Pix scams
Pix scams on the phone: how a payment app can defend
How the malware behind many Pix scams works on Android, and the controls a bank or fintech can add to the payment screen.
Short answer
Several Pix scam campaigns described by researchers in 2026 do not break into the bank: they take over the customer's phone. Malware abuses accessibility services to read the screen and tap for the victim, draws fake screens over the app and lets a remote operator watch, then changes the Pix key at the moment of confirmation. An app defends by detecting those techniques on the payment screen and stopping the transfer.
How the attack works
The victim installs an app from outside the official store, often from a fake store page, and grants it accessibility permission. From then on the malware can see the screen and act for the user. When a transfer starts, it waits for the confirmation and swaps the destination, while a fake waiting screen hides what happens.
Why server rules miss it
The transfer comes from the customer's real device, real session and real credentials. To the server it looks legitimate. The evidence is on the phone: an accessibility service controlling the screen, an overlay over the confirm button, an active remote-access session.
What the app can do
Detect overlays, accessibility abuse, screen capture and remote access while the payment screen is open. Hide sensitive content during capture, and warn, step up or block the transfer by policy. Send the signals to your fraud team and backend with each attempt.
What the sources say
In March 2026, researchers described PixRevolution, an Android trojan that abuses accessibility permissions, watches the screen in real time and swaps the Pix key when the victim confirms a transfer.
Source · checked on
Play Integrity can report apps that may be capturing the screen or controlling the device while your app runs (app access risk).
Source · checked on
What Moatgator does
Pix Shield detects overlays, accessibility-service abuse, screen capture and remote access on payment screens, and can stop the transaction.
Source · checked on
Policies can trust specific accessibility services, so legitimate assistive tools keep working.
Source · checked on
Each detection starts in monitor mode and moves to warn, block or end the session when you decide.
Source · checked on
Where it stops
Pix Shield is available on the Scale and Enterprise plans. It adds device signals that a fraud engine cannot see; it does not replace your fraud engine, customer education or the bank's own controls.
Frequently asked questions
Is this guide for people who were scammed?
It is for teams that build banking and payment apps. If you were scammed, contact your bank right away through its official channels.
Won't blocking accessibility hurt people who need it?
Policies can trust specific accessibility services, so legitimate assistive tools keep working while unknown services are flagged on payment screens.
Does this work on iOS?
The malware described here targets Android, and this guide is about Android apps. Moatgator supports Android and iOS (beta).
Is detection on the phone enough?
No single layer is. Combine device signals with server checks, transaction limits and fraud monitoring.
See where your app stands
Upload an APK, AAB or IPA to the free Scan and get a grade, without an account.