Fake Brazilian PIX dynamic QR-code (BRcode) swap lure — "o QRcode anterior foi invalidado / atualizado pelo banco; utilize o novo QR Code PIX dinâmico." Distinct from pix-boleto-copy-paste-code-latam-phishing (static EMV code + boleto barcode). Detection: qr code pix dinâmico + PIX context. Source: Red-Team R8 multi-agent council C3 (BR payment-rail specialist); BCB PIX dynamic QR 2025.
br-pix-qr-dynamic-swap-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake Brazilian PIX dynamic QR-code (BRcode) swap lure targeting invoice recipients and Brazilian businesses. Distinct from `pix-boleto-copy-paste-code-latam-phishing` (static EMV code + boleto barcode) — this signal specifically targets the *PIX dynamic QR (BRcode)* primitive. The phish narrative arrives in Portuguese as: "O QRcode anterior foi invalidado pelo banco — utilize o novo QR Code PIX dinâmico em anexo para efetuar o pagamento," or "Atualização do QR Code PIX dinâmico: O código anterior foi substituído conforme orientação da Safra Factoring. Por favor utilize o novo QR Code Pix dinâmico abaixo." The attacker attaches or embeds a new BRcode QR where the QR encodes the attacker's Pix key; the victim pays into the attacker account. Detection: "QR(code/Code) (pix) dinâmico" / "QRcode dinâmico/atualizado/pix" / "código QR dinâmico" / "novo QR(code/Code) pix" / "QR(code/Code) foi invalidado/atualizado/substituído" / "atualização do QR(code/Code) pix" AND pix / "pagamento pix" / "chave pix" / "transferência pix" / "cobrança pix" context. Source: Red-Team R8 multi-agent council C3 (BR payment-rail specialist); BCB PIX dynamic QR 2025; FEBRABAN fraud bulletin Q1 2026; IronVest BR banking fraud 2026.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started