Security

The fleet that does not exist: a Play Store listing, a 3-week-old CNPJ, and the robotaxi Ponzi aimed at Brazil

Taxinexo sells Brazilian users a share of an autonomous taxi fleet that drives itself around New York and pays 90% a month. The fleet is a sprite sheet, the rides are a cron job, and the company behind it is a 3-week-old electronics retailer in a virtual office on Avenida Paulista. The evidence, the arithmetic, and the collapse timeline. Findings and reasoning, not a takedown guide.

Arthur Dutra··10 min readShare ↗RSS

A Play Store link crossed my feed this week: an app called Taxinexo, 10 thousand plus downloads, 4.7 stars. People around it were posting withdrawal receipts and talking about doubling money in a month. The pitch: rent a share of an AI-driven autonomous taxi, collect a cut of its fares.

I spent an evening pulling on it. Everything below is from public sources and screenshots of the app itself: the Play Store listing, the Receita Federal registry, and 3 screens from inside the product. No exploitation, no backend access, nothing that requires trust in me. You can reproduce every step.

The conclusion up front: Taxinexo is a Ponzi scheme wearing a mobile game as a costume. The rest of this post is the evidence.

The storefront

The listing itself does most of the work if you read it slowly.

The developer account is "Hoorin". The listed developer entity is a person, "HARRIS RICHARD MICHAEL", country United States, contact address kamrangaa@gmail.com. Support goes to service@taxinexo.com. That is already 2 unrelated mailboxes for one product, and neither belongs to a company.

The package name is plus.H50715A0E. Real products name their packages after their domain: com.uber.driver, com.nubank.android. A hex-string package is the signature of app factories that publish the same template repeatedly and expect takedowns. When one listing dies, the next identifier is already compiled.

The description contains no feature list, no screenshots of actual functionality being described, no company history. One sentence, translated: if a user rents a vehicle after payment, they may receive a share of the profits the car generates, deposited to their bank account after taxes and platform commissions. The store metadata reads "Brazilian investors support AI projects for autonomous driving." A vehicle category app whose entire self-description is an investment prospectus.

The reviews split in a familiar way. The 5-star reviews are generic ("started yesterday, excellent app to invest your money, easy to use, recommend"). The critical ones report real friction: Google sign-in broken, forced phone number registration, persistent errors. Purchased praise is smooth. Real users hit walls.

Last update: 26 March 2026. Hold that date, it matters in the next section.

The paper company

Defenders of the platform point to its CNPJ, and the CNPJ does exist: 67.702.335/0001-22, TAXINEXO INTELIGENCIA ARTIFICIAL AUTOMOBILISTICA LTDA, status active, São Paulo. I pulled the Receita Federal record. It is the strongest evidence against the platform, not for it.

Date of registration: 24 June 2026. The app has been live and collecting deposits since at least March. The company was incorporated 3 months after the money started moving, which inverts how legitimate operations work and matches exactly how fraudulent ones retrofit legitimacy when users start asking questions.

Registered main activity: CNAE 47.57-1-00, retail of parts and accessories for household electronics. Secondary activities: retail of appliances and audio/video equipment, retail of cosmetics and perfume, retail of unspecified goods. A company named "artificial intelligence automotive" whose registered business is selling phone chargers and perfume. Not one CNAE touches vehicles, leasing, transport, payments, or asset management.

That last gap is the legally fatal one. Taking public money against a promise of returns is a regulated activity in Brazil. It requires either a CVM registration (securities offering) or a Bacen authorization (financial institution). A microempresa retail LTDA holds neither, and operating anyway is a crime under Lei 7.492/86 before we even reach the pyramid statutes.

The rest of the record fills in the texture. Registered address: Avenida Paulista 1471, conjunto 1110, a virtual-office suite shared by hundreds of shelf companies. Registered email: sickhauer@gmail.com, which is now the third disposable Gmail attached to this operation. Porte: ME, a size class capped at R$360 thousand in annual revenue, declared by a venture that claims to operate an autonomous taxi fleet.

Incorporation costs a few hundred reais and no one at the Junta Comercial checks whether your fleet exists. A CNPJ proves a form was filed. It proves nothing else.

The map

Inside the app, the home screen shows your fleet live on a map. The map is of New York: Manhattan, Brooklyn, Queens, the 495 and the 278 labeled and visible.

Sit with that. The deposits are in reais, via Pix, from Brazilian users, into a São Paulo retail LTDA. The fleet supposedly generating those returns operates 7,700 km away, in one of the most heavily regulated taxi markets in the world, run by a São Paulo retail microempresa with no US entity on record anywhere in the operation.

The cars themselves are cartoon sprites, one model, one color, no plates, rotated at angles that ignore the road grid. Two of them overlap near 5th Avenue. This is a static basemap with decorative icons on top, and it is the level of effort the operators judged sufficient. They were right, which says more about the acquisition funnel than the app.

The ledger

The "orders today" screen is where the simulation becomes measurable. It lists the rides your rented car completed, with timestamp, duration, distance, and your earnings. I transcribed the 13 visible rows from 15 July.

3 patterns fall out of the numbers immediately.

The schedule is a timer. Rides land every 46 to 61 minutes, without exception, around the clock: 01:03, 02:00, 02:57, 03:54, 04:44, 05:44, and on through the morning. No taxi in any city on earth books a 10 to 18 km fare hourly through the 3 am trough and the 8 am rush at the same cadence. Demand has a shape. This data has none, because it comes from a scheduler, not a street.

