Penetration testing for gateways and acquirers that process cards and Pix — and need to pass PCI DSS 4.0.

In a payment gateway, a bug doesn't create “risk” — it causes an instant financial loss. A refund race condition doubles the refund. An anti-fraud bypass lets a fraudulent transaction through. A BIN attack runs card testing at scale. A replayed webhook re-approves a cancelled order.

These bugs aren't theoretical. They're what organized attackers go after today in Brazilian payment gateways. Automated card testing accounts for a meaningful share of attempted transactions at acquirers — and every attempt that gets through costs interchange, chargebacks and your standing with the card brands.

A pentest here isn't a regulatory checkbox — it's proof that the product isn't quietly bleeding money.

Regulatory coverage

• PCI DSS 4.0 — Requirement 11.4 (internal and external penetration testing, CDE segmentation, application layer)
• BACEN Resolution 4,893 — the Central Bank of Brazil's cybersecurity policy rule, for authorized payment institutions
• BCB Resolution 85 — cybersecurity policy (Central Bank of Brazil)
• LGPD Art. 46 (Brazil's data protection law) — cardholder data, CPF (Brazilian taxpayer ID), transaction data

Card transaction flows

• Tokenization — token usage validation (replay, leakage, expiration)
• 3DS 2.x — bypass via frictionless fallback, risk score manipulation
• BIN attacks — card testing at scale, rate limiting by BIN/IP/device
• Refunds — race conditions, double refunds, amount manipulation
• Delayed capture — amount manipulation between pre-authorization and capture
• Chargeback flow — dispute abuse, evidence tampering
• Recurring billing — cancellation bypass, reuse of expired tokens

Pix (gateway side)

• Dynamic QR codes — payload manipulation, amount validation bypass
• Pix refunds — race conditions, double refunds, receiver manipulation
• Pix billing (Pix Cobrança) — phishing using forged keys
• Payment initiation — initiator authentication, JWT validation
• Reconciliation — status manipulation, payment receipt replay

Notification webhooks

• HMAC signature bypass — timing, length extension, algorithm downgrade
• Replay attacks — webhooks that change order status (paid, refunded)
• Webhook forgery — forging a callback to release an order without payment
• SSRF via a webhook URL configurable by the merchant
• Duplicate callback race conditions — double processing of notifications

Anti-fraud and risk scoring

• Rule bypass through payload modification (headers, fingerprint, geolocation)
• Score manipulation through test volume
• BOLA on rule endpoints (rule dump)
• Velocity checks — rate limit bypass via IP rotation, header injection
• Device fingerprint forgery

Merchant application (dashboard)

• Cross-merchant BOLA on transactions, receivables and settings
• Balance / early settlement manipulation
• Limit bypass through payload modification
• Card data leakage in logs / exports
• Unauthorized access to the chargeback tool

PCI infrastructure

• CDE segmentation — pivoting from the DMZ into the PCI zone
• HSM — validation of signed operations
• Logs and WORM storage — audit log tampering
• Key management — rotation, derivation, derivative leakage

A PCI QSA expects a report in a specific format:

• An executive summary formatted for the C-suite and the QSA
• Findings mapped to PCI DSS 4.0 requirements (especially 11.4.x and 6.x)
• A formal compliance statement after the retest
• Evidence of CDE segmentation testing
• An attack surface inventory classified by CDE exposure

For BACEN, we use the same structure, adapted to BACEN Resolution 4,893 and BCB Resolution 85. For the card brands (Mastercard SDP, Visa CPP), an additional format is available on request.

Every engagement gets a custom quote once the scope is defined. The hourly rate ranges from US$ 150 to US$ 250 depending on stack, testing mode and timeline — larger packages have a lower hourly rate. Invoiced in USD via Wise or international wire transfer: 50% at kickoff, 50% on delivery.