Pix scams and booking fraud: how to protect your hotel

Why Pix became a fraud vector in hospitality

Pix solved a real problem for small and mid-sized hotels: taking a booking deposit without relying on a card machine, a gateway or card fees. A good share of direct bookings made by phone, Instagram or WhatsApp now go through a Pix key given out by the front desk or reservations team. It is fast, simple to receive and usually low-cost for the hotel, and that is exactly why it became a target.

The problem is not Pix itself. It is that, unlike a booking engine with an integrated checkout, a Pix charge sent manually has no automatic confirmation built into the hotel's workflow. Someone on the team decides, on the spot and under pressure that "the booking will get away", whether what is on the phone screen is real money. That gap is exactly what social engineering scams exploit.

Frequent scams against hotels

Fake or edited receipt: the guest (or someone posing as a guest) sends an image of a Pix receipt with the amount, the date and even an authentication number, but the transfer never existed or never reached the hotel's account. Image editing apps make these receipts visually identical to real ones. No receipt sent by a guest is, on its own, proof of payment.

A scheduled Pix is not a received Pix: the scammer shows the confirmation screen for a Pix scheduled for a future date. The screen looks like a payment confirmation, but no money has entered the hotel's account, and the scheduled transfer may never go through, either because it was cancelled or because there were insufficient funds. The front desk releases the booking or the benefit on the strength of a transaction that never happens. A booking is only paid when the hotel's bank, or the system integrated with it, confirms receipt.

Swapped Pix key (the fake contact centre scam): scammers create profiles, websites or WhatsApp accounts that imitate the hotel, often copying photos and the name from real profiles found on Instagram or Google Business Profile, and reply to guests looking for direct contact with a Pix key that does not belong to the hotel. The guest pays, believes they have booked, arrives at check-in and finds that the hotel never received anything and had no record of the booking. The reputational damage falls on the hotel, even though the team is not directly at fault. That is why it is worth advising guests, before confirming payment, to check the recipient name their banking app shows, not just the hotel name that appears in the contact or profile.

The problem does not end with Pix: fraudulent bookings with a third party's card through an OTA. The same principle (do not trust what has not been verified) applies to cards. A fraudulently obtained card is used to book on platforms such as Booking.com or Expedia. The booking is approved as normal, but weeks later the real cardholder disputes the charge, and the hotel loses the room revenue plus a chargeback fee, even though it has already provided the service.

Social engineering for refunds or cancellations: someone calls posing as a guest, as management from another property or even as a representative of the OTA itself, creating urgency so that the front desk authorises a refund, a penalty-free cancellation or the release of a room without the expected payment. It works best on new or seasonal teams, or teams without a clear procedure for who can approve exceptions.

"I overpaid, send back the difference": the scammer sends a receipt for more than the agreed amount, or claims a Pix was made by mistake, and asks the hotel to return the difference to another key. Even when the money did come in, the refund should be made using Pix's own return function, which sends the money back to the originating account, and never by a new transfer to a key given in the conversation. This is also the guidance from the Banco Central do Brasil (Brazil's central bank).

Supplier Pix key swap: an email or WhatsApp message arrives, apparently from a supplier, agency, event organiser or service provider, giving a "new Pix key" or new bank details for the next payment. Sometimes the message comes from a genuine account that has been compromised. Here it is the hotel itself that sends money to the scammer, and the loss tends to be larger than a single night's revenue.

Why hotels are a particularly easy target

Some factors make hotel operations more exposed to this kind of scam than other businesses that also take Pix payments:

• High seasonal staff turnover: high season means temporary hiring for front desk and reservations, often without the same training as year-round staff.
• Pressure not to lose the booking: the sales culture of "confirm quickly before the guest gives up" creates exactly the urgency the scammer wants to exploit.
• Informal channels outside the PMS: bookings closed over WhatsApp or Instagram Direct rarely have the same record and audit trail as a booking made through the booking engine or an OTA.
• A digital presence that is easy to clone: photos of the hotel, its phone number and even the names of staff circulate publicly on social media and Google Business Profile, giving scammers everything they need to build a convincing fake profile.

How to protect the operation without slowing down service

Confirm from the statement, never from the screenshot. No booking, benefit or room release should depend on an image sent by the guest. Confirmation must come from a source the hotel controls: the bank statement or banking app, the dashboard of the payment institution or PSP (payment service provider) used to receive Pix, or the automatic confirmation from a system integrated with them. This should be written down as a rule, not left as implicit common sense.

When volume justifies it, automate reconciliation. The safest control is not asking the front desk to check the statement faster, but reducing the need for human interpretation. A Pix charge generated for each booking, with its own QR code or payment code, lets the finance system or the PMS recognise the payment and match it to the booking automatically, with no screenshots or manual checking. Not every hotel needs this: a guesthouse that receives a few Pix bookings a week can check the statement manually without any problem. For a hotel with a significant volume of direct bookings, however, it is one of the highest-return improvements to the payment flow.

