Security and knowledge, before every operation.
Everything your team needs to operate stablecoins with reais safely: digital security practices, how to spot scams, what to check before every transaction, a complete glossary and the most frequent questions.
Three rules that stop most scams
Never share passwords or codes
Obsidiam never asks for your password, verification code, private key or recovery phrase, through any channel.
Always check the domain
Our official communications come only from @obsidiam.com addresses, and the platform lives at obsidiam.com.
When in doubt, stop and confirm
Urgency is a scammer's main tool. Before acting, confirm through the official channel: support@obsidiam.com.
Protect your company's access
Most incidents start with an exposed credential. These practices reduce that risk for the whole team.
Strong, unique passwords
Use a long password that is different for the platform, and keep it in a password manager. Never reuse passwords from other services.
Two-factor authentication
Turn on two-factor authentication whenever it is available, and prefer an authenticator app to SMS, which is more vulnerable.
Access only for those who need it
Give access only to the representatives who operate the account, and remove it immediately when someone leaves the company or changes role.
Protected devices
Keep your operating system and browser up to date, use antivirus software and avoid public computers or open Wi-Fi networks.
API keys in a vault
Store API keys in a secrets vault, never in code, spreadsheets or email. Use the IP allowlist and rotate the key at the first sign of exposure.
End your sessions
Sign out when you finish, especially on shared devices, and review regularly who has access to the account.
Recognize a fake message
Scammers imitate well-known brands to steal access or divert payments. Here is how a fake message gives itself away.
Dear client,
We detected unusual activity. Your account will be suspended in 2 hours unless the check is completed.
To keep your access, reply with the verification code you just received by SMS and confirm your details at:
obsidiam-verify.net/login
Illustrative example of a fake message
Warning signs
- A sender outside the @obsidiam.com domain, even one that looks similar
- Urgency or threats: account suspension, short deadlines, penalties
- Shortened links or swapped domains, such as 0bsidiam.com or obsidiam-support.com
- A request for your password, verification code, private key or recovery phrase
- A request to transfer funds to another account or wallet, even a "safe" one
- Unexpected attachments or offers that are too good to be true
The most common scams
Fake support
Someone poses as Obsidiam support by phone, messaging apps or social media and asks for login details to "fix a problem".
Fake executive
A message that seems to come from one of your company's directors asks for an urgent, confidential operation. Always confirm through another channel.
Changed payment details
An email says the Pix key, the QR code or the wallet address has "changed". Always use the details shown on the platform.
Fake site or ad
Pages that imitate the platform appear in search ads. Type obsidiam.com directly into your browser.
Test or unlock transfer
The scammer asks for a small transfer to "validate" or "unlock" the account. Obsidiam never asks for this.
What Obsidiam never does
- Ask for your password, verification code, private key or recovery phrase
- Ask you to move reais or assets to another account or wallet
- Change payment details by email, message or phone
- Send links to validate your account outside the platform
Check before you confirm
Pix and blockchain transactions are fast and, in most cases, irreversible. A few seconds of checking prevent permanent losses.
Pix
- Only use the QR code or Pix key shown on the platform, never details received by message.
- Before paying, check that the beneficiary shown by your bank is the expected one.
- Withdrawals only go to Pix keys already registered and approved on the platform.
- Payments from senders your company hasn't approved are held for review and may be returned to the payer.
- If a Pix turns out to be fraudulent, the Central Bank's Special Return Mechanism (MED) can be triggered. Tell us immediately.
Blockchain
- Check the network: the same asset exists on different networks, such as TRC-20 and ERC-20, which are not compatible with each other.
- Check the whole address, not just the start and the end. Scammers create near-identical addresses.
- Copy the address from a trusted source, such as your saved wallets, never from the transaction history.
- For a new address, send a small test amount first.
- Blockchain transactions cannot be undone. Track every transfer by its transaction hash.
Compare the two addresses.
Quotes
- Confirm the operation only within the firm quote's validity window.
- Review the amount in reais, the stablecoin quantity, the network and the destination wallet before confirming.
The platform's terms, made simple
- Address poisoning
- A scam in which the fraudster sends a tiny transaction from an address almost identical to one you use, hoping you copy it from your history on a later transfer.
- AML/CFT
- Anti-Money Laundering and Counter-Terrorist Financing: the policies, procedures and internal controls used to detect and prevent these crimes.
- API
- Application Programming Interface: a set of rules that lets different systems talk to each other. At Obsidiam, it lets your company request quotes, execute orders and check balances from its own systems.
- Blockchain
- A distributed digital ledger that records transactions securely, transparently and immutably. Instead of a central intermediary, a network of computers validates and records the information in cryptographically linked blocks.
- Compliance
- The practices a company follows to meet legal and regulatory requirements and its internal policies, and to prevent, detect and address deviations.
- Crypto-asset
- A digital asset protected by cryptography and recorded and transferred on a blockchain. It includes cryptocurrencies, tokens and stablecoins.
- Cryptography
- A technique that turns data into an unreadable code that can only be deciphered with the right key.
- Digital asset
- An asset that exists only in digital form and has a measurable economic value. The best known are crypto-assets.
- Fiat currency
- Currency issued by a government and accepted as legal tender, such as the Brazilian real.
- Firm quote
- A price guaranteed for an operation during a visible validity window. If you confirm within that window, the operation is executed at exactly that price.
- KYC and KYB
- Know Your Customer and Know Your Business: identity checks on people (KYC) and on companies, their shareholders and beneficial owners (KYB), used to prevent fraud and money laundering.
- LGPD
- Brazil's General Data Protection Law (Law No. 13,709/2018), which governs the processing of personal data in Brazil to protect people's freedom and privacy.
- MED
- Special Return Mechanism: a Pix feature created by the Central Bank of Brazil to make it easier to return funds in proven cases of fraud, scams or operational failure.
