How Pix Works: Payment Methods, Pix Keys, and How Your Money Is Protected

September 1, 2026 · 13 min

Pix moves money mainly two ways — a QR code (scanned with your camera, or copied and pasted as text, sometimes called a “Pix link” or Pix Copia e Cola) or a Pix key typed directly into the app — and every single one of those payments is checked in real time against a Central Bank directory that confirms the recipient’s name before your money leaves your account. That directory, plus a formal refund process for fraud cases and a set of network-wide fraud protections, is what makes Pix one of the more tightly verified instant payment systems in the world — not just the fastest. Here’s how each piece actually works, and what protects you when you use it.

What are the 3 ways to initiate a Pix payment?

Every Pix transaction falls into one of three formats:

Static QR code — a fixed code, often printed on a sticker at a counter or market stall, that doesn’t have an amount built in. You scan it, then type in how much to pay.
Dynamic QR code — generated on the spot for a specific transaction, with the amount already embedded. This is what you’ll usually see at a restaurant or store checkout — you just scan and confirm. Either QR type can also be shared as a text string instead of an image — known in Brazil as Pix Copia e Cola — which you paste directly into the app instead of scanning, common for online payments or invoices sent by chat.
Manual key entry — no QR code at all. You type in the recipient’s Pix key (a phone number, email, or similar identifier) directly into the app.

All three route through the exact same verification system behind the scenes — the difference is purely how the recipient’s information reaches you.

What is a Pix key, and how many types exist?

A Pix key is a stand-in for a full bank account number — a shortcut alias that lets someone pay you without ever seeing your account or agency number. There are four types:

Random key (EVP) — a system-generated string with no personal information in it
Phone number
CPF or CNPJ (Brazilian tax ID for individuals or businesses)
Email address

An individual can link up to five different keys to the same account, while businesses can register up to twenty. A key can only ever point to one account at a time, though it can be transferred between institutions if the owner requests it — a process the Central Bank calls “portability.”

One detail that matters for trust: you can’t just register any phone number, email, or CPF as your Pix key — the bank has to confirm you actually own it first. A phone number key requires a verification code sent by SMS; an email key requires a confirmation link; and a CPF or CNPJ key is checked directly against Receita Federal (Brazil’s tax authority) records before it’s accepted. In other words, nobody can register your phone number or CPF as their Pix key just because they know it.

How does Pix know who you’re paying? The DICT, explained

This is the part most guides skip, and it’s the most important one. Every Pix key you’ve ever seen — CPF, phone, email, random string — is registered in a database called the DICT (Diretório de Identificadores de Contas Transacionais), which is built and operated directly by Brazil’s Central Bank. When you scan a QR code or type in a key, the DICT is what looks up that key in milliseconds and returns the actual account and the registered name of the person or business behind it — which is exactly why you see a name on the confirmation screen before you approve anything.

The scale of it is hard to overstate: according to the Central Bank’s own 2023—2025 Pix Management Report, more than 920 million Pix keys are registered in the DICT, used by roughly 148 million individuals — about 86% of Brazil’s adult population — and 12 million businesses, or 51% of all active companies in the country. It’s the single reason a payment can be instant, irreversible, and still traceable to a real identity — a combination most payment systems don’t manage to pull off at the same time.

Is Pix more secure than instant payment systems abroad?

It’s a fair question, especially if you’re used to Venmo, Zelle, or a European bank transfer, and it’s genuinely one of the more interesting things about Pix: Brazil built payee verification into the system from day one in 2020. Most other regions are still catching up.

Europe: A “Verification of Payee” check — confirming that a recipient’s name matches their account before you send money — only became mandatory for euro-area banks on October 9, 2025, under the EU’s Instant Payments Regulation. Banks outside the eurozone have until July 2027 to comply. That’s a five-year gap behind what Pix has done by default since launch.
United States: There’s no universal, consumer-facing equivalent. The Federal Reserve’s FedNow system offers “Payee Name Verification” only as optional.

None of this means Pix is scam-proof, no payment system is. It just means the identity check most countries are only now making mandatory has been standard in Brazil for years.

