Pix security rules: the central bank's part and the merchant's

The Pix security rules set by Banco Central do Brasil protect accounts, devices, keys and the path money takes between institutions. They do not reach the store's payment page: if the QR code or the copy-and-paste code is swapped there, the Pix goes through as a valid payment to the wrong account, and no rule in the scheme stops it before confirmation. That part still belongs to the merchant.

Knowing where the line falls helps merchants stop expecting protection the bank does not provide, and focus on what only they control.

What the central bank's rules protect

Value limits

Since 2021, Resolution BCB No. 142 has required institutions to cap transfers between individuals made between 8 p.m. and 6 a.m. at R$1,000 in total, Pix included. Limit increases requested through electronic channels can only take effect after at least 24 hours. Since November 1, 2024, a Pix above R$200 can only be sent from a phone or computer previously registered with the bank; on an unregistered device, the daily limit is R$1,000.

Risk management at institutions

Resolution BCB No. 403 (2024) requires every Pix participant to run a fraud risk management solution that uses security data from the DICT, the key directory operated by the central bank, and flags transactions that are unusual for the customer's profile. Institutions must check customers' fraud markings at least every six months, may reject transactions with well-founded suspicion of fraud and may place a precautionary hold on incoming funds, with up to 72 hours to analyse the case.

Keys and payee confirmation

Since July 1, 2025, Pix key data has been checked against the federal tax registry whenever a key is created or changed, and keys with mismatched names or irregular tax IDs are deleted. The user-experience rules also require the payer's banking app to show, before confirmation, the payee's name and masked individual tax ID or company tax ID (CNPJ).

Refunds through the MED

The Special Return Mechanism (MED) lets the payer's institution request recovery of funds in fraud cases, for transactions up to 80 days old. Receiving institutions block the available balance and have up to seven calendar days to analyse. According to the central bank's schedule, MED 2.0, which follows the money beyond the first account, has been mandatory since February 2, 2026.

What falls outside those rules

All of these layers work from the moment the buyer taps “pay” onwards: account, device, institution, settlement. What the store's page displays before that is not checked by anyone in the scheme.

• The swapped QR points to a real account. If malicious code replaces the QR on the page, the destination is usually a mule account, with a valid key and a name that passes the tax registry check.
• Limits are not triggered. The amount is that of an ordinary purchase, from the usual device, at a normal hour.
• Checking the name depends on the buyer. The app shows the payee, but the customer has to read it and know which name to expect.
• The MED is not a guarantee. A refund depends on there being balance in the affected accounts, and the scam is usually discovered days later, when the order is not approved.

For the store, the loss is twofold: the money never arrives and the customer blames the store.

What remains the merchant's responsibility

This is not a Pix regulatory duty; it is what only the merchant can control. A practical checklist:

1. Create every charge through your payment provider and confirm payment only from its notification, never from a receipt sent by the customer.
2. Show on the page the name and CNPJ that will appear in the bank app. If your legal name differs from your brand, or an intermediary collects on your behalf, say so clearly.
3. Cut the scripts on the payment page and keep platform, theme and plugins up to date.
4. Monitor the live page, checking that the QR displayed and the code copied are exactly the ones the store issued.
5. Reconcile payments and orders and set an alert for Pix orders pending longer than usual.
6. Prepare customer service for “I paid but my order was not approved”: tell the customer to contact their bank right away and keep all records.
7. Keep invoices and proof of delivery, useful if an improper refund ever needs to be contested.

Where PCI DSS comes in

Pix has no equivalent rule for the store's page, but cards do. For merchants that also accept cards, PCI DSS requirements 6.4.3 and 11.6.1 require payment page scripts to be authorised and inventoried and unauthorised changes to the page to be detected. The same discipline, applied to the Pix screen, covers exactly the gap the central bank's rules leave open. See how this works in Pix protection.

Proteside covers that stretch: it checks, in the buyer's browser, that the QR and copy-and-paste code are the ones the store issued, blocks any swap before payment and produces PCI DSS evidence, with any platform and any payment provider. You can try it free for 14 days and see how it works for online stores.