← Articles and guides on fraud, cybersecurity, privacy and AML

Fake boleto scam in Brazil: how to spot it and what to do if you paid

How to tell if a Brazilian boleto is fake: bank code, amount, payee and CNPJ, DDA alerts and PDFs. Real cases and the steps to take if you already paid one.

2026-11-01

The boleto, a barcode payment slip, is still one of Brazil's most used payment methods. Data from clearing operator Núclea cited by Let's Money show 8.2 billion boletos were issued in 2025, up 3% from 2024. That volume makes the fake boleto scam a persistent problem for consumers and companies alike.

How does the fake boleto scam work?

The slip looks real, with the right logo, amount and due date, but the barcode routes the money to an account the criminals control. Typical channels are emails or WhatsApp messages impersonating a school, condo or lender; fake "duplicate bill" websites; malware that swaps the barcode when you print or open the bill, a risk flagged by Nubank and consumer group Idec; and tampered supplier invoices. In one police case, a lottery-shop owner in Mato Grosso do Sul lost R$560,000 to a ring that caused about R$2 million in losses using mule accounts, according to Correio do Estado. In Goiás, state police arrested a suspect after a company paid a tampered boleto of more than R$74,000.

How can you tell if a boleto is fake?

Check	Legitimate	Red flag
First 3 digits	Match the issuing bank (Febraban's Busca Banco tool)	Another or unknown bank
Last digits	Encode the amount (R$79.90 ends in 7990)	Amount mismatch
Payee shown in your banking app	Name and CNPJ of the company billing you	An individual, another company or a misspelled name
Barcode scan	Reads normally	Fails and must be typed

Does DDA protect you?

Largely, yes. DDA (Débito Direto Autorizado) lists in your banking app every boleto issued under your CPF or CNPJ and charges nothing without your approval, as Idec explains. It reached 100 million users in April 2026, and about 60% of boleto settlements already go through it, per Núclea data. A bill that should be under your CPF but is missing from DDA deserves a call to the company through an official channel.

Why is the payee name the key check?

Before you confirm, every Brazilian banking app shows who will receive the money. That screen is your last and best line of defense: if the payee is not the company you owe, or is an individual or a company with a slightly different name, stop and contact the biller through its official website or phone number, never through the message that delivered the slip. A fake boleto can copy logos, amounts and due dates perfectly, but it cannot change the account that the barcode points to.

What to do if you paid a fake boleto

Call your bank at once and ask to block the payment; Nubank notes settlement can take up to one business day.
Tell the company you meant to pay.
File a police report with the slip, receipt and messages.
Request reimbursement in writing from the bank and the company; Brazil's Consumer Defense Code may support the claim, decided case by case, with Procon or small-claims court as next steps.
Scan your computer and phone for malware.

Note that MED, Brazil's refund mechanism, covers Pix transfers, not boletos; see Pix security and MED 2.0. Learn how mule accounts move scam money in mule and pooled accounts, protect company email with SPF, DKIM and DMARC, and follow new cases on the radar.