Protection for CoDi payments
CoDi brings Mexico’s instant payments to QR codes and payment requests (cobros). The infrastructure belongs to the central bank; the screen that displays the payment request is yours, and that’s where the scam strikes.
The payer is about to accept the payment request by scanning the QR code.
Illustrative animation
CoDi · Mexico
With CoDi, the merchant generates a payment request that the payer accepts in their banking app, usually by scanning a QR code displayed on the page. What’s displayed determines the destination and the amount.
How the attack happens without anyone noticing
Payment request QR code swapped
The displayed QR code is replaced with a payment request from another account, for the same amount. The payer accepts it in the app, and the money goes to the scammer.
Tampered payment request details
The payee or reference shown on the payment request is swapped for similar ones, impossible to spot in a quick confirmation.
Manipulated amount
The amount of the displayed charge is altered on screen, diverting the difference.
How it works
Four layers between the scam and your payment
- 1
Record what’s legitimate
Proteside records the legitimate QR code, payee and amount of every payment request your page generates.
- 2
On-screen check
It checks that what the payer sees and scans is exactly what was issued.
- 3
Block before confirmation
A tampered payment request is blocked before it’s accepted in the app.
- 4
Alert and evidence
An alert and a record of the attempt for your team.
The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works
Protection scope
What’s covered
- The CoDi payment request QR code shown on your checkout, payment links and logged-in web areas
- Payee, CLABE and amount shown to the payer
- Content copied with the “copy code” button
- Scripts and extensions that try to alter the payment page
Out of scope
- Printed QR codes or stickers displayed in physical stores
- Scams that happen outside your page (messages, phone calls or fake profiles)
- Settlement between institutions, which is already protected by the payment scheme’s infrastructure
Also protected by the same installation
One installation, every payment method in your checkout.
Frequently asked questions
Isn’t CoDi secure by design?
The rail is secure, but it settles whatever the payer accepts. If the payment request shown on the page is tampered with from the start, the “secure” settlement goes to the wrong account.
My business also accepts cards. Do I need two products?
No. The same installation checks CoDi, cards and every other payment method at checkout.
Protection for CoDi payments
Choose the path that fits your business: start a free trial for your store or book a demo built on your real payment flow.