Brazilian regional / PIX + boleto payment fraud — Portuguese-language email + Brazilian-banking brand (Banco do Brasil / Caixa / Itaú / Bradesco / Nubank / Santander Brasil / Inter / PicPay / Mercado Pago / Stone / PagSeguro / C6 Bank, etc.) + scam narrative + one of: fake PIX "Copia e Cola" EMV QR code, fake boleto 47-digit "linha digitável" barcode, or "PIX errado / enviei por engano / favor devolver" refund narrative. Delivers payment-rail fraud — victim pastes the code into their bank app, funds transfer directly to the attacker; no malware component. Evidence: Kaspersky BR, Exame, Estado de Minas Jan 2026, Banco Pan, IronVest Brazil-Banking-Fraud 2026, BankInfoSec "$130M grabbed via Brazil's Real-Time Payment System." Distinct from Casbaneiro (court-summons + password-PDF + banking-trojan narrative)
pix-boleto-copy-paste-code-latam-phishing
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Brazilian-regional payment-rail phishing exploiting PIX + boleto — the two dominant Brazilian payment instruments. PIX is a central-bank-run real-time instant-payment system launched by Banco Central do Brasil in 2020 that now processes billions of transactions monthly; boleto is a Brazilian bank payment slip with a distinctive 47-digit "linha digitável" barcode. This signal fires on three fraud variants, all in Portuguese-language email tied to a Brazilian banking/utility brand. Variant 1: fake PIX "Copia e Cola" EMV-compliant QR-code payload ("00020126...BR.GOV.BCB.PIX..." — a copy-paste code the victim pastes into their bank app, which then sends the money directly to the attacker). Variant 2: fake boleto 47-digit "linha digitável" barcode paired with "boleto em anexo", "segue o boleto", "pague o boleto", "boleto vencendo hoje" phrasing — the victim pays the boleto in their bank app, funds go to the attacker. Variant 3: "PIX errado / enviei por engano" refund-request narrative — a social-engineering ploy where the scammer claims they sent a PIX transfer in error and requests the victim "return" it via a phishing link. Evidence: Kaspersky BR 2026 boleto-fraud report, Exame + Estado de Minas Jan 2026 coverage, Banco Pan and IronVest 2026 Brazil-banking-fraud reports, BankInfoSecurity 2025 "Hackers Grab $130M Using Brazil's Real-Time Payment System," Febraban Cert.br advisories. This signal is distinct from Casbaneiro (iter 1059 — court-summons + password-protected-PDF narrative that drops banking trojans) because PIX-boleto attacks the payment rails directly via copy-paste codes with no malware component. The fraud artifact is the Brazilian-specific copy-paste code or narrative + Portuguese-language framing + Brazilian brand mention (Banco do Brasil, Caixa, Itaú, Bradesco, Nubank, Santander Brasil, Inter, PicPay, Mercado Pago, Stone, PagSeguro, Getnet, Sicredi, Sicoob, C6 Bank, Will Bank, Neon, utility brands Enel/CPFL/Sabesp/Comgás/Correios) + cold thread (no In-Reply-To). A legitimate boleto or PIX notification from a bank lives inside an existing customer email thread, has the bank's own DKIM signature, and does not instruct the customer to paste a code or return funds to an unverified counterparty.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started