Skip to content

Pix checkout scam: how the QR code is swapped and how to stop it

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · Updated · 5 min read

In the Pix checkout scam, malicious code on a legitimate store's payment page swaps the QR code and the Pix Copia e Cola code for others with the same amount, so the customer pays and the store gets nothing. Effective protection checks, on the payer's screen, that the displayed code is the one the store issued and blocks the swap before confirmation.

The checkout scam targeting Pix (the instant payment system run by Banco Central do Brasil, Brazil's central bank) happens inside legitimate online stores. Malicious code planted on the payment page swaps the QR code and the Pix Copia e Cola code (the text version of the payment code that the customer copies and pastes into their banking app) for different ones, for the exact purchase amount, that send the money to the scammer's account. There is no fake site and no suspicious link. The customer pays, the store gets nothing, and both only find out days later.

This guide brings together what is known about the scam and points to the articles that cover each part in detail.

How the scam works

  1. The store creates a legitimate Pix charge, with the correct QR code and Copia e Cola code.
  2. Code running on the page, coming from a breach, a compromised plugin or theme, or a third-party script, replaces the QR code on screen and the text delivered by the copy button.
  3. The customer pays the right amount, sees a plausible name in their banking app and confirms.
  4. The money lands in a pass-through account and is spread out within a few hours.
  5. The order stays pending. The complaint arrives when the product is never shipped.

The same mechanism has been used for years to steal card data and is known as Magecart. See Magecart: what it is and how to protect your online store.

The September 2026 case

On September 1, the independent researcher known as eremit4 disclosed the campaign. Kaspersky confirmed 90 small and mid-sized stores hit, all on the same open-source e-commerce platform and all behind on maintenance, and reported that the scam had been active since June 2025. The code swapped the QR code and the Copia e Cola code and, when the customer chose credit card, copied the card details. On September 12, Procon-SP (the consumer protection agency of São Paulo) published guidance for consumers about the scam. The full analysis is in Magecart on Pix.

Where the QR code can be swapped

  • On the store's page. It hits every customer who chooses Pix. This is the September 2026 case and the subject of this guide.
  • On the customer's device. Malware and browser extensions swap the copied or displayed code, at any store. See malware that swaps the Pix QR code: on your device or in the store?.
  • In a message. A QR code or Pix key sent outside the website by someone posing as the store.

The same applies to the Copia e Cola text, which is the payment instruction itself. See tampered Pix Copia e Cola code.

Why traditional defenses miss it

Firewalls, anti-fraud tools and payment gateways protect servers and transactions. The gateway generated the right QR code. The anti-fraud tool sees a valid transaction, from a real customer, for the right amount. The swap happens later, in the shopper's browser, along with everything else the page loads.

Even tools built for PCI DSS, which list the scripts on the page and alert when a new one appears, can stay silent if the malicious code sits inside a file that was already approved. We explain this in why a script inventory does not detect a swapped QR code.

The warning signs

For merchants:

  • More orders with Pix pending or abandoned, with no drop in checkout visits.
  • Customers with a completed receipt in the name of another company or person.
  • Files changed with no release, unknown administrators in the admin panel.

For customers:

What customers should do

  • Before paying: check the payee's name and CNPJ (Brazil's company registration number) in the banking app. See altered Pix QR code: how to tell before you pay.
  • If you already paid: use the Contestar Pix (Dispute Pix) option in your banking app the same day, tell the store and keep the receipt. The deadline under MED (Mecanismo Especial de Devolução, the Pix refund mechanism for fraud cases) is 80 days, but a refund depends on money still being in the account. See wrong Pix payment online: mistake or scam.

What merchants should do

  1. Update the platform, theme and plugins and remove what you don't use.
  2. Protect the admin panel with two-factor authentication and review who has access.
  3. Cut checkout scripts down to the essentials, each with an owner and a reason.
  4. Monitor the live page as the customer sees it. See how to monitor checkout changes.
  5. Compare the code displayed with the code issued and block any mismatch before confirmation.
  6. Track the pending Pix rate every day.
  7. Prepare customer support for the customer who paid and got nothing. See the customer paid by Pix and the order was not confirmed.

It is not only Pix

The same code that swaps the QR code can swap the linha digitável (the payment number) of a boleto (the Brazilian bank payment slip), the address of a stablecoin wallet or the QR code of other instant payments, and it can copy credit card and debit card details. Protecting the checkout means protecting every payment method shown on it.

Where Proteside fits in

Proteside is a cybersecurity layer that checks, on the payer's screen, whether the payment details are the ones the seller issued, and blocks the swap before confirmation. It is not an anti-fraud tool, a firewall or a gateway: it works alongside them, on any platform and with any provider. See Pix protection at checkout and how it works.

Back to blog

Read next