Corporate PIX scam and artificial intelligence.

25/08/2026

The corporate PIX scam: how AI-powered fraud is targeting companies' finances.

13:29

Corporate PIX scam and artificial intelligence.

The corporate PIX scam and artificial intelligence have become a real threat to businesses. As an innovative company, we advocate for the expansion of Artificial Intelligence (AI) as a work tool. However , the popularization of generative AI tools has also brought serious consequences. In fact , these impacts go far beyond productivity.

Criminals have begun using this same technology to create sophisticated fraud vectors, specifically targeting finance departments . Understanding how these attacks work, and what signs usually precede them, has become an essential skill for any area responsible for financial transactions.

The new generation of financial fraud.

The term deepfake describes synthetic content, generated by artificial intelligence, capable of simulating the voice or image of a real person with a high degree of realism. In recent years, estimates from the digital security sector point to a significant growth in this type of fraud , driven by the ease of access to voice cloning tools.

In the corporate environment, this technological advancement has found a particularly vulnerable target: Pix payment processes . The speed and irreversibility of instant transfers make this type of fraud especially attractive, since the transferred amount is usually dispersed within minutes.

How the scam usually unfolds

In most recorded cases, the attack follows a relatively predictable script , which begins long before the fraudulent call:

Collection of publicly available voice and video samples from executives, typically extracted from interviews and social media.
Training a model of vocal cloning, capable of reproducing the executive's voice in real time.
A message written in an urgent tone, directed to the person responsible for payments, requesting an immediate transfer.
The funds received are quickly dispersed into third-party accounts, making any subsequent tracking difficult.

This pattern explains why most successful cases combine psychological pressure with a plausible justification , such as a confidential negotiation or an urgent external meeting.

The two most common types of attack

The first method , known as vishing , a variation of the phishing scam, the classic fraudulent email or message applied to voice calls, is usually the most frequent. The criminal speaks directly to the finance department, using the cloned voice of a director , and requests a transfer to an escrow account.

The second , more sophisticated method combines voice synthesis with real-time video manipulation , simulating the virtual presence of an executive. Cases like this have already resulted in millions of dollars in losses in other countries , where employees authorized transfers after contacts in which other participants were synthetic representations.

Some warning signs can help identify an attempt at this type of fraud:

An unusual, urgent request, outside the normal payment approval process.
Vague justification for waiving the standard verification of a transfer.
Insisting that the conversation not be shared with other team members.

There is also a variation known informally as the " wrong Pix scam ." The criminal deliberately transfers an amount to the company's account and requests a refund via manual transfer, instead of using the official mechanism available in the bank's app.

Protocols that reduce risk

Given this scenario, some security measures prove particularly effective:

Callback verification, interrupting any suspicious calls and resuming contact through the official numbers already registered.
Rules of tiered jurisdiction, requiring double approval and a mandatory waiting period for high values.
Exclusive use of the native return function. in the banking app, avoiding further manual transfers.
Call pattern monitoring in the telephony infrastructure, identifying anomalies that indicate attempted fraud.

How does Next_security fit into this equation with the best solution?

It's worth reiterating: the problem isn't artificial intelligence itself, but the malicious use that criminals make of it . The same technology that today clones voices for fraudulent purposes is the one that, when applied correctly, allows for the detection of anomalous patterns, the automation of verifications, and the protection of real-time operations . The difference lies in who controls the tool and for what purpose, and that's exactly where a layer of protection designed to keep pace with the evolution of these threats comes in.

This is the purpose for which Next_security operates: 24-hour monitoring with real-time alerts, analysis of vulnerabilities specific to the company's financial operations, and a specialized team ready to respond to incidents as soon as an alert is identified.

Furthermore, the solution helps structure verification protocols aligned with best practices , such as the tiered authority rules and call pattern monitoring mentioned above, and keeps the company compliant with the LGPD (Brazilian General Data Protection Law) , reducing legal and reputational risks.

Integrated into the Next_ ecosystem , Next_security also interacts with Next_phone and Next_chat, allowing for cross-referencing of communication data and customer history to identify fraud attempts before they materialize.

Financial security as a culture, not just a technology.

No matter how sophisticated the protection tools are, a company's greatest vulnerability often lies in the automatic trust placed in a familiar voice . Training finance teams to be wary of unusual emergencies is just as important as any technological layer.

From a strategic point of view, companies that treat fraud protection as a cultural process, involving the entire team beyond just the technology department , tend to react more quickly to attempted attacks. As artificial intelligence becomes more accessible for malicious purposes, this shift in mindset becomes a matter of financial survival.