The bridge to Pix

The situation

Formalization is the last screen before the money leaves. The customer confirms their data, signs, and says where they want to receive it. The step was already there for bank transfers, and by then Pix had become an option beside them. What did not exist was a Pix formalization, a screen where the customer typed a key. That is what we set out to build.

Every Pix transfer cost money, because the provider charged per one and the price only came down as volume grew. And there was a second cost, harder to see. When a payment goes to a key, the app has to ask the Central Bank's key directory which account sits behind it, and the Central Bank rations those lookups.

A valid lookup costs a token from the quota, a key that does not exist costs twenty, and an empty quota returns an error. So letting the customer try keys until one worked would spend quota on every attempt. On top of that, in payroll lending the money has to land in the borrower's own account, because paying a third party is a known fraud pattern.

Brazil's superior court holds the bank liable for fraud inside its own operation, so the rule had to be explicit on screen and verifiable by the operation.

The decision

A designer on my team proposed the Pix key. One field, and the customer would be done with the step. It was the right destination, and it still is. But to keep the key from costing us, it needed a lot of checks and validation around it. That was more time and more engineering effort than the moment could take.

So I took him the cost and the rules, and we decided together. Bank details first, and his key later, when the cost came down. Bank details means institution, account type, branch and account, always in the customer's own name, with the ownership rule written on the screen. The transfer goes out by Pix all the same, to an account the app already knows, with no lookup at all.

It is more typing than a key, and that is why the six decisions below exist. When the designer had to step away, I finished the screens and did the handoff.

The screens

There are three steps. The bank, the account, the confirmation. The ownership rule carries the customer's name and appears in all three, so it is read where the decision is made. Below, the screens redrawn as wireframes, and the six decisions that exist to make the form easy.

Bank

Name and code, side by side

The search takes the bank's name or its code, and the list shows both together, so people find the bank the way they know it and do not pick the wrong one.

Account type

Pre-selected, then removed

Checking account came pre-selected at launch. In November 2025 we took the pre-selection out, because it was inducing errors, with people confirming a type that was not theirs.

Branch

No check digit, counter, example

The field asks for the branch without its check digit, and shows a 0 of 4 counter and the example 0466, so the digit does not end up in the wrong box.

Account

With check digit, and a hint

The field takes the account with its check digit, and the hint says what to do when that digit is an X. Use 0.

Keyboard

Numeric, and the form scrolls

The keyboard opens numeric, and on focus the form scrolls so branch and account stay visible above it.

Button

Enabled only with complete data

Continue only enables with four digits of branch and an account with at least one digit, so incomplete data stops before it reaches the backend.

These screens are a redesign of a step that already existed, live in February 2025. The team kept working on them afterwards, and the change that taught me the most was taking out the pre-selected account type in November 2025, once the data showed it was inducing errors.

Existing accounts, and leaving the flow

Three situations the backend already knew were designed from the start. The benefit account comes prefilled and not editable. Whoever already has an account on file chooses between keeping it and adding another. And whoever tries to leave gets a reminder of how few steps remain. A savings account uses the same confirmation, with the label following the type.

The bridge and the destination

The key flow came later, behind a flag in November 2025, and went live in June 2026, once the cost no longer weighed. Its first months were uneven. In product A the key returned 8.6% of paid contracts in July against 2.9% for bank details, and 6.9% against 2.2% in August. Through 7 September, with the month half done, it ran at 1.6% against 2.1%.

In product B, on the other hand, the key returned less in every full month. The comparison shows the difference, not the cause.

What the numbers say

The products appear as A, B and C, because what matters is the comparison and not which is which. Product A launched in March 2025, a month after the redesign went live, so its series has no before. By August 2026 payment returned had fallen from 13.5% to 2.4% of the contracts paid each month. Invalid account, the largest reason, fell from 11.5% to 1.6%.

Ownership mismatch fell from 1.0% to 0.08%. In the step itself, completion rose from 80% to 93% and the median time fell from 67 to 9 seconds. None of this is a controlled test. In the same months the product launched, the backend let customers correct their own data, and engineering fixed a modal that was raising drop-off.

So the data show the drop, and they do not measure how much of it came from design. Below, the three products that pass through this step. A was born on these screens, B and C are older than them.

Product A

Born on these screens

March 2025 to August 2026: payment returned 13.5% to 2.4% of paid, ownership mismatch 1.00% to 0.08%, step completed 80% to 93%, median 67 s to 9 s, 90th percentile 73 s in August. With a key in August it returned 6.9%, against 2.2% with bank details.

Product B

Older than these screens

Steady across the same months: payment returned 2.6% to 3.8% of paid, step completed 93% both ends, median 6 s to 8 s, 90th percentile 102 s in August. Here the key returned less: 1.4% against 3.8% with bank details.

Product C

Older than these screens

Also steady: payment returned 4.3% to 4.0% of paid, step completed 87% to 84%, median 8 s at both ends, 90th percentile 53 s in August. The key was not on this product in the months measured.

Four readings of the whole contracting journey, from the formalization cockpit in 2026, with no before and after. They cover every step, bank details included. The score is a Customer Effort Score, where 5 is the best.

What stayed

Constraint

A design requirement, not an excuse

The cost of Pix set the path. Then the extra typing it caused was treated with the bank code, the counter, the hint and the right keyboard.

Rule

On the screen, with the name

The rule that protects the customer is written where the decision is made, with the customer's name on it, on every step.

Destination

Shipped when it got cheap

The bridge went live in February 2025, and the key flow followed in November 2025, behind a flag. Turning it on in June 2026 was a business decision, not a new project.

Default

Watched, then removed

A default can induce error. The first version pre-selected the checking account, and it came out in November 2025 when the data said so.

Where the rules come from

The rules in this case are public and were checked at the source. Prices are not. The fee per transfer and the volume tiers are contractual and confidential, so the case speaks of tiers.

Manual entry

Regulamento Pix, art. 5 and 14

Resolução BCB 1/2020 admits paying to the receiver's account details, and requires the directory lookup for keys, QR codes and tap-to-pay between different institutions, not for manual entry.

Lookup quota

Manual do DICT 8.4, section 13

One token per valid lookup, twenty per unregistered key for the payer, three for the institution, and HTTP 429 when a bucket is empty.

Ownership

IN INSS 138/2022, art. 5, VII

The public payroll loan is credited to the benefit account or, for those paid by magnetic card, to an account the borrower holds. Portaria MTE 435/2025, art. 10, VI, asks the same for private payroll loans.

Liability

STJ, Súmula 479 and REsp 1.771.984

Banks answer objectively for fraud that is an internal risk of their operations. In 2020 the court held the institutions in a fraudulent portability jointly liable.

Fees

Resolução BCB 19/2020, art. 4

Companies may be charged per Pix sent. Public prices in 2026: banks charge 0.89% to 1.45% with floors near R$1 and ceilings near R$10; providers charge R$0.50 to R$1.00 per transfer, negotiable by volume; one provider lists the lookup at R$0.25.