The forged boleto
You receive a boleto (a payment slip) — by email, message, or paper — for a service you really do use, but the beneficiary's account has been swapped to the criminal's. The layout looks perfect.
The defence is built into your banking app: when you go to pay, the app shows you who will receive the money.
What to do: before confirming, check that the beneficiary shown by your app (the name and CPF/CNPJ) matches the company you mean to pay. If they don't match, stop and contact the company directly. Turning on DDA makes your real boletos appear inside your bank app.
Threat examples
Tap the outlined parts of the message to see the red flags
Your monthly invoice is attached as a boleto. Please pay by the due date to avoid service interruption. [boleto with a stranger's account as the beneficiary]