The adulterated QR code
Criminals who get into your email inbox can edit the PIX QR code or barcode inside a real bill — your electricity or phone invoice — before you even open it. The payment then goes to a mule account. There's no virus on your phone and no spelling mistake to spot; the document looks completely genuine.
The only reliable check is the recipient your app shows after you scan.
What to do: after scanning a QR code or barcode, read the recipient name and CPF/CNPJ your app displays before confirming. If it isn't the right company, don't pay — ask the provider for a fresh bill. Prefer paying utilities inside your bank app rather than by scanning an emailed code.
Threat examples
[A genuine-looking electricity bill emailed to you — but the PIX QR code inside it has been edited so payment goes to a stranger's account.]