Pix Automático: what to check on the authorization screen

With Pix Automático, Brazil's recurring version of its Pix instant payment system, available since June 16, 2025, the customer gives a single authorization in their banking app and, from then on, the company charges on a recurring basis without a new confirmation for each debit. That is why everything hinges on the authorization screen: who will receive the money, the maximum amount per charge, the frequency, the first payment date, the validity and the use of credit. Customers should check each item before accepting, and merchants should make sure the screen shows exactly what was sold.

How Pix Automático works under Central Bank rules

The rules are in the Pix regulation, amended by Banco Central do Brasil Resolution 402 of July 2024. The key points:

• A single, prior authorization. The payer authorizes their own bank once, before the first charge, and does not need to authenticate for each debit.
• Payer control. The payer can cancel the authorization at any time and, where allowed, change it.
• A specific purpose. Each authorization covers a defined billing relationship, which may bundle several products or services from the same recipient if they are charged as one.
• Who can charge. Only companies with an active Brazilian tax ID (CNPJ) can receive through Pix Automático. Offering it to recipients is optional; institutions that hold accounts must offer it to payers.
• Four authorization journeys. The request can reach the payer's bank through the direct relationship with the company; by scanning a QR code containing the authorization request; through a QR code that authorizes and pays the first charge at once; or as a proposal shown after a payment made with a QR code.
• Minimum parameters. The authorization records the recipient's identity, the maximum amount per transaction, chosen by the payer above a floor the recipient may set, whether pre-approved credit can be used when the balance is short, the validity period, if any, the frequency and the expected date of the first payment.
• Refunds when something goes wrong. The Special Return Mechanism (MED) covers debits that don't respect the authorized parameters, debits without a valid authorization and failures by the payer's bank. Institutions offering Pix Automático agree to refund from their own funds, even when the recipient's account has no balance.

Where the attack surface is

A recurring authorization is worth more to a scammer than a one-off payment: until someone notices, it keeps debiting. The sensitive points sit around the authorization screen.

• A swapped QR code at checkout. Three of the four journeys start by scanning a QR code displayed by the company. If malicious code swaps that QR code on the page, the request reaching the bank may be for another recipient. In the journey that authorizes and pays the first charge at once, the customer loses the first amount and also leaves a recurring debit in place.
• Unwanted authorization requests. A company can send authorization requests to the payer's bank. That is why the regulation requires institutions to monitor and act against recipients that send improper charges or excessive offers, such as to people with no relationship to them or repeatedly to someone who already declined.
• Maximum amount and credit. A customer who accepts without looking may leave the cap too high or enable pre-approved credit without realizing it.
• A name the customer doesn't recognize. When the legal name shown in the banking app is very different from the store's name, customers get used to approving unfamiliar names, and that habit is exactly what scammers exploit.

Good practices for merchants

• Before showing the QR code, explain in one sentence what the customer will see in the bank: recipient name, amount, frequency and date of the first debit.
• Display your legal name and tax ID next to the QR code, exactly as they appear in the banking app.
• Set a maximum-amount floor consistent with the plan sold; don't push customers to authorize amounts far above the price.
• Send authorization requests only to people with an active relationship with the store, and don't insist with those who declined.
• Make it clear how to cancel, both in the store and in the banking app.
• Protect the page showing the authorization QR code as carefully as the payment page, and monitor what it displays live.
• Regularly reconcile active authorizations with real contracts and subscriptions.

Customer checklist on the authorization screen

1. Is the recipient the company I signed up with, with the tax ID it gave me?
2. Is the maximum amount per charge consistent with the price of the service?
3. Are the frequency and the first payment date correct?
4. Is there a validity period, and does it make sense?
5. Is pre-approved credit turned off, if I don't want to use it?
6. Will this screen also pay the first charge right now?
7. Have I reviewed my list of Pix Automático authorizations in the app and cancelled the ones I don't recognize?

To see how QR swaps happen at checkout and how to stop them, read Pix protection at checkout.

Proteside protects the moment the QR code appears on your page, whether for a one-off payment or a recurring billing authorization: it checks, on the customer's screen, that the code displayed is the one your store issued and blocks any swap before confirmation, with an alert and evidence. Try it free for 14 days and see how it works.