Fake boleto and PIX scams: how to spot them

The most common scams against companies

• Tampered boleto
  The boleto arrives through a fake email or is altered by malware on the computer. It looks identical, but the barcode sends the money to another account.
• Supplier account switch
  An email, sometimes from the supplier’s real but hacked account, says that “our bank details have changed.” The next payments go to the scammer.
• Fake executive
  An urgent message, as if from a partner or director, asks for a PIX transfer or a payment outside the normal process, “today, and don’t tell anyone.”
• Fake bank call center
  A call or message claiming there is a suspicious transaction and asking for passwords, codes or the installation of a remote access app.
• Fake QR codes and PIX charges
  Charges for “fees,” “domain renewal” or “trademark registration” with a QR code that pays a stranger.
• Fake WhatsApp profile
  A scammer uses an employee’s or customer’s photo and name on a new number to ask for transfers.

How to check a boleto before paying

1. Check the payee
   On the bank’s confirmation screen, make sure the recipient’s name and CNPJ are exactly those of the supplier. This is the single most important check.
2. Compare the bank digits
   The first three digits of the typeable line identify the issuing bank. They must match the bank shown on the boleto.
3. Check the amount and due date
   A different amount, an unexpected discount or an odd date are warning signs.
4. Prefer DDA
   With DDA (Authorized Direct Debit), boletos issued against the company’s CNPJ show up directly in your online banking, without going through email.
5. Be wary of the channel
   A boleto that came from an unusual email address, with urgency or with a zipped attachment, deserves confirmation.

How to stay safe with PIX

• Before confirming, read the recipient’s name and CNPJ or CPF as shown by your bank.
• Be suspicious of urgency, secrecy and requests outside the normal process, even from “directors.”
• Confirm requests through another channel by calling a number you already had.
• Set PIX limits and hours that fit the company’s routine.
• Never share passwords or SMS codes, and never install apps at the request of whoever called you.

Process rules that prevent most scams

Rule	Why it works
Dual approval for payments	A second person checks before the money goes out
Bank detail changes only after confirmation by a phone number already on file	Stops the account-switch scam, even if an email account has been hacked
Centralized supplier registry	Nobody pays into an account that isn’t in the registry
PIX limits per user	Reduces the maximum loss from a single mistake
MFA on email and online banking	Makes it harder to hack the accounts used in the scam

If your company falls for a scam

1. Dispute it immediately
   Use the dispute button in your bank’s app or call the official call center. PIX’s Special Return Mechanism (MED) allows funds in the destination account to be frozen. Since February 2026, MED 2.0 also traces the money into the accounts it was later moved to.
2. File a police report
   At a police station or through your state’s online police service, with all the transaction details.
3. Keep the evidence
   Receipts, emails with full headers, messages, phone numbers and screenshots with the date and time.
4. Warn the people involved
   The supplier, customer or employee whose name was used. If an email account was hacked, change the passwords and turn on MFA.
5. Investigate the source
   If the boleto was altered on a computer or an email account was hacked, there is a security incident to deal with.

Speed makes a difference
The sooner you file the dispute, the better the chance that the funds can still be frozen. Don’t wait until the end of the day or for internal sign-off to contact the bank.

Quick checklist for the finance team

• Payee checked before every payment
• DDA enabled at the company’s bank
• Dual approval for payments
• Bank detail changes only after phone confirmation
• PIX limits defined
• MFA on email and online banking
• Team briefed on common scams