Skip to content

Pix security checklist for online stores

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

To protect Pix, a store should use one dynamic QR code per order with an expiry and reconciliation by identifier, keep the checkout lean and monitored, tell customers which name and CNPJ the bank app will show, and keep an incident playbook that includes guiding customers to dispute through MED.

An online store protects Pix on four fronts: it configures charges so that every order has a unique, time-limited code that is easy to reconcile; it watches the page where that code appears; it teaches customers to check who is being paid; and it has a ready-made playbook for the day something goes wrong. The list below turns those fronts into items you can check one by one.

1. Charge configuration

  • Use dynamic QR codes, one per order. Create the charge through your payment provider's or gateway's Pix API. Banco Central do Brasil's manual provides for a transaction identifier, an expiry time and data signed by the payee's provider.
  • Set the expiry. If none is given, the charge is valid for 24 hours. Choose a window that matches your buying journey.
  • Reconcile by identifier. Release an order only when your provider confirms the credit for that identifier, for the right amount, ideally through an automatic notification (webhook).
  • Never accept a receipt as proof. Brazil's CERT.br warns about fake payment receipts and advises checking that the money actually reached your account before handing over the goods.
  • No fixed key at checkout. A Pix key or static QR code offered as an alternative is easy to imitate and impossible to reconcile per order.
  • Know how your business appears. Make a small real payment to the store and see which name and company ID (CNPJ) the banking app shows. That is the name customers must recognise.

2. Page protection and monitoring

  • A lean checkout. Keep only essential scripts on the payment page authorise each one and record why it is there, in line with PCI DSS requirements 6.4.3 and 11.6.1 for payment page scripts.
  • A protected admin panel. Two-step verification for every administrator, unique passwords and periodic review of who has access.
  • Up-to-date software. Keep the platform, theme and plugins current; remove whatever is not used.
  • Watch the page your customers receive. Monitor the checkout as it reaches the browser, with alerts for new or changed scripts, and confirm that the QR code and copy-and-paste text shown are the ones the store generated.
  • Track the numbers. Every day, compare Pix charges created, Pix payments received and orders. A jump in unpaid charges or in “I paid and it was not approved” messages deserves immediate investigation.

3. Customer communication

  • Say who will be paid. Next to the QR code and in the order email, state the name and CNPJ that will appear in the bank app and ask customers to check it before confirming.
  • Make clear what the store never does. The store does not request Pix by message, does not switch keys and does not send codes outside the site. CERT.br advises ignoring QR codes received through messages.
  • Offer a fast, official channel so customers can ask questions before paying and report anything that looks odd.
  • Refund through the return function. Always return money to the originating account, using the return feature in your provider's app or system, never to another key someone gives you. Under Banco Central's guide, the payee may return funds on its own initiative within 90 days of the transaction.

4. If an incident happens

  1. Contain it. Take Pix offline or put the checkout into maintenance and disable the suspicious component.
  2. Preserve evidence. Keep copies of the page, scripts and logs, and list the affected orders with date, time and amount.
  3. Find the way in. Review recently changed plugins, themes and scripts, unknown administrator accounts and admin logins. Change every password and access key.
  4. Inform your partners. Notify your payment provider or gateway and, if card data may have been exposed, your acquirer.
  5. Guide affected customers. Ask them to dispute the Pix in their bank's app or official channels as soon as possible to trigger the Special Return Mechanism (MED). Under Banco Central's guide, a recovery can be opened for transactions up to 80 days old, and any refund depends on funds remaining in the traced accounts. Advise them to keep receipts and file a police report, as CERT.br suggests.
  6. Communicate openly about what happened, who was affected and what was fixed.
  7. Review this checklist and close the gap that allowed the attack.

What the store needs to know about MED

MED is not a card chargeback. Banco Central's guide makes clear that commercial disagreements, such as a late delivery or a product the buyer did not like, do not justify a fraud return, and that good-faith sellers cannot have their accounts debited because of the mechanism. If the store receives a legitimate Pix and it is returned through a fraudulent dispute, the store can contest that return through its own provider within 30 days, under the version of the guide in force this month.

To understand the layer that protects the moment of payment, see the Pix protection page.

Most of this checklist is about process; one item depends on seeing inside the shopper's browser. Proteside takes care of it: at the moment of payment it checks that the QR code and copy-and-paste text displayed are exactly what your store issued, blocks any swap and alerts you immediately. Try it free for 14 days.

Back to blog

Read next