Brazil's National Social Security Institute (INSS) has quietly rewired how tens of millions of Brazilians prove who they are to collect a pension, a disability payment, or a welfare benefit. Portaria DIRBEN/INSS Nº 1.347, signed June 18, 2026 and published four days later in the Diário Oficial da União, operationalises the already-mandatory biometric registration requirement — in force since November 21, 2025 — for new applications for retirement, the Continuous Cash Benefit (BPC), and prison assistance (auxílio-reclusão). Applicants get 30 days to complete registration after filing; miss the window, and INSS closes the request outright, treating it as if the applicant withdrew.
What the rule actually requires
The portaria regulates Decreto nº 1.561, issued in July 2025, and slots into a rollout that has been building since late 2025. As of May 1, 2026, benefit approval, maintenance, and renewal already require biometrics on file in one of three databases: the Carteira de Identidade Nacional (CIN), the Superior Electoral Court's voter-registration biometric system, or a national driver's license. That flexibility is temporary. From January 1, 2028, the CIN becomes the sole accepted standard — anyone whose biometrics live only in the electoral or driver's-license systems will have to migrate. Welfare recipients without any biometric record face the tightest clock: the government has set December 31, 2026 as the deadline for them to register. INSS carved out exemptions for people over 80, migrants, refugees and stateless residents, Brazilians living abroad, people unable to travel for health reasons, and residents of hard-to-reach areas — categories that acknowledge, correctly, that a biometric mandate without carve-outs would strand exactly the people welfare systems exist to serve.
The fraud case, stated fairly
INSS's justification deserves to be taken seriously rather than waved off as bureaucratic overreach. Brazil's welfare system has a well-documented fraud problem: investigators have spent much of 2025 and 2026 unwinding a scheme in which associations authorized to deduct union and association fees directly from beneficiaries' payments did so without consent, siphoning off benefits from retirees who often didn't notice until months later. Separately, fraudsters have used stolen CPF (taxpayer ID) numbers to file benefit claims in other people's names and redirect payments to accounts the real beneficiary never opened. A biometric anchor tied to a single national identifier — the CIN uses the CPF number itself as its unique ID — closes an identity-verification gap that has cost the system real money and left genuine beneficiaries fighting to reclaim benefits filed fraudulently in their names. Consolidating identity onto one document also addresses a genuinely absurd status quo: Brazilians could previously hold up to 27 different state-issued RG identity cards, none of them nationally unified. A single, biometrically anchored ID is a defensible modernization goal.
Why the sequencing is the actual problem
The policy's flaw isn't the goal — it's the pace relative to the infrastructure meant to support it. As of May 2026, Brazil had issued just over 52 million CIN cards, according to Biometric Update, against a population of roughly 213 million. Even generously assuming faster issuance since then, the government is asking a welfare population disproportionately composed of elderly, low-income, and rural Brazilians — the people least likely to have already obtained a new ID voluntarily — to acquire one on a compressed timeline or risk having a benefit request closed. The 30-day window is not generous when it requires a trip to a state Civil Identification Office, which in much of Brazil means travel, wait times, and, for the CIN specifically, an updated birth or marriage certificate as a prerequisite document.
The timing also invites a legitimate trust question. On May 21, 2026, INSS confirmed that a Meu INSS query tool had been exposed without requiring login, leaking roughly 2.8 million taxpayer records; the agency said 97% belonged to deceased individuals, but that still left an estimated 50,000 living citizens' data exposed, as Reclaim The Net reported. An agency that had a basic authentication gap on an existing lookup tool one month before mandating that citizens surrender fingerprints and facial biometrics to expand that same centralized system owes the public more than the standard reassurance that new safeguards are in place. Centralizing biometric identity is precisely the kind of system where a configuration error stops being a leaked record and starts being an unrevocable exposure — you can reissue a password; you cannot reissue a fingerprint.
The proportionate fix
None of this argues for abandoning biometric verification — fraud reduction in a system serving tens of millions of monthly payments is a legitimate public interest, and the exemption list shows INSS is not indifferent to edge cases. But a policy this consequential should scale its deadlines to actual card-issuance capacity rather than the reverse, and it should publish an independent security audit of the Meu INSS breach before asking citizens to trust the same infrastructure with irrevocable biometric data. Brazil doesn't need to choose between fraud control and due process for its most vulnerable beneficiaries; it needs to stop setting deadlines the identity system it built cannot yet meet.