A Taxonomy of Pix Fraud in Brazil: Attack Methodologies, AI-Driven Amplification, and Defensive Strategies

TL;DR

This paper addresses the growing threat of fraud in Brazil's Pix instant payment system by developing a structured taxonomy of attack methodologies and examining AI's role in both offense and defense. It combines a systematic incident review with expert interviews (Banco do Brasil, Sicredi, Banrisul) to map 15 scams across motivation, medium, and execution, and assesses security controls across 13 institutions. The analysis shows social engineering as the predominant vector, evolving into hybrid, AI-augmented schemes, including remote access malware and impersonation threats, with rapid transaction speeds complicating intervention. The work provides actionable insights for detection, prevention, and response, emphasizing adaptive defenses, continuous user awareness, and faster blocking protocols to bolster Pix resilience.

Abstract

This work presents a review of attack methodologies targeting Pix, the instant payment system launched by the Central Bank of Brazil in 2020. The study aims to identify and classify the main types of fraud affecting users and financial institutions, highlighting the evolution and increasing sophistication of these techniques. The methodology combines a structured literature review with exploratory interviews conducted with professionals from the banking sector. The results show that fraud schemes have evolved from purely social engineering approaches to hybrid strategies that integrate human manipulation with technical exploitation. The study concludes that security measures must advance at the same pace as the growing complexity of attack methodologies, with particular emphasis on adaptive defenses and continuous user awareness.

Figures (1)

• Figure 1: Conceptual taxonomy of Pix fraud