Pix Security Controls

Designing My Limits and Safe Contacts for millions of Pix users,
under a Central Bank deadline.

Role

Product Designer

Team

UX lead, 2 product designers, 2 UX writers, PM, engineering, legal

Platform

iOS & Android · Personal and business accounts

Timeline

2023–2024

A person at an ATM holding a phone with a limit-increase confirmation

Ways to add a safe contact, in one unified flow

5 + 1

Limit-adjustment flows, plus the day/night period change

24 h vs. instant

Increasing a limit takes up to 24 h; decreasing is immediate

1 quarter

From new regulation to launch

Summary

In 2023, Brazil’s Central Bank required every payment app to let users set Pix limits and manage trusted contacts. At Mercado Pago, I designed the user flows for My Limits and Safe Contacts, balancing security with everyday payment friction. We shipped every mandatory feature by the July 3, 2023 deadline.

As a product designer on the Pix squad, working with our UX lead, another product designer and two UX writers, I designed the navigation architecture, flows and handoff for My Limits, limits by period and Safe Contacts, for individual and business accounts, plus the new limit cards, feedback screens and notifications.

Context & challenge

Pix is Brazil’s instant payment system, regulated by the Central Bank. Version 6.4 of the Pix Experience Manual required features the app didn’t have: trusted contacts, day and night limits, and limit-increase requests for Pix Saque (cash withdrawal at stores) and Pix Troco (cash back on purchases). All of it had to fit into a Pix experience used by millions, within one quarter.

The law set the features and the deadline. The menu structure, how limits are explained, error states and notifications were open to design, and that’s where I focused my effort.

My Limits → Transfers → Withdrawals → Transaction period → Safe Contacts → Increase → New value → Confirm → Face ID → Up to 24 h → Push notification → Safe Contacts → CPF · CNPJ · Phone · E-mail · Random key · Past transfer → My Limits → Transfers → Withdrawals → Transaction period → Safe Contacts → Increase → New value → Confirm → Face ID → Up to 24 h → Push notification → Safe Contacts → CPF · CNPJ · Phone · E-mail · Random key · Past transfer →

Process

Benchmark

Studied Brazilian payment apps for the symbols and imagery tied to security and limits in Brazil, which set the tone for the limit cards and the menu UI.

Map every case

Mapped every use case in the manual, plus errors and edge cases, before drawing screens.

Validate content

Took part in a quick card sorting and wording test led by our UX writer with colleagues, which we treated as directional.

Review before handoff

Feedback rounds with the team, domain specialists, design system and engineering.

Key decisions

01 — Ordering the menu around a real fear

The card sorting was framed around a familiar fear: losing your phone or being robbed at night. Transfers came first, as the most frequent action, and Safe Contacts came last. The final order is Transfers → Withdrawals → Transaction period → Safe Contacts: limits come first, and the exception to the rules comes last.

In the wording test, “R$ 1,000 for the period” read more clearly than “R$ 1,000 in total”. Next to “remaining”, the word “total” made it unclear whether the amount was the full limit or what was left.

Final My Limits menu: Transfers, Withdrawals, Transaction period, Safe Contacts

02 — Planning for edge cases, not just the happy path

I mapped and designed every state before the screens, from setting a limit to R$ 0 (which blocks transfers) to exceeding the R$ 50k cap. Increases take up to 24 hours while decreases are immediate, so the confirmation screen and the push notification explain the delay, with an illustration that gives it context. Users never have to wonder whether a change worked.

Limit calculator states with behaviour annotations: max value, zero, same value, above the cap

03 — Saving development time with familiar patterns

Safe Contacts reuses the bottom sheet and the CPF / CNPJ / phone tag from Pix key registration. Building on components already in code cut development effort under a fixed deadline and kept the patterns consistent across Pix. The only new components were the day/night limit cards and their variations, which I refined over several feedback rounds and documented with engineering.

Whether someone adds a contact by CPF, CNPJ, phone, e-mail, random key or a past transfer, the flow uses one unified input and the same error states: key not found, attempt limit reached, own account, already registered.

Night limit card showing the limit for the period and what remains

Outcome

We shipped on the regulatory deadline, and the work was validated by the leadership team for payments and money rails. Impact data is confidential.

What I learned, and what I’d do differently

A regulatory deadline sometimes means doing the best you can with the time and resources you have. It takes flexibility, or “jogo de cintura”, as we say in Portuguese. The flow held up well after launch, but next time I’d still push for usability tests with real users.

It was also my most end-to-end project: from the release of the manual to going live and following the data, bringing weekly updates to the team and working through feedback.

Special thanks to Thiago, Mara, Cadu and Mel.