Tampered boleto: how the payment line is swapped on screen

In the tampered boleto scam, the boleto (Brazil's bank payment slip) issued by the store is genuine, but what appears on the customer's screen is not. Malicious code swaps the payment line, a sequence of digits customers can type into their bank app, and the barcode for numbers from a criminal's boleto, almost always keeping the amount and due date. The bank accepts the payment because the fake boleto is also a valid boleto, just for a different payee. The defence is to check who will receive the money before confirming, and to protect the page where the boleto is displayed.

How the payment line is swapped

The payment line is the sequence of digits that represents the barcode. Following the technical description institutions use, the first three digits identify the issuing bank, the fourth the currency, the next 25 are defined by the bank and identify the charge, and the last ten carry the amount. Changing the middle digits is enough to send the payment to another account; amount and due date can stay identical.

Research published in 2014 shows how this happens on the payer's computer:

• Browser extensions. Kaspersky researchers found extensions, including some in official stores, that watched pages with boletos and replaced the numbers as they were displayed.
• Code injected into the browser. Malware that looked for words such as “boleto” and “pagamento” and swapped the line for another one received from the criminals' server. Some made the barcode unreadable to force the customer to type the altered line.
• Home routers with tampered settings, redirecting traffic to manipulated pages.
• Fake reissue sites, promoted on search engines, that reissued overdue boletos with the scammer's details.

The scale is striking. In 2014, RSA described a single gang that may have compromised 495,753 boleto transactions over about two years, across more than 30 banks, from 192,227 infected computers. The estimated value reached US$3.75 billion, with no confirmation of how much was actually paid.

Why boleto registration is not enough

Since 2018, every boleto must be registered on the banks' centralised platform before it can be paid, and banks refuse anything not in that database. That does not stop a scammer from using a boleto registered to a payee they control. To the system, the swapped boleto is legitimate; the person who notices the difference is whoever reads the payee's name before confirming.

For the store, the effect is familiar: the order goes unpaid, the customer says they paid and shows the receipt, and suspicion falls on the brand.

What customers should check before paying

Guidance from Febraban, the Brazilian banking federation, points to four simple checks:

• Payee. Every payment channel shows the payee's name before confirmation. If it is not the company you bought from, do not proceed.
• Bank code. The first three digits must match the bank shown on the boleto.
• Amount and due date. They must match the purchase.
• DDA. Customers who enable DDA (Débito Direto Autorizado, Brazil's electronic boleto presentment) at their bank receive boletos issued to their tax ID straight from the banks' database, and can compare.

Febraban also advises against printing boletos, since the swap can happen at that step, and recommends the PDF file sent by the issuer.

Checklist for stores that issue boletos

1. State on the page and in the order email the payee name, CNPJ and issuing bank the customer will see in the app.
2. Use a recognisable payee name. If your legal name differs from your brand, say so next to the boleto.
3. Provide the PDF generated by your own system and offer reissues only in the customer area, never through third-party links.
4. Register the boleto with the buyer's correct tax ID, so it shows up in their DDA.
5. Cut the scripts on the boleto page and keep platform, theme and plugins up to date.
6. Monitor the live page, checking that the line displayed and copied is the one issued.
7. Reconcile paid boletos and orders, investigating anyone who says they paid but does not appear as settled.

To see how this check works in practice, read about boleto protection.

Proteside protects that moment: it records the payment line, barcode and payee of each boleto issued and checks, in the buyer's browser, that what is displayed or copied is exactly that, blocking the swap and alerting the merchant. It works with any platform and any issuer, and you can try it free for 14 days for online stores.