Convincing video does not prove investment: 7 checks before Pix

When the video itself tells you to ignore the bank, the most important alert has already appeared.

A well-presented face, a confident voice and the visual identity of a well-known company do not prove that an investment offer is genuine. Videos can be produced by artificial intelligence, legitimate brands can be copied, and fake pages can look professional enough to reduce distrust.

Faced with a promise of daily income, the safest decision is not to quickly try to figure out whether the video “looks like AI.” It involves stopping the payment and verifying elements that criminals have the most difficulty in falsifying together: the company's official channel, the identity of the beneficiary, the authorization of the participants, the economic origin of the return and the absence of pressure to ignore security mechanisms.

The case that motivated this guide

On July 31, 2026, ESET published an analysis of a fake platform that misused Caterpillar's name and branding. According to the investigation, the page initially requested a telephone number and then a full name and CPF. It then presented supposed plans for shared rental of machines, with the promise of daily income.

Before payment, the platform displayed a video produced with artificial intelligence. The character said that the bank could issue a scam alert during the transfer, but advised the user to disregard it and continue. Payment was requested by Pix, and the members area offered possible earnings by referring new participants.

The report published by Folha de S.Paulo on the same day described the same campaign, including the promise of an extraordinary daily return, the collection of personal data, the use of a domain similar to that of the company and the encouragement of recruitment. The report was based on technical analysis by ESET and should therefore not be treated as an independent technical detection of the same website.

ESET highlighted that it found no signs of intrusion into Caterpillar systems. What was identified was the misuse of the brand to increase the credibility of the fraud. The manufacturer also maintains an official warning about unaffiliated pages that request personal information or payments and use addresses other than their legitimate channels.

The decision in four steps

STOP: do not complete Pix or provide new data.

VERIFY: leave the received page and search for the company through an official channel opened by you.

CONSULT: check records, regulatory alerts and beneficiary identity.

DO NOT TRANSFER: any disagreement, pressure or guidance to ignore the bank ends the analysis.

You don't technically need to prove that the video is fake to decide not to pay. Just acknowledge that the offer failed basic authenticity, risk and transparency checks.

Seven checks before any Pix

1. Does the offer require you to ignore a bank alert?

This is the strongest signal.

A bank notice is not a bureaucratic hurdle that the seller needs to teach you how to bypass. Institutions participating in Pix apply prevention mechanisms, additional analysis times and precautionary blocks when they identify suspected fraud. Therefore, a person or platform that anticipates the alert and tries to neutralize it is interfering precisely at the moment when you could reconsider the payment.

Safe decision: do not indicate that you recognize the transfer just because the video, the attendant or the website told you to. Cancel the operation and speak to the bank through an official channel.

2. Is there a promise of an extraordinary daily return?

High, rapid and predictable gains require a verifiable economic explanation. The offer should clarify where the revenue comes from, what costs there are, who bears the losses, what risks may reduce the return and what documents govern the operation.

Promising high gains in the short term is one of the signs associated by the CVM with financial fraud and pyramid structures. The presence of machines, real estate, cryptocurrencies or any other asset in the narrative does not demonstrate that the money is actually being invested.

Safe decision: do not transfer while profitability is supported only by a simulation on the website, testimonials or the word of a representative.

3. Does the gain increase when you recruit others?

Legitimate referral programs do exist. The problem arises when recruitment occupies the center of the proposal and remuneration depends mainly on the entry of new participants, not on the actual sale of a product or service with demonstrable demand.

The CVM points out as signs of a pyramid the focus on attracting new members, the promise of high profitability in a short time and the absence of economic activity proportional to the announced gains. These structures depend on continuous expansion and become unsustainable when new inflows fail to cover previous promises.

Safe decision: if the platform rewards inviting people more than comprehensible economic activity, do not enter and do not forward the offer.

4. Does the address just look like the official domain?

Changing, adding or inverting a letter may be enough to create an address visually similar to that of a well-known company. In the case analyzed by ESET, at least one domain resorted to a small change in the brand name. The identified addresses must not be accessed or shared.

Do not verify by clicking the ad or link you received again. Type the company name yourself into a reliable search engine or access an official address you already know. The Ministry of Communications recommends opening the legitimate channel directly and checking whether the domain actually belongs to the institution before providing information.

Safe decision: a different letter, a strange subdomain or the absence of the offer on the official website is reason enough to stop payment.

5. Does the Pix beneficiary exactly match the verified entity?

Before confirming, check the recipient's name and other data presented by the banking application. Compare this information with that of the entity that should receive the value.