What happens if you’re scammed or send money by mistake? The MED

Even with the DICT in place, fraud happens, Brazil’s banking federation (FEBRABAN) ranked Pix-related scams as the fourth most common type of fraud in the country in its 2025 research. That’s exactly why the Central Bank built the MED (Mecanismo Especial de Devolução), a formal refund mechanism, separate from your bank’s regular customer service.

Most banks now run this as a self-service flow directly in the app: you locate the transaction, open a dispute with a few taps, and track its status without needing to call anyone.

You have up to 80 days after the transaction to open a MED request. Since a 2025 update to the mechanism, known informally as “MED 2.0”, institutions can trace funds through additional accounts in the chain to identify so-called “conta laranja” (mule accounts) and block the entire chain at once, not just the first account that received the money, extending the investigation window to as much as 11 days when needed.

Worth knowing before you rely on it: the MED only recovers money that’s still sitting in the recipient’s account when the block happens, if it’s already been moved or withdrawn, there’s nothing left to return. It also doesn’t cover typos (sending to the wrong key by mistake) or commercial disputes, like a product that was never delivered, only confirmed fraud, scams, or bank-side errors. The real takeaway: checking the recipient’s name on the confirmation screen before you send is worth far more than any refund process after the fact.

Ready to see how this looks in practice? Download Lokal and every payment screen shows you exactly who you’re paying before you confirm, the same protection built into Pix itself, without needing a CPF to access it.

What is the Brazil beach vendor card machine scam, and how do you avoid it?

It’s one of the most reported payment scams against tourists in Brazil: a vendor overcharges you on a card machine (maquininha) by 10 to 100 times the price you agreed on — a R$15 coconut water quietly becomes a R$1,500 charge, or a $3 souvenir turns into a $300 hit on your card statement. Both the U.S. Embassy and the UK’s FCDO travel advisories have flagged card fraud, including manipulated payment terminals, as a recurring issue in Brazil’s beach destinations, especially around Copacabana and Ipanema in Rio de Janeiro.

Here’s how the scam typically plays out:

The vendor turns the screen away from you, or angles it so you can’t read the amount before tapping your card or entering your PIN.
The display flashes the total for less than a second, too fast to actually check.
The machine has a cracked or “broken” screen, so you’re told to just trust the number the vendor says out loud.
If you object after the fact, the vendor claims the payment “didn’t go through” and runs it again, sometimes charging you twice.

By the time you see the real amount on your bank statement, days later and often in a different currency, there’s no vendor to go back to.

This is exactly the scenario Pix removes from the equation. You’re never handing your card to someone else’s machine, you’re holding your own phone, and the exact amount in reais, plus the registered name of who you’re paying, shows up on your own screen before you confirm anything. Nobody can flash a number at you or hide a display, because there’s no shared device to manipulate in the first place. The habit that protects you: always read the amount and the recipient’s name on your own phone, at your own pace, before you tap confirm and never take a vendor’s word for what a card machine just charged.

Want to know more about how to pay in Brazil? Check out our complete payment guide for tourists.

What other protections apply automatically, behind the scenes?

On top of the DICT and the MED, the Central Bank requires participating institutions to run a few additional layers of protection, designed less around a single transaction and more around cutting off fraud at the source:

Fraudster blocking, enforced where it counts and visible everywhere else: once a user is formally marked as a fraudster, the institution where that person actually holds their account must block them from sending or receiving any further payments, except for returning stolen funds, which is still allowed, and from registering, porting, or reclaiming any Pix key. Every other institution in the network can see that marking the moment they look up the same key, CPF, or CNPJ, and Brazil’s Central Bank requires them to weigh it in their own fraud controls before authorizing a transaction, so the information travels network-wide even though the block itself sits with one institution.
Ongoing validation against tax records: it’s not just a one-time check at registration, every CPF or CNPJ key is continuously cross-checked against Receita Federal records. If a business is dissolved or a CNPJ becomes invalid after the key was already created, the key gets pulled from the directory automatically, and no new key can be registered on it until the mismatch is resolved.

