Altered Pix QR code: how to tell before you pay and what to do

An altered Pix QR code (Pix is the instant payment system run by Banco Central do Brasil, Brazil's central bank) looks just like the real one and charges the same amount. What changes is who gets paid. That is why the only way to spot it before paying is to look at the payee in your banking app: the name and the CNPJ (Brazil's company registration number) shown on the confirmation screen must belong to the store or to the company that processes its payments.

How the Pix QR code gets altered

The change can happen in three places:

• On the store's page. Malicious code installed on the site swaps the QR code and the Pix Copia e Cola code (the text version of the payment code that the customer copies and pastes into their banking app) at the moment of payment. In September 2026, Kaspersky confirmed 90 Brazilian online stores in this situation. The customer was on the right site and saw nothing different.
• On your computer or phone. Malware or a browser extension swaps the copied code or the image on screen. We explain this case in malware that swaps the Pix QR code.
• In a message. A QR code sent by WhatsApp, email or social media, outside the website, by someone posing as the store.

In all three cases the amount is usually right. The scam works precisely because nothing about the amount stands out.

What to check before you confirm the Pix

1. The payee's name. It should be the store's legal company name, its trade name or the name of a known payment intermediary. An individual's name or a company with no connection to the purchase is a reason to stop.
2. The CNPJ. Many stores show their CNPJ in the site footer. Compare it with what appears in the banking app.
3. The receiving institution. The app usually shows the bank or institution that will receive the money. If the store says it gets paid through a provider, that provider should appear there.
4. The amount and the description. A store's QR code usually includes the order number or the store name in the description.

Procon-SP (the consumer protection agency of São Paulo) made the same recommendation in September 2026: checking the amount is not enough, you need to check the payee's name and CNPJ and not complete the payment if they are different or unknown.

A fair caveat: at small stores, the Pix account may legitimately be in the owner's name. If the name doesn't match, ask the store through a channel you found yourself, such as the phone number or the chat on the site, before paying.

Signs that something is wrong

• The payee's name has no connection to the store.
• The order is still "awaiting payment" long after the bank shows the Pix as completed.
• The store says it did not receive the money, and the receipt shows a different CNPJ.
• The QR code came by message, not on the site's payment page.

I paid an altered QR code: what to do now

1. Open your banking app and use the Contestar Pix (Dispute Pix) option. The self-service button has existed since October 2025. Pick the transaction and choose scam or fraud as the reason.
2. Do it the same day if you can. The deadline to request a refund through MED (Mecanismo Especial de Devolução, the Pix refund mechanism for fraud cases) is 80 days, but the money only comes back if there is still a balance in the receiving accounts. Scammers usually spread the amount out within a few hours.
3. Tell the store. Send the receipt and explain that the payee is someone else. This helps the store find and fix the problem, and it protects other customers.
4. Keep everything. The receipt, screenshots of the payment page, your conversation with the store and the bank's case number.
5. File a police report. It is optional for the dispute, but it strengthens the request and helps the police link cases.

If you are not sure it was a scam, see wrong Pix payment online: mistake or scam. The difference decides whether MED applies to your case.

Why it is not the customer's fault

When the change happens on the store's site, the customer did everything right: went to the correct address, chose the product and paid the amount requested. Checking the payee is a good defense, but it should not be the only one. The store's page is what displays the QR code, and that is where it needs to be protected.

For merchants

If customers start sending receipts in another company's name, treat it as an incident. See the playbook for when the customer paid by Pix and the order was not confirmed and the full guide to the Pix checkout scam.

Proteside protects this point: it checks, on the payer's screen, whether the QR code and the Copia e Cola code are the ones the store issued, and blocks the swap before confirmation. See Pix protection at checkout.