Procon-SP warns of scam that alters Pix QR codes at online stores

On September 12, Procon-SP, São Paulo's consumer protection agency, issued guidance about a scam that alters the Pix QR code (Brazil's instant payment system), and also the copy-and-paste code, on online stores' payment pages. The message to consumers is simple: before confirming, check the name and company tax ID (CNPJ) of the payee in the banking app, not just the amount. For merchants, the alert weighs differently: the swap happens on the store's own page, and the store is who the customer will blame.

What Procon-SP advised

The guidance, published by Agência SP, the state government's news agency, describes a fraud in which the legitimate payment code is replaced by another that sends the money to criminals' accounts. The advice to consumers boils down to four points:

• Check the payee, not just the amount. The name and CNPJ shown by the bank should match the store or the payment institution processing the purchase.
• Do not complete it if they don't match. An unknown payee with no link to the store or its intermediary is reason to stop the payment.
• Act fast if you already paid. Contact the bank immediately, report the scam and request a dispute through the Special Return Mechanism, MED 2.0.
• Tell the store and keep everything. Receipts and records of contact with the store and the bank help the analysis.

The agency also mentions that the central bank extended an MED deadline from 30 to 80 days. According to the mechanism's official guide, what changed on September 1 was the deadline to contest a refund made through the MED, which now matches the 80 days that already applied to request the return of a Pix.

Why the alert is about the store's page

A few days earlier, on September 9, Kaspersky described a campaign that injected malicious code into Brazilian online stores' checkouts to swap the QR and copy-and-paste codes. By then it had identified 90 small and mid-sized stores affected, all running the same e-commerce platform without up-to-date maintenance.

The detail matters: there is no fake site and no suspicious link. The customer is on the right store, sees the right brand and pays the right amount. The store is not paid, the order stays pending and, days later, the complaint arrives. In the customer's mind, the store failed, and technically it was indeed the store's page that displayed the wrong code.

What stores can do now

1. Show the expected payee. Display on the page the name and CNPJ the customer will see in the bank app; if an intermediary collects for you, name it.
2. Review the payment page. Keep scripts to the essentials and update platform, theme and plugins.
3. Monitor the live checkout. What matters is the code the buyer sees and copies, not what sits on the server.
4. Reconcile orders and payments. An alert for Pix orders pending longer than usual is often the first sign.
5. Lock down admin access with two-factor authentication and rotated passwords.
6. Log every case, with date, amount and the payee shown on the customer's receipt.

How to answer customers

A customer who paid and does not see the order approved needs a fast, concrete answer. A script that works:

• Ask for the receipt and compare the payee with the store's details; if it is someone else, treat it as a possible scam without blaming the customer.
• Tell them to contact their bank right away and request a refund through the MED: the sooner, the more likely there is balance to freeze.
• Provide a record of the support case that the customer can attach to the dispute.
• Fix the cause before reopening Pix sales; otherwise, other customers will fall for the same scam.

Note that Procon-SP's guidance is aimed at consumers but includes telling the store: the customer who lost money will come to you, and how the store responds weighs on their trust. To understand how the swap works, see the Pix protection page.

Proteside protects exactly this moment: it checks, in the buyer's browser, that the QR and copy-and-paste codes displayed are the ones the store issued, blocks the swap before payment and alerts the merchant. It works with any platform and any payment provider, and you can try it free for 14 days for online stores.