Fake betting sites promise up to R$ 3,000 on R$ 20 Pix deposits and block withdrawals

A ZenoX investigation has mapped a network of imitation betting platforms that lure users with small Pix deposits and then trap withdrawals inside the site’s own logic. For PSPs and payment teams, the interesting part is not the fake bonus headline; it is how the flow is built to force repeat payments and keep settlement off the user’s side.

1. The scheme starts on social media. One Instagram example found by ZenoX told users to open a link, register, deposit R$ 20, and send the receipt together with their Pix key in exchange for R$ 2,000. ZenoX also identified a TikTok account tied to the operation with more than 126,000 followers and 2.5 million likes; Instagram and Telegram were used for both promotion and support.
2. After the first Pix, the user sees a gambling-style interface with games, a displayed balance, and records of supposed previous withdrawals. The site also shows a “last withdrawals” showcase with partially hidden names and large amounts, which is there to make the operation look legitimate enough for the next deposit.
3. When the user tries to withdraw, the platform demands a R$ 30 fee to release the funds. In some cases, the QR Code for that payment is generated by the user’s own browser, and the mechanism meant to verify the transaction cannot confirm it. The withdrawal then stays stuck at “Pagamento da Taxa Pendente” (“Fee Payment Pending”), and the cycle restarts every time a new QR Code is generated.
4. The platform also tied bonuses to a minimum approved deposit of R$ 30. That matters because the whole design pushes repeated small-value payments, which is exactly the kind of traffic that can look ordinary in isolation but becomes suspicious when the withdrawal side never clears.
5. ZenoX said it accessed the sites’ internal structure after finding production credentials exposed in public code, and also identified a privilege-escalation flaw during registration. In one database, researchers found 415 user accounts and 231 deposit transactions; 92% of those deposits were in the R$ 20 to R$ 30 range, and 157 of the 231 were still pending with no refund. The internal dashboard showed R$ 107,519 in accumulated balance across accounts since December 2025.

One of the platforms identified as NEWWBET7K reportedly held a base of more than 3,600 accounts, with users’ names, emails, and phone numbers exposed. For high-risk operators, that is a reminder that these schemes are not just payment fraud; the same infrastructure can also turn into a data leak and a reuse problem for future attempts.