Receiving the Pix is not enough: match it to the booking. Knowing that R$1,500 has come into the account does not tell you which booking, guest or period it relates to, whether it is a deposit or full payment, or whether it covers two bookings at once. Use a charge linked to the booking or a unique reference, and record in the PMS which payment paid for which booking.

Have a procedure for third-party payments. Companies pay for employees, parents for children, agencies for clients, event organisers for several rooms. A Pix sent by João for Maria's booking is not, on its own, a sign of fraud. The procedure should record who paid, for which booking and who authorised it, so the front desk does not have to improvise that decision.

Standardise a waiting period for direct Pix bookings. For bookings closed outside the booking engine, set a period (for example, until the payment appears on the statement, and never more than a few hours during business hours) before definitively blocking the date or telling the guest the booking is confirmed. Tell the guest about this period openly: it reduces friction and avoids mistaken expectations.

Publish the official Pix key on every verified channel. Make it clear on the website, on Google Business Profile and on the official social media profiles which is the hotel's only valid Pix key, and advise guests to be wary of any contact that does not come directly from those channels. This does not eliminate fake profiles, but it gives guests a simple way to check before paying.

Protect the official channels themselves. Publishing the correct key does not help if an attacker manages to change it on the official channel. Instagram, WhatsApp Business and Google Business Profile accounts and the website's admin panel should have multi-factor authentication and administrative access restricted to a few people, and changing the Pix key or published payment details should require approval.

Monitor mentions and fake profiles. Regular searches for the hotel's name, phone number and photos on search engines and social networks such as Instagram and Facebook help identify cloned profiles before they cause damage at scale. The main platforms have a specific reporting channel for impersonation profiles, and the hotel can explain on its website how guests can report a suspicious contact.

Treat OTA bookings that show risk signals differently. A guest name that does not match the cardholder with no third-party payer explanation, multiple booking attempts with different cards in a short space of time, or unusual last-minute change requests deserve additional identity checks at check-in, within what the LGPD (Brazil's data protection law) allows for that purpose. A mismatch between guest and payer is not, on its own, a sign of fraud, since companies, family members and agencies frequently pay on guests' behalf. The warning sign is that mismatch combined with other unusual behaviour.

Document every exception in writing. A penalty-free cancellation, a refund outside the policy or releasing a room without confirmed payment should always have a record (email, a note in the PMS) and, above a set amount, approval from a second person. This greatly reduces the effectiveness of social engineering, because the scammer depends on a quick, isolated decision by a single person. A simple approval matrix helps make this clear to the team; the roles below are an example and should be adjusted to the hotel's structure:

Never change a supplier's payment details on the strength of a message alone. Confirm any change of Pix key or bank account through an independent channel, by calling a contact the hotel already had before the message, not the number that came in it.

Train reservations and front desk with real cases, not a generic policy. A short training session showing a realistic example of a fake receipt, a scheduled Pix screen and a simulated fake contact centre conversation tends to work better than a policy document nobody reads. Repeat it at the start of every season, when seasonal staff join.

What if the hotel sends a Pix to a scammer?

A guest's fake receipt and a Pix sent by the hotel itself to a scammer are different situations. In the first case, no money left the hotel: a booking was released without payment, and the way forward is to charge, cancel and record what happened. In the second, for example after a fake supplier key change or a fake refund request, the hotel is the victim of a fraudulent Pix.

In that case, tell the hotel's bank immediately and ask for an analysis under the Mecanismo Especial de Devolução (MED), Pix's special return mechanism for cases of fraud, scams or crime. According to the Banco Central do Brasil, the request must be made to the hotel's own institution within 80 days of the Pix date; if the case qualifies, the funds available in the scammer's account are blocked and may be returned, in whole or in part. Also file a police report and keep receipts, messages and emails. The sooner the bank is told, the greater the chance there is still money left to return. The MED does not cover commercial disputes, and it does not recover the revenue from a booking released on a fake receipt.

Next steps

The basic measures do not require investment in new technology: they are mainly process, training and one simple rule (the statement, not the screenshot) applied consistently. With a higher volume of direct bookings, the next step is to design the flow so that nobody has to rely on screenshots: booking, linked Pix charge, automatic confirmation in the PMS and exceptions approved and recorded. The starting point is to map every channel through which your hotel currently receives payment or confirms bookings outside the booking engine and the OTAs, and check that each one has a clear confirmation rule before any benefit is released. It is worth including in that review the scams that use AI, such as account takeover of the hotel's OTA account and the cloned voice of the manager asking for a Pix, which we cover in our guide to AI scams against hotels.

This adds to the hotel's other data and payment protection measures, such as network segmentation between guest Wi-Fi and the PMS/POS systems and the PCI DSS compliance scope for the channels that accept cards. Our team can review your hotel's booking and payment flow end to end and point out where the unverified steps are. Talk to our team.

Sources

• Banco Central do Brasil, O que é e como funciona o Mecanismo Especial de Devolução (MED) (what the special return mechanism is and how it works, in Portuguese), bcb.gov.br
• Banco Central do Brasil, Vítima fez um Pix e caiu em um golpe (victim made a Pix and fell for a scam, in Portuguese), bcb.gov.br