Contactless Pix and no-typing payments: the new risks

Contactless Pix and biometric Pix (Pix is Brazil's instant payment system) both stem from the same Central Bank rule: Open Finance's journey without redirection. The customer links their account once to a device or digital wallet and then confirms payments without opening the banking app and without copying any code. At online checkout, this reduces copy-and-paste, but it shifts trust to two points: the account-linking step and the payment button on the store's page. That is where the new precautions come in.

What the Central Bank launched

The foundation is Banco Central do Brasil Resolution 406 of August 2024, which regulates payment initiation without redirection within Open Finance. It splits the journey into two stages:

• Account linking. The customer authorizes a payment initiator, such as a digital wallet, to link their account to a device. Authentication and confirmation take place in the environment of the bank that holds the account, and the device then stores a security credential.
• Transaction. For each payment, the bank uses that credential to authenticate the customer, and confirmation happens in the initiator's environment, without a trip to the banking app.

The rule made implementation mandatory from November 14, 2024 for the institutions that accounted for 99% of Open Finance payment initiations. After roughly three months of testing, offering it to the public became mandatory for those banks on February 28, 2025. For the other institutions required to take part in Pix, a December 2025 amendment set testing from February 6, 2026 and general availability from April 22, 2026.

In practice, the first big showcase was Google's wallet, which in November 2024 began accepting contactless Pix for customers of some digital banks. At that stage, the button to pay with the wallet in online purchases was still limited to a few apps.

There is also an amount limit. Pix rules currently set a cap of BRL 500 per transaction for contactless payments by individuals, also applied to the journey without redirection. Normative Instruction BCB 746, published in June 2026, revokes that cap as of October 1, 2026, when each customer's regular Pix limits will apply.

What changes at online checkout

For online sellers, the most relevant change is not the card terminal but payment without typing. In the journey without redirection, the customer picks their bank at checkout, approves the link once in the banking app and, on later purchases, confirms with biometrics or the device passcode without leaving the store.

• Less copy-and-paste and less app switching, which tends to reduce drop-offs.
• Charge details now travel from the store's page to the initiator, instead of reaching the bank through a QR code scanned by the customer.
• QR codes and copy-and-paste remain, because not every customer will have a linked account.

New precautions

Fewer steps bring convenience, and also fewer chances for the customer to notice that something is wrong.

• Linking is valuable. Whoever manages to link someone else's account to a device gains a ready-made payment method. By rule, linking is authenticated in the bank's environment; customers should approve it only in the official banking app, never through a link received in a message.
• The page button becomes the starting point. Malicious code on the checkout that alters the button, the redirect address or the data sent can lead the customer into a fake flow or a different charge. The trust that used to sit in the QR code now sits in the button.
• Fast confirmation, fast checking. With biometrics, the confirmation screen goes by in seconds. Showing the recipient clearly remains the customer's main defense.
• Larger amounts from October. With the BRL 500 cap gone, an improper payment through these journeys can cost more.
• Lost devices. The linked device works as a credential; customers should know how to remove links in their bank or wallet.

Merchant checklist

1. Offer the journey without redirection through your payment provider, with an initiator authorized by the Central Bank.
2. Make sure the payment button only leads to your provider's, the initiator's or the bank's domains, and review this whenever the checkout changes.
3. Keep third-party scripts on the payment page to a minimum and monitor what the live page displays.
4. Show your legal name and tax ID before confirmation, matching what the customer will see on the initiator's screen.
5. Keep protecting QR codes and copy-and-paste, which many customers still use.
6. Review reconciliation and support alerts after October 1, when limits change.
7. Explain on your help page that account linking should only be approved in the banking app.

To understand how QR swaps happen at checkout and how to block them, see Pix protection at checkout.

The new journeys coexist with the old ones, and both start on your page. Proteside checks, on the buyer's screen, that what the page shows or copies for payment is exactly what your store issued, and blocks any swap before confirmation, with an alert and evidence. Try it free for 14 days and see how it works.