The payout is a constant. Divide earnings by distance across all 13 rides and you get R$0.05 per km, give or take a rounding step, on every single row. 17.91 km pays R$0.89. 6.11 km pays R$0.40. Real fare revenue varies with surge, wait time, tolls, tips. A fixed per-km constant is what you hard-code when you need plausible-looking rows.

The physics is uniform. Duration versus distance gives an average speed of 34 to 45 km/h on nearly every ride, at 2 in the morning and in the breakfast rush alike, through Manhattan. Sample any real GPS fleet and the spread would be triple that.

And then there is the absolute scale: a 24-minute, 18 km taxi ride in New York bills somewhere between USD 40 and 60. The app credits R$0.89 for it. The numbers are not even trying to reconcile with the story. They only need to tick upward.

The catalog

The rental screen is the actual business model, and it is 4 rows long.

The entry product, "Experiência-001", is free (R$97 struck through, 100% off) and pays R$9.70 to R$10.67 over a 3-day cycle. Note the figure: almost exactly 10% of the fictional price. This tier exists to complete one full deposit-accrue-withdraw loop, because a successful first withdrawal is the single most persuasive marketing asset a scheme like this can generate.

Then the ladder:

ProductPriceStated profitCycleReturn
TA-CAR-021R$65R$123.50 to 130.0025 days~1.9x
TA-CAR-022R$190R$351.50 to 370.5030 days~1.9x
TA-CAR-023(cut off)R$674.50 to 710.0045 days~1.9x implied

Every tier pays 1.9 times its price. The "profit range" is cosmetic noise around a fixed multiplier. Nobody priced these against a fleet's operating economics; someone picked a return that sells and stretched the cycle length as the only variable.

For calibration: 90% over 25 to 30 days, against a Selic benchmark of roughly 1% a month. There is no lawful asset class within 2 orders of magnitude of this. Renaissance Medallion, the best-documented fund in history, averaged about 66% a year before fees.

The interface seams confirm the template origin: the nav bar reads "Lar" and "Minha" (machine translation of "Home" and "Mine", a Chinese app convention), cycle durations render as "3days" untranslated, and a bonus bubble is labeled "Bola". This exact template has shipped under dozens of names. Taxis this quarter; last year the same template sold shares in warehouses, hotel rooms, and battery-swap stations.

The arithmetic

None of the above requires speculating about intent. The payout structure alone determines the outcome.

Paying 1.9x over 30 days means every active real that exits must be covered by more than 1 new real entering within the cycle. There is no fleet revenue, so the coverage comes exclusively from new deposits. That constraint has 1 solution: the deposit base must grow faster than 90% a month, compounding, forever. No population of recruits sustains that curve. The scheme is insolvent from its first day of operation; the only open question is the date the insolvency is disclosed, and the operators choose that date, not the market.

This is also why "but withdrawals work" is the least informative fact a participant can cite. Early withdrawals are the customer acquisition budget. Every paid receipt posted to a WhatsApp group is advertising bought at a known cost, and it converts better than any ad the operators could run under their own name.

The observable lifecycle, from the Brazilian schemes that ran this same template through 2023 to 2025, runs 2 to 6 months: launch, influencer seeding, growth phase with reliable payouts, then a terminal sequence that is remarkably consistent. Watch for sudden deposit bonuses, raised minimum withdrawal amounts, "scheduled maintenance" on the withdrawal rail, and finally a required "release fee" to unlock your balance, which is a second scam run against people already trapped. App published in March, CNPJ in June, aggressive recruiting in July. My read is that Taxinexo is past its midpoint.

The winners get investigated too

A detail that surprises people: profiting from the scheme does not place you on the safe side of the eventual investigation.

Passive participants who only deposited and withdrew are treated as victims in the criminal frame, but their net gains are proceeds of crime paid with other victims' deposits, and clawback actions can and do recover them. Telexfree established the pattern in Brazil: net winners were pursued for restitution. Undeclared gains also sit exposed to Receita cross-checks against Pix records.

Recruiters carry criminal exposure of their own. Promoting a pyramid is an offense against the popular economy under Lei 1.521/51, article 2, IX, and case law reaches active recruiters, not only founders. Depending on what a promoter knew, estelionato (CP 171) and money laundering (Lei 9.613/98) attach. Several Brazilian influencers have been convicted or held civilly liable for exactly this conduct in prior schemes. At 90% a month, arguing good faith gets difficult, and it gets harder in proportion to your referral earnings.

If someone you know is inside

Short version, and I am neither a lawyer nor a financial advisor:

Withdraw everything now if withdrawals still function, and stop depositing. Preserve evidence while the app still opens: screenshots of balances, the rental catalog, Pix receipts, referral records. If money is already stuck, file a boletim de ocorrência and trigger the MED (the Pix special return mechanism) through your bank immediately; MED outcomes decay fast as funds are layered onward. Report the listing through the Play Store's flag function, and to consumidor.gov.br.

Expect the warning to fail while payouts still flow. It usually does. The documentation you keep today is for the person they will be in 2 months, when it stops.

Method note

Everything here came from 4 sources: the public Play Store listing for plus.H50715A0E (captured 18 July 2026), the Receita Federal CNPJ record for 67.702.335/0001-22 (certificate issued 26 June 2026), 3 screenshots from inside the app dated 15 July 2026, and public corroboration from Brazilian users flagging the platform on TikTok and YouTube. I did not probe the backend, and this post deliberately omits anything that would function as an operator's checklist for building a better version. The scheme does not need reverse engineering. It confesses in its own UI, one arithmetic check at a time.