Protection against the swapped Pix QR code scam
The swapped QR code scam is as direct as attacks get: the customer pays the exact purchase amount, into a mule account. The store never gets paid, and the customer never comes back. Proteside checks the Pix payment on screen before the customer pays.
The customer is about to pay. Everything looks normal.
Illustrative animation
Pix · Brazil
Pix is Brazil’s instant payment system. Your page displays a QR code or a copy-paste code that carries the destination account and the amount, and the buyer’s bank pays exactly what’s in the code. Whoever controls what appears on screen controls where the money goes.
How the attack happens without anyone noticing
QR code swapped on screen
Malicious code replaces the legitimate QR code with another one, for the exact purchase amount, pointing to a mule account. The customer checks the amount, pays, and the money never reaches the store.
Tampered copy-paste code
The customer taps “copy Pix code” and the scam swaps the copied content. The banking app shows a similar-looking name, the right amount and the wrong account.
Altered key or amount
Variations of the scam swap the Pix key on display or raise the amount charged, diverting the difference without anyone noticing at the time.
How it works
Four layers between the scam and your payment
- 1
Record what’s legitimate
Proteside records the legitimate QR code, key and amount of every Pix charge your page generates.
- 2
On-screen check
In the buyer’s browser, it checks that the QR code on screen and the copied code are exactly what was issued.
- 3
Block before confirmation
Mismatched QR code, key or amount: the payment is stopped before the buyer confirms it in their banking app.
- 4
Alert and evidence
You receive an alert with a record of the attempt, and the history is available in your dashboard.
The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works
Protection scope
What’s covered
- The Pix QR code shown on your checkout, payment links and logged-in web areas
- Pix key, recipient name and amount shown to the payer
- Content copied with the “copy code” button
- Scripts and extensions that try to alter the payment page
Out of scope
- Printed QR codes or Pix signs in physical stores
- Scams by message, phone call or fake profile outside your page
- Processing between banks, which is already protected by the Pix scheme
Also protected by the same installation
One installation, every payment method in your checkout.
Frequently asked questions
Don’t banks or Brazil’s Central Bank stop this scam?
No, not this one. The Pix scheme protects the transfer between banks, but it can’t see what the store’s page shows the buyer. If the QR code on screen is already tampered with, the “correct” payment goes to the criminal. That layer is the responsibility of whoever displays the charge.
What about MED, Pix’s Special Refund Mechanism?
MED is a remedy after the fraud, with no guarantee of recovery: the money is usually scattered across accounts within minutes. Proteside works before: it stops the tampered payment from happening at all.
Does it work with Pix charges generated by my payment provider or gateway?
Yes. The check happens on the page where the Pix charge is displayed, whichever provider generated it.
Protection against the swapped Pix QR code scam
Choose the path that fits your business: start a free trial for your store or book a demo built on your real payment flow.