Drogaria Carvalho scam? Fake card decline, Pix-only site

drogariacarvalho.com is a fake storefront. It shows up as a sponsored result on Google, sells discounted beauty, fragrance and personal-care products, in practice accepts only Pix, and never delivers. We received a report from someone who paid in early October 2026, and the "Drogaria Carvalho" profile on Reclame Aqui has been collecting complaints following the same script since September.

The pharmacy whose name is being used has nothing to do with the scam. There is a real Drogaria Carvalho, in Arcos (MG), open since 1966, that does not sell online. The fake site displays its name, CNPJ and address to look legitimate. The drogariacarvalho.com domain had other owners in the past; the current registration dates from September 4, 2026.

How the scam works

1. You search for a product on Google and click a result tagged sponsored.
2. The site looks like a large pharmacy chain: a "Genuine products with invoice" banner, trust seals, "up to 12 installments by card" and below-market prices.
3. At checkout, if you choose card payment, you get "Card declined — No charge was made" and a button to pay by Pix.
4. You pay the Pix. The order sits in "pending" status or gets a tracking code that leads nowhere.
5. The phone number and WhatsApp in the footer go unanswered. The product never arrives and the money never comes back.

Complaints indicate the Pix payments land in accounts belonging to different companies, which change from one week to the next. The name on the payment receipt is almost never "Drogaria Carvalho".

The companies most frequently named as Pix recipients in public complaints are listed in the identifiers section on this page, with CNPJ and corporate name. Appearing there means victims read that name on their receipt; it does not mean the company is aware of the scam. If the name on your receipt is one of these, you are in the right place.

The "declined" card was never declined

This is the most important part of this page. In October 2026, CyberX's investigation read the code the site itself serves to any visitor's browser. The card payment screen never talks to any card processor. It does three things:

1. sends the card number, expiry date, security code (CVV), name on the card and CPF to the site's own server;
2. waits three seconds;
3. always displays "Card declined — No charge was made", with a button to pay by Pix.

The decline is hard-coded: it appears with any card, valid or not. The same system has an admin panel with a section to download captured cards, including expiry date and CVV. In other words, anyone who typed in their card handed over the full set of details, even if they later paid by Pix and even if no charge ever appeared.

Why decline instead of charging? Not charging on the spot avoids an immediate chargeback. The data is stored and can be used later, on another purchase or another scam, once the victim can no longer connect the problem to an online pharmacy.

The site also stores the name, email, phone number, CPF and address entered in the form, even if you abandon the purchase.

Other sites running the same system

The report we received concerned drogariacarvalho.com. During the investigation, we found other domains built on the same system:

• farmaciapalmas.com and drogariafontella.com: we read the code on both and it is identical to Carvalho's, with the same declined-card screen, the same capture of number, expiry date and CVV, and the same card-storage function (Fontella even identifies itself internally as "Drogaria Carvalho");
• drogariasaluto.com and drogariavitare.com: hosted on the same servers as Palmas, with the same technical signature in their TLS certificates;
• drogariafontellla.com (with three "l"s): same server as Carvalho;
• drogarianectar.com: the same page, with the same layout and the same icons.

All seven domains were registered between September 2 and October 16, 2026. farmaciapalmas.com also has complaints on Reclame Aqui, under the "Palmas" profile, following the same script: a Google ad, Pix, and tracking through a carrier that does not exist. And its code shows that anyone who tried to pay by card also had their details captured. Some of these sites use the name and address of real pharmacies in other cities, which likewise have nothing to do with the scam.

If you bought from any of them, the guidance below applies equally. And, if you want, tell us what happened through our reporting channel: every report helps link the sites together and show the scale of the operation.

If you made a purchase

• If you entered your card on any of these sites, even if it showed as "declined" and even if you then paid by Pix: call your issuing bank, explain that your details were captured by a fake site, and request that the card be blocked and reissued. Watch your statements over the coming months: an unfamiliar charge may surface weeks later, under a different name.
• If you paid by Pix: contact your bank as soon as possible and request a refund through the MED (Mecanismo Especial de Devolução), stating that it was a scam. Keep the receipt with the transaction ID.
• File a police report (your state's online police portal will accept it) and attach the receipt and screenshots of the site and the ad.
• Be wary of emails and messages about "completing your purchase" or "order shipped" after payment: the site stored your email address and phone number.
• Report the ad to Google (three-dot menu next to the ad, "Report ad").

What this investigation does not claim

• Who operates the sites. The domain registrations are shielded or held by third parties.
• That every pharmacy-named site advertised on Google is part of this scam.
• That the companies whose names appear on Pix receipts are aware of the scam.