Skip to content

Tampered Pix copy-and-paste codes: how the swap works

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · Updated · 4 min read

The Pix copy-and-paste text is the payment instruction itself: whoever swaps it, on the store page, on the device or in a message, diverts the payment while keeping the amount. Stores must ensure the code shown and copied is the one they issued, and shoppers must check the payee's name and CNPJ before confirming.

A tampered Pix Copia e Cola is a payment code that gets swapped somewhere between the store's page and the shopper's banking app. The customer taps “copy”, pastes it into the app and sees the right amount, but the text is no longer what the store issued, and the money goes to someone else. Protection has two sides: the store makes sure the code shown and copied is exactly the one it generated, and the customer checks the payee's name and company ID (CNPJ) before confirming.

What Pix Copia e Cola is

Under Banco Central do Brasil rules, Copia e Cola (copy and paste) exists for situations where scanning the QR code is impractical, such as buying in the phone's own browser. The copied text must be exactly the same string a scanner would read from the QR code, and the feature works for static, dynamic and composite QR codes.

In other words, the copied text is the payment instruction. It tells the bank where the money goes, either directly, through the Pix key, or indirectly, through an address that points to the charge held by the payee's payment provider. Whoever can change that text changes the destination of the payment without touching anything else.

Where the copied content can be swapped

Between tapping “copy” and tapping “confirm” in the bank app, the code passes through three weak points:

  1. On the store's page. The copy button is driven by code running in the shopper's browser. If a malicious script is present on the page, whether from a compromised plugin, a third-party service or a break-in, it can swap the displayed QR and the text sent to the clipboard. The store stays online and looks normal.
  2. On the shopper's device. Malware on the computer can watch the clipboard and replace what was copied. In 2023 Kaspersky described GoPIX, which spread through fake “WhatsApp Web” ads and replaced copied Pix payment codes with others supplied by the criminals' server.
  3. In the delivery channel. When the code arrives by message or email, a hijacked account or a fake message can deliver a different code.

In all three cases the banking app receives a valid code. Nothing in the code itself reveals that it was swapped.

Why shoppers rarely notice

The bank app shows the amount, and the fraudster uses the exact purchase amount. What changes is the payee. The Banco Central manual itself shows, as an example, a confirmation screen with a warning to check the payment details, including the payee's name and CNPJ. That line is what gives the swap away, but it is usually read in a hurry. Brazil's CERT.br sums up the rule for consumers: confirm first, transfer later.

For the store, the damage cascades: the order is never paid, the customer believes they paid, and the complaint lands on the business that received nothing.

How the store protects itself

  • Know what runs on the checkout. List the scripts loaded on the payment page, remove what is not needed and keep the platform, theme and plugins up to date.
  • Create one charge per order. Use a dynamic QR code with a unique identifier and an expiry time, and release the order only when the Pix for that identifier is credited.
  • Tell the customer who will appear in the app. Next to the QR code, show the name and CNPJ the bank will display at confirmation. If a different name appears, the customer knows to stop.
  • Verify what is shown and copied. The most direct protection compares, in the shopper's browser, the QR code and the copied text with the charge the store issued, and blocks any mismatch before payment.
  • Treat complaints as an alarm. Several “I paid and my order was not approved” messages in a short period call for an immediate check of the payment page.

How the customer protects themselves

  • Pay only inside the store's official site or app. Febraban, the Brazilian banking federation, advises checking every payment detail and whether the store is really the one receiving the money.
  • Before confirming, read the payee's name and CNPJ, not just the amount. If it does not match the store, cancel.
  • Be wary of codes received by message and do not install software from dubious sources, including software promoted in ads.
  • If you paid a tampered code, dispute the Pix in your bank's app or official channels as soon as possible. CERT.br lists paying a fake or altered QR code among the cases covered by the Special Return Mechanism (MED). According to Procon-SP, the app should offer a dispute option when you select the Pix, but a refund depends on the fraud being proven and on funds remaining in the receiving account.

To see how QR and copy-and-paste swaps affect online stores, visit the Pix checkout protection page.

The blind spot in this fraud is the shopper's browser, which neither the bank nor the gateway can see. Proteside checks right there, at the moment of payment, that the QR code and the copied code are exactly what your store issued, and blocks the swap before confirmation. You can try it free for 14 days.

Back to blog

Read next