Pix: a scheduled transfer is not money received

Someone holds up a phone: “I’ve paid.” You are about to hand over a product. What should you check: the image they sent, or the money received in your own account?

Pix, Brazil’s instant payment system, appeared in Brazil’s trending searches during our editorial check on 18 October 2026. Search interest does not establish a cyberattack, fraud campaign or system failure. This lesson explains a mechanism documented by the Central Bank of Brazil. The example below is fictional.

The attack: the fake receipt scam

In a fake receipt scam, apparent proof of payment persuades someone to act as though money has arrived. One variant documented by Brazil’s central bank presents a genuine receipt for a scheduled transfer as though it confirmed a completed payment. After the seller releases the product, the payer cancels the scheduled transfer and the seller receives nothing. ^[1]

Scheduling means arranging a transfer for a future time. It differs from completing the transfer and receiving the credit. A document can be genuine without proving the fact someone claims it proves.

The central bank says scheduled-transfer receipts must identify themselves as “Agendamento Pix” with a calendar/clock icon, while completed-payment receipts use a confirmation icon. These distinctions help identify the states. They do not make an image shared by another person independent proof that you received money. ^[1]

The weakness, conditions and consequence

The asset at risk is the product or service released without the expected payment. The exploited weakness is a process and trust failure: accepting a shared image as sufficient evidence and delivering before checking your own account. This is not a claimed software vulnerability, CVE or intrusion into Pix.

For the loss in this example to occur, the recipient must release the goods based on that representation and the expected payment must fail to arrive. Seeing a receipt or receiving a message does not, by itself, establish that a device or account was compromised.

Figure 1. Original CTW teaching model. The shared image and the record independently checked with the recipient’s institution are different sources. No real account or transaction is depicted.

A fictional example: a box on a counter

Imagine an in-person sale of a used item. A box is on the counter. The other person displays a screen with an amount and says everything is settled. But the screen heading says “Agendamento Pix”—a scheduled Pix transfer.

If the box leaves because the image looks convincing, the seller can lose the product without receiving payment. That is a possible consequence of the mechanism, not a report about an identified victim or business.

Defence: check receipt before delivery

1. Open your banking app independently. Use your usual app rather than a link provided by the person claiming to have paid.
2. Find the corresponding incoming credit in your account history. Check the amount and transaction context against the payment you expect. The payer’s display does not replace this check.
3. Keep delivery pending if receipt is unconfirmed. A forecast, scheduled transfer or shared image does not resolve missing confirmation. If the app’s information is unclear, contact your institution through its official channel.
4. Do not make an icon your only test. Even an image saying “completed” can be altered. The important check is receipt of funds displayed by your own bank.

The observable result is that, before releasing the product, you located and checked the corresponding credit in your own app. This reduces reliance on the payer’s claim. It does not guarantee every aspect of the transaction.

Practise without a real payment

Draw two cards: “scheduled” and “received”. Place a paper box beside them. One person presents “scheduled”; the other explains why the box stays on the counter. Then simulate an independent account check and present “received”. Do not send real money, forge a document or test an unsuspecting person as an exercise.

If you suspect fraud

Preserve available messages and records and contact your institution through an official channel. Brazil’s central bank advises victims who sent a Pix payment to report the case to their bank and request return through the applicable procedures. Eligibility and recovery depend on the circumstances; reimbursement is not guaranteed. A seller who released goods without receiving money is not automatically in the same position as someone who transferred money to a fraudster. ^[2]

One habit to retain: check receipt of funds before delivery. An image may represent a future transfer or may have been altered; it does not replace your independent check.

References

1. BANCO CENTRAL DO BRASIL. Conheça novas funcionalidades do Pix e outros aperfeiçoamentos no meio de pagamento. 3 April 2025. Section “Diferenciação entre os comprovantes de transações concluídas e de transações agendadas”. https://www.bcb.gov.br/detalhenoticia/20602/noticia . Accessed 18 October 2026. English explanations here are editorial paraphrases of the Portuguese source. ↩ ↩²

2. BANCO CENTRAL DO BRASIL. Vítima fez um Pix e caiu em um golpe. Meu BC frequently asked questions. https://www.bcb.gov.br/meubc/faqs/p/vitima-fez-um-pix-e-caiu-em-um-golpe . Accessed 18 October 2026. ↩