The scene is familiar to anyone on an INSS pension in Brazil: the money lands in the account and the statement already shows the slice taken out for a payroll-deductible loan. A federal audit has now found something wrong with that routine at Banco Master. According to the audit, cited by Folha de S.Paulo, 93.3% of the bank's loans became valid before the retiree had signed anything. The audit was finished in July and released on September 8; this breakdown of the Master data was reported by Folha on Wednesday (30).

In Brazil, a "consignado" is a loan repaid through automatic monthly deductions from retirement checks, which is why lenders chase INSS beneficiaries, the country's social security institute. The CGU, the federal government's internal audit office, reviewed 165,990 contracts signed by Master customers between 2019 and 2025. In 154,867 of them, or 93.3%, the signature showed up after the contract had taken effect: the next day in 2.8% of cases, and two days or more later in 90.5%. No other bank had such a high share, the audit says, though the practice appeared at 53 financial institutions.

The rule is simple. For the CGU, authorizing the loan requires an "express manifestation by means of a signature with biometric verification", and the deduction from the pension cannot be registered without proof of that signature. The auditors themselves note that some findings may stem from data-entry errors, but warn of the consequence: "These situations can distort the calculation of financed amounts and clients' debts."

Who answers for it

Master is suspected of defrauding the INSS payroll-loan operation, according to a Federal Prosecutors' Office investigation in the capital Brasilia. The focus is the Credcesta card, which offered perks such as pharmacy discounts and funeral aid and was the bank's flagship product. The CGU audit covered exactly this kind of benefit-linked payroll card, the category Credcesta falls into. The bank's former owner, Daniel Vorcaro, had phones seized by federal police in an inquiry that reached the Supreme Court. His lawyers did not answer questions Folha sent on Monday (28).

The audit carries other warning signs. At Master, biometric validation of electronic signatures was insufficient in 62.4% of contracts, the third-highest rate among banks. Across the system, the CGU counted 110,128 contracts signed with the CPF tax IDs of dead people, from 48,945 distinct IDs, over ten years. In 2025, 37.8% of INSS benefits carried some payroll-loan deduction, totaling 108 billion reais for the year.

In a statement, the INSS said it has had no relationship with Master for more than a year: the technical cooperation agreement ran for five years and ended in September 2025, and the agency has demanded documents and explanations from the bank. "The INSS has improved processes related to payroll loans in recent months," the agency said, citing automatic blocks that stop loans from being registered after a beneficiary's death. In the cases identified by the audit, the INSS opened proceedings and signed settlement terms to investigate them.

What changes, and for whom:

• The flagged problems cover contracts signed between 2019 and 2025 by INSS beneficiaries at 53 institutions; Master holds the largest share.
• Contracts signed late, or with weak biometric checks, may have miscalculated loan values and debts, the auditors say.
• The INSS says it opened proceedings and signed settlement terms to examine the cases identified by the CGU.
• Loans in the name of deceased beneficiaries are now blocked automatically, according to the agency.