None of these protections are something you configure yourself, they run in the background and exist purely to make a compromised account or a stolen key less useful to a criminal, regardless of which single transaction is being watched.

Pix is bigger than a QR code — a quick look at the rest of the ecosystem

Everything above covers how you, as a traveler or nomad, will actually use Pix, but it’s worth knowing that scanning a code or entering a key is just the entry point into a much larger system. A few other Pix formats exist that you’re likely to encounter indirectly, even if you never use them yourself:

Pix Automático: a recurring-payment format launched in mid-2025, built for subscriptions and bills with fixed or variable amounts, similar to a direct debit. It’s how a growing number of Brazilians now pay for streaming services, gym memberships, or utility bills.
Pix Agendado Recorrente: a scheduled, repeating transfer for a fixed amount, mandatory for institutions to offer since October 2024. It’s commonly used for rent and other regular payments between individuals, exactly the kind of payment a landlord might expect from a long-term tenant.
Pix Saque and Pix Troco: ways to withdraw cash using Pix instead of a card, either at a participating store’s till (Troco, like cashback at checkout) or at specific ATMs and agents (Saque). It’s a reminder that in Brazil, Pix has effectively replaced the debit card as the default way people move money, cash included.
Bolepix: a boleto (Brazil’s traditional printed or digital payment slip, used for rent, tuition, and utility bills) that now carries a Pix QR code alongside the usual barcode. It can be paid either the old way, through the barcode, or instantly by scanning the QR code with Pix, which is exactly the format you’ll run into if you ever pay rent or a subscription in Brazil.

None of these change how you pay as a Lokal user, you’ll still be scanning codes and using keys for one-off payments, but they explain why almost every Brazilian, from a beach vendor to a landlord to a corner store, treats Pix as the default rather than an alternative.

How does this all show up when you actually pay?

None of this is something you manage manually, it happens automatically, behind a screen that just shows you an amount and a name. That’s the entire design philosophy of Pix: bank-grade verification, without the user needing to understand any of the machinery behind it. If you’re paying through Lokal specifically, the confirmation screen carries that same principle over: you see the recipient’s name and the exact fee before you approve anything, whether you’re paying a kitesurf instructor in Jericoacoara or splitting a dinner bill in São Paulo.

FAQ

What’s the difference between a Pix key and a QR code? A Pix key (CPF, phone, email, or random string) identifies an account permanently. A QR code is just a delivery method for that same information, scanning it fills in the key and, often, the amount automatically.

Can someone steal my money just by knowing my Pix key? No. A Pix key only allows someone to send you money, it can’t be used to withdraw funds from your account or make a payment on your behalf.

How long does a Pix refund take if I’m scammed? Once a MED request is confirmed as fraud, the receiving bank has up to 96 hours to return the funds, but recovery depends entirely on whether the money is still in the recipient’s account when it’s blocked.

Is it safe to use Pix as a foreign tourist without a CPF? Yes, when accessed through a compliant provider like Lokal. Lokal partners with a regulated payment institution that’s an authorized Pix participant, so the underlying Pix rails, DICT verification, and MED protections are the same ones every Brazilian account uses; Lokal simply removes the CPF requirement to reach them.

What happens to someone once they’re identified as a Pix fraudster? Once a user is formally marked as a fraudster in the Central Bank’s system, the institution where that person actually holds their account is required to block them from sending or receiving any further Pix payments. Every other institution in the network can see that marking whenever they look up the same key, CPF, or CNPJ, and they’re required to factor it into their own fraud controls when deciding whether to authorize, hold, or reject a transaction.

Is the Brazil beach vendor card machine scam real? Yes, it’s one of the most commonly reported payment scams against tourists, flagged by both the U.S. Embassy and the UK’s FCDO. Vendors overcharge by 10 to 100 times the agreed price using a manipulated or hidden card machine display. Paying with Pix removes the risk, since you confirm the amount and recipient on your own phone instead of trusting the vendor’s terminal.

Now that you know how Pix works and how safe it is, pay like a local — download Lokal.

More questions about how Pix payments work, refunds, or account security? Check our full FAQ.