CPF and Pix scams: a small fee still needs verification

What the research establishes

In research published November 9, Lumu describes an operation impersonating gov.br, Brazil’s Central Bank and digital banks through CPF identity information and small Pix charges. The company links nearly 900 domains to activity observed over nearly a year; this is its own assessment, rather than an independently established national count.

The account suggests a business assessment scenario: someone receives a small charge, recognizes their information on screen and treats payment as a routine administrative step. The proposed exercise examines that decision process. It does not assume that official systems or any particular organization have been compromised by the reported operation.

Verify the obligation before evaluating the amount

Imagine an employee receiving a message about a fee to release a benefit or regularize a registration used for work. Internal procedures should make it possible to check the charge through an already known channel. A correct name, document number or familiar appearance is information supplied by the message, rather than independent evidence of an obligation.

The business can provide a simple point of contact for this situation without asking employees to investigate suspicious pages. Support should distinguish a company payment from a personal matter and route each appropriately, collecting only necessary information. This separation also limits the unnecessary circulation of identity documents during the triage process itself.

A small exception can reveal broad authorization

Within accounts payable, examine what happens when an amount falls below the usual approval threshold. The test should establish whether there is still a recorded obligation, an expected recipient and a way to verify the request. Policy can be proportional to value, but the absence of those elements should remain visible before authorization.

Include a case where the description and amount look correct but the beneficiary differs from the approved record. Use a simulation without a real transfer and observe who detects the discrepancy. The central evidence is why the team accepts or rejects the charge, rather than whether it recognizes the appearance of one particular fraudulent page.

Treat correct information as a question, not an endorsement

A screen displaying familiar information can encourage someone to assume they reached the intended service. Training can demonstrate how to verify a request through an independent path, using a demonstration environment and fictional records. The goal is to practice an observable pause before submitting additional information or approving an action, rather than memorizing a disposable website address.

For support teams, prepare questions about the message’s context and actions already taken. Do not request passwords, temporary codes or complete document copies to substantiate the report. If the report suggests payment or unauthorized access, refer it through the appropriate channels and preserve available evidence without expanding the exposure of personal information.

Measure the process that supports a refusal

A useful exercise should show whether someone can find help, obtain understandable guidance and continue working after declining a request. If the correct procedure requires lengthy research or an unavailable contact, the organization needs to fix that friction. Counting only who clicked leaves this operational part of the problem outside the assessment.

Group results by stage: checking the obligation, confirming the beneficiary, deciding on payment and routing an incident report. These observations can improve the process without attributing intent or blame to the person raising the concern. A suspicious small charge can reveal an authorization weakness that also reaches more valuable transactions in the same business workflow.

Frequently asked questions

Related reading

• Billing: verify who receives the payment
• IDScan: limit data sent for identity checks
• External invitations: verify the next access request

Sources and references

• Lumu: CPF and Pix fraud research

Original Pentesty analysis, published November 12, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.