- Network (blockchain)
- The infrastructure where a digital asset is recorded and transferred, such as Tron (TRC-20), Ethereum (ERC-20), Polygon and Solana. The same asset can exist on several networks, which are not compatible with each other.
- Network fee
- A cost charged by the blockchain itself to process a transaction. It varies with the network and how busy it is.
- OTC
- Over-the-counter: trading negotiated directly between the parties, usually for larger operations.
- Payment account
- An account for making payments, such as Pix, held at a payment institution. It is not a checking account or a deposit account.
- Phishing
- A fraud attempt in which the scammer poses as a trusted company, by email, message or fake website, to steal passwords, codes or money.
- Pix
- The Central Bank of Brazil's instant payment system, available 24 hours a day, every day.
- Pix key
- An identifier linked to an account for receiving Pix, such as a CNPJ, email address, phone number or random key.
- Pix QR code
- A code that holds the details of a Pix payment. It can be reusable, with no set amount, or generated for an exact amount.
- Private key
- The secret code that controls the assets in a wallet. Whoever has the private key controls the assets, so it must never be shared.
- Random key (EVP)
- A Pix key generated automatically, made of a string of letters and numbers, that lets you receive payments without exposing company data.
- Social engineering
- Manipulation techniques in which scammers pose as trusted people or companies to obtain information, access or payments.
- Spread
- The difference between the market reference price and the price offered in the quote, which pays the intermediary. At Obsidiam, it is already included in the quote before you confirm.
- Stablecoin
- A virtual asset backed by reserve assets and designed to keep its value tied to a reference fiat currency, such as the US dollar. Examples: USDT and USDC.
- Token
- A digital asset that represents value or utility on a blockchain, such as the digital representation of an asset or a right to use a service.
- Transaction hash
- A unique code that identifies a transaction on a blockchain and lets you look it up in a public explorer.
- Two-factor authentication (2FA)
- An extra layer of security that requires, besides your password, a second factor such as a code generated by an app on your phone.
- USDC
- A stablecoin issued by Circle Internet Financial, LLC, referenced to the US dollar.
- USDT
- A stablecoin issued by Tether International, S.A. de C.V., referenced to the US dollar.
- Wallet
- Software or hardware that holds the keys to digital assets on a blockchain. Each wallet has a public address for receiving assets.
- Wallet address
- A public identifier, made of a long string of characters, where digital assets are sent. Each network has its own address format.
Adapted from the glossary in the Terms and Conditions of Use.
Frequently asked questions
Obsidiam intermediates the buying and selling of stablecoins, such as USDT and USDC, against reais, for Brazilian businesses. You request a firm quote, confirm the operation and receive the assets on the wallet and network you choose.
Legal entities incorporated in Brazil with an approved account. Before you trade, we verify the company, its shareholders, representatives and beneficial owners.
USDT on the Tron (TRC-20), Ethereum (ERC-20), Polygon and Solana networks, and USDC on Ethereum, Polygon and Solana. The up-to-date list is always on the Digital assets page.
See Digital assetsObsidiam does not provide custody of third-party virtual assets. The assets you buy are sent to the wallet you indicate, on the network you choose.
It is a payment account in your company's name, opened and maintained by Celcoin Instituição de Pagamento S.A., an institution authorized by the Central Bank of Brazil. You receive reais by Pix, execute operations straight from the balance and withdraw by Pix.
Read the Payment Account Terms of UseBy Pix, using the reusable QR code, a QR code for an exact amount or the random key shown on the platform. Every payment is credited automatically as soon as the Pix is confirmed.
Payments from senders your company hasn't approved are held for review and may be returned to the payer. This protects your account against funds of unknown origin.
By Pix, to a key registered and approved on the platform. Before confirming, you see the amount, the destination and your limit.
No. The payment account is not a checking account or a deposit account, earns no interest and is not covered by the FGC. The reais are your company's electronic money, held by Celcoin in segregated assets.
A price guaranteed for a visible validity window. If you confirm within that window, the operation is executed at exactly that price. Once it expires, simply request a new quote.
Obsidiam earns the spread, already included in the quote before you confirm, plus the blockchain network fee where applicable. For the BRL account, Celcoin charges the fees it discloses; Obsidiam charges no fee of its own for the account.
See Fees and risksWhen you confirm, the amount due is debited from your BRL balance and the asset transfer starts right away. Blockchain confirmation time depends on the network you choose, and everything is usually completed the same day.
Before you confirm, yes: just don't confirm or let the quote expire. Once executed, blockchain transactions cannot be undone, and a confirmed Pix is not reversed because of an error by whoever entered it.
Transfers to an incompatible network or a wrong address can be lost for good, with no way to recover them. Always check the network and the full address before confirming.
Our official communications come only from @obsidiam.com addresses, and the platform lives at obsidiam.com. Be suspicious of any other domain, even one that looks similar.
Never. We also never ask you to move funds to another account or wallet, or change payment details by message. If someone asks, it's a scam.
Don't click any link, don't reply and don't make any payment. Forward the message to support@obsidiam.com. If you shared any login details, ask us through the same channel to block the account immediately.
We process data under Brazil's General Data Protection Law (LGPD), with technical and organizational security measures. The details are in the Privacy Policy.
Read the Privacy PolicyVerifying the company, its representatives and beneficial owners is required by anti-money-laundering rules and protects the financial system against fraud. The same data is reused to open your BRL account.
We monitor operations to prevent fraud and money laundering. When something needs extra verification, the operation may be held for review and we may ask for more information.
Received something suspicious?
Don't click, don't reply and don't make any payment. Forward the message to our team, and if you shared any login details, ask us to block the account immediately.
Compliance matters: compliance@obsidiam.com