You use your bank's phone app. You can scan a QR code or you can send money to someone if you know their "id string", like a phone number, an email or a random string of numbers - you choose the "id string" format you want, and you can have different "ids" linked to different bank accounts. There are no physical cards.
assuming that the typo didn't lead to an invalid/unregistered key, you will see the recipient's bank, full name and masked CPF number in the confirmation screen.
I really