The CVM advises that transfers related to regulated participants are made to accounts linked to the legitimate entity and that the account is confirmed directly with the institution through official contacts. Payments directed to employees, advisors, third parties or beneficiaries with no demonstrable relationship to the offer represent a sign of risk.

Even the coincidence of the name, however, does not prove legitimacy. Business accounts can also be misused, and fraudsters can copy data from real organizations.

Safe decision: divergence in the beneficiary ends the operation; coincidence only allows verification to continue, it does not authorize payment.

6. Is the main “evidence” a convincing video, voice or face?

Video is not a document of authorization, regulatory registration or confirmation of the receiving account. A person in the scene may be synthetic, have their image reused or be reading false information.

It is also not necessary to become an expert in lip movements, shadows or intonation. These visual clues can help, but they should not decide alone. The strongest check occurs outside the video: does the offer exist on the official channel? Does the company recognize the campaign? Does the contact match public data? Is the recipient identified? Is there documentation on risks and operation?

Safe decision: treat videos as advertising material, never as authentication of the offer.

7. Do the offeror, the intermediary and the transaction appear in the appropriate records?

When the proposal is presented as an investment, consult the CVM alerts, the municipality's General Registry and the ContraGolpe tool. The query helps identify authorized participants and recurring signs of fraud. The ContraGolpe initiative was updated on May 1, 2026 when consulted for this article.

This step requires additional care: finding the name of a real company in the registry does not prove that you are talking to it. The CVM itself warns of corporate identity fraud in which criminals copy the name, CNPJ, documents, pages and data of legitimate participants. It is necessary to compare the offer contacts with official data and confirm the operation directly with the entity.

Not all commercial activity is under the jurisdiction of the CVM. If it is not clear which body regulates the offer, the lack of clarity is yet another reason to delay payment and seek independent professional advice.

Which sign should weigh more?

A single very strong signal justifies the pause. The combination of several of them makes it unnecessary to continue negotiating with the person who presented the offer.

This does not prove that the investment is legitimate

A well-produced website does not prove the existence of the operation.

A well-known brand does not prove that the company created the offer.

A CNPJ displayed on the screen does not prove that the person responsible for the website represents that organization.

Testimonials, panel balances and receipts sent by participants do not prove that the money is invested.

A small initial withdrawal also does not validate the model. In pyramid schemes, initial payments can be temporarily supported by the entry of new participants, until expansion becomes insufficient.

The correct question is not “has anyone received it yet?”. It is “what verifiable, regulated where applicable and documented economic activity produces this return?”.

I provided name, telephone number or CPF, but I did not pay

Stop registration and do not send photographs of documents, passwords, authentication codes or bank details. Preserve messages, emails and screenshots necessary for a possible report, but do not redistribute the active link, QR Code or page address.

In the case analyzed, ESET stated that it was not possible to determine how the collected data would be used. This means that it should not be stated that accounts were opened or services were contracted in the name of registered people, but the data must be treated as exposed to an untrustworthy source.

Monitor unusual movements and communications. If you reused a password when registering, change it from the official address of the affected service and activate two-step authentication. The Ministry of Communications also recommends notifying the financial institution, monitoring accounts and gathering evidence when personal information is provided to suspicious pages.

Has Pix already been created?

Contact your bank immediately via the app, phone or official branch. Inform that it is a suspected scam and request the opening of the Special Return Mechanism, the MED. Also register a police report and preserve proof, time, value, messages and identification presented by the recipient.

According to the Central Bank, the request related to fraud can be registered with the financial institution within 80 days of the transfer. MED increases the possibility of recovery, but does not guarantee a refund: the result depends on the analysis of the institutions and the existence of resources that can be blocked in the account involved.

Do not make new payments to “release” the balance, pay taxes, correct the registration or recover the investment. New charges could prolong the loss.

Checklist to share with family members

Before any Pix related to an investment opportunity, ask:

1. Are you telling me to ignore the bank?
2. Is the promised return daily, high or presented as guaranteed?
3. Is there a reward for bringing in new participants?
4. Did I find the offer via the company's official channel?
5. Is the Pix beneficiary exactly the confirmed entity?
6. Is there clear documentation about risks, costs and source of return?
7. Did I consult official alerts and records without using links sent by the seller?

If an answer raises doubts, do not transfer.

Consult official alerts and registrations before paying. Send this script to family members who receive offers of extra income, shared rental, investments or opportunities advertised through videos and private messages.

Pausing for a few minutes can interrupt a narrative built to make you act before checking.