silver or gold gov.br account with two-step verification enabled.
The service was launched on December 1, 2025. On February 20, 2026, the Central Bank reported that BC Protege+ had reached 1 million activations. The rapid growth helps explain why it has become a relevant measure in cases of identity exposure.
What BC Protege+ should not be confused with The Central Bank itself delimits the scope of the service to covered contracts. Therefore, it does not replace monitoring other financial products and records. Fraud involving an existing account, a credit transaction registered through another method or another use of the CPF needs to be detected and dealt with by specific mechanisms.
There is also no retroactive effect to "delete" a relationship that has already been opened. If an unknown account already appears linked to your CPF, the measure is no longer just preventive: it is necessary to identify the institution, dispute the relationship and request correction or closure through official channels.
What if I need to open a legitimate account?
Protection can be deactivated by the user. The Central Bank allows you to deactivate it indefinitely or choose a date for automatic reactivation. This allows you to release a legitimate contract and then return to the protected condition, without abandoning the mechanism permanently.
BC Protege+ also records queries made by institutions. This history can help identify hiring attempts, but an isolated query does not prove fraud. It needs to be interpreted in context: if you haven't initiated any account opening and an unknown institution has consulted your data, it's worth checking the reason directly with the institution.
Registration: it detects, does not prevent
Registration is the Central Bank's tool for consulting reports on financial information associated with your CPF or your company. For the exposed identity issue, one of the most useful reports is the Accounts and Relationships report, known as CCS.
The CCS shows which banks and institutions you have an account, investment or other relationship with and informs you of the start and, if applicable, end dates of the relationship. It does not display balance, movement, branch number or account number. This is enough, however, to find an institution you don't recognize and initiate a dispute.
The Central Bank expressly states that the report can be used to verify whether the CPF or CNPJ was used improperly in opening a fraudulent account. If a relationship appears that you are not aware of, our advice is to contact the responsible institution. It is she who can clarify the origin of the registration and correct or terminate the relationship when there is an irregularity.
Why a single query is not enough
Registration is not a real-time alarm. Each report has its own update deadline. In the case of the CCS, the Central Bank reports daily updates, but allows a delay of up to two business days in the information displayed.
This detail changes the way you use the tool after a leak. An inquiry made shortly after receiving an incident notice creates a baseline. If the risk continues or strange messages, charges or contacts appear, it is worth checking again later. The absence of an unknown relationship today does not prevent an attempt from appearing later.
Registration also offers other reports, such as credit operations and Pix keys. They can be useful when the sign of fraud is not a new account, but an unknown loan or a key linked to an institution you don't recognize. The objective, again, is to detect and then act with the corresponding institution.
Prepaid Registration: a detector for mobile lines in your CPF
Prepaid Registration addresses another risk: a prepaid cell phone line activated incorrectly with your data. The portal maintained by the providers in the project accompanied by Anatel allows you to check which operators have active prepaid lines linked to the CPF consulted.
For privacy reasons, the result does not show the phone number or number of lines. He points to the provider. If an operator appears with which you have no relationship, Anatel's guidance is to contact that provider and, if applicable, request the cancellation or unlinking of the line.
This means that Prepaid Registration does not previously block an activation simply because you have made an inquiry. It works as a detection mechanism. Anatel itself has reinforced the activation procedures for prepaid chips, with more rigorous registration validations, but the query remains useful for discovering a link that has passed these controls or that has a previous origin.
A fourth useful block: preventing improper participation in CNPJ
Whoever is dealing with an exposed CPF can also reduce a risk that does not appear in BC Protege+: the unwanted inclusion of the CPF in companies and other legal entities. The Federal Revenue offers, through Redesim, the service of preventing or allowing the participation of the CPF in the CNPJ.
When the impediment is active, the purpose is to prevent the CPF from being unduly included in the tables of legal entities. The service is free and can be reversed when the holder really wishes to participate in a CNPJ. It does not replace BC Protege+, because it protects another type of bond.
The combination makes sense precisely because of the fragmentation of risks. BC Protege+ covers certain new accounts. Redesim's protection covers participation in CNPJ. Registrato and Prepaid Registration help you search for signals on specific bases. None of them, in isolation, resolves the entire identity exposure.
If something appears that you don't recognize, the action changes from monitoring to contesting
Finding a strange relationship in the Registration or an unexpected provider in the Prepaid Registration is not the end of the diagnosis; It is the beginning of the correction. In an unknown financial relationship, contact the institution through the official channel, inform them that you do not recognize the contract and ask for a protocol. On an undue prepaid line, look for the operator indicated by the portal and request cancellation or unlinking.
If there is financial loss, fraudulent hiring, use of identity or other possible crime, official guidance also includes registering the incident with the competent police authority. The ANPD makes it clear that it monitors administrative infractions related to data protection; does not replace criminal fraud investigation.
Saving protocols, messages, proof of dispute and responses from institutions is important because these records help to demonstrate when you became aware of the problem and what measures you tried to take.
Confirmed leak: when to look for the controller and the ANPD
There is a difference between discovering a fraud attempt and knowing which organization suffered a security incident. If a company or agency has reported that their data has been exposed, that organization is the starting point to ask for clarification about what data was affected, when the incident was identified, what risks were assessed, and what mitigation measures were taken.
The ANPD advises that the exercise of the holder's rights must first be requested from the data controller. If the request is not met or the response is unsatisfactory, the holder may submit a petition to the Agency.
and you must keep proof of previous contact, such as protocol number, emails and messages.
For incidents that may cause significant risk or damage to holders, the obligation to communicate the incident to the ANPD and the holders lies with the controller. The current rule provides for a period of three business days for this communication, except for any specific legislation. The Security Incident Report form is intended for controllers; the citizen uses the appropriate reporting or petitioning channels.
If you just suspect that data "must have been leaked" because you received a scam attempt, don't automatically assume which company was responsible. The ANPD itself emphasizes that attempted fraud and a security incident are not the same thing. When there is an identifiable controller, ask directly whether exposure occurred and what data was affected.
If password, email or account access has also been leaked, treat this as another problem
Exposed CPF is one thing; exposed credential is another. If the incident included a password, recovery code, compromised email address, or other authentication secret, the response must include changing the password where it was reused, reviewing access, and enabling two-step verification.
The official primer on data leaks also recommends monitoring accounts, cards and financial records and being wary of an increase in phishing, convincing calls and messages after an incident. True data about you can be used to make a scam more persuasive, even when the criminal has not been able to open an account or line in your name.
A practical sequence for the first hours and the following days
As soon as you learn about the exposure, it makes sense to activate the preventive barriers that apply to your case, especially BC Protege+ for new covered accounts and Redesim's CNPJ participation protection. Then, consult the Registration and Prepaid Registration to establish a baseline of what already appears linked to your CPF.
If the consultations are normal, the work becomes monitoring. Repeat the checks when new signals appear, respecting the fact that some bases have an update delay. If something strange appears, stop just monitoring and dispute directly with the responsible institution or operator.
When there is an incident confirmed by an organization, ask the controller for information and keep the protocols. If your rights are not met, use the appropriate ANPD channel. If there is fraud, loss or criminal use of identity, also contact the police.
The core idea is simple: after a breach, real protection comes from combining specific blocks with targeted monitoring. BC Protege+ reduces an important type of risk before hiring; Registration and Prepaid Registration help to identify links that need to be investigated; and the channels of the controller, the ANPD, the institutions and the police come in when the problem stops being just potential and starts having a concrete fact to correct.
