When the first cases appeared, they were treated as punctual. But now, with more than 1 million Pix keys exposed since 2021, according to data recently released by the Central Bank, it is more correct to call them common. The latest, was that of Cashway Tecnologia, which despite involving only 50 keys, made Brazil return to discuss security in the instant payment system.
This is because in the first months of this year, new incidents of leakage were recorded, raising concern about the protection of personal data of users. Before Cashway, the problem had occurred in the IQ Direct Credit Society and exposed 25,349 Pix keys of customers. In addition to these, had great repercussion the case of XP (XPBR31), which communicated to customers at the end of April that a database hosted in an external supplier of the financial institution had an unauthorized“”. In this way, users were victims of leakage of information such as name, telephone, email, date of birth, date, CEP, nationality, and state of the financial position, and state.
According to Thiago Guedes, CEO of DeServ, a company specialized in information security and data privacy, for companies responsible for protecting Pix keys to avoid the occurrence of punctual failures in systems it is essential to observe the entire development of applications and systems from the programming and testing phase until it goes into production. This monitoring is required precisely to prevent possible problems and failures before they even happen.
“In this way, all companies that deal with personal data need to develop processes of continuous improvement covering both the legal and information security aspects. During all stages of data processing, it is essential to seek an immediate adaptation to the LGPD. The legislation itself requires that a data protection impact report is made and the company needs to structure itself so that it has these processes well underway to be able to manage possible” risks, he says.
Regarding Pix key holders, it is necessary to pay attention to the fact that it is not always possible to know when and if they were the victim of a leak or not. In this sense, the ideal is always to take extra security measures. “Although the leaked data does not include passwords or allow financial movements, any exposure of personal information can facilitate coup attempts, especially by social engineering”, he warns
Guedes gives some tips on how to protect yourself.
Monitor your Pix keys: frequently track the use of your Pix keys through your bank's app.If you notice anything strange or unknown, contact the financial institution immediately.
Enable alerts and notifications: keep Pix transaction notifications enabled on your phone to quickly identify any unauthorized movement.
Beware of suspicious messages: scammers often use leaked data to send fake messages (phishing). Never click links received by SMS, WhatsApp or email, even if they seem legitimate.
Update your information: if you suspect that your key has been compromised, you can request portability or deletion of the Pix key from your bank.
Use multiple authentication factors: whenever possible, enable two-step verification in financial apps and register strong, unique passwords.
Check if your data has been leaked: the Central Bank provides official channels to inform the user about any leaks. Stay tuned for communications directly in the app of your bank or on the BC website.
According to the Central Bank, the leaked data includes information such as name, CPF, relationship bank, agency number and date of creation of the Pix key.No sensitive data, such as passwords, balances or statements, has been compromised.
“O Pix is a secure system, but no technology is immune to operational failures. Therefore, user care is an essential part of” protection, concludes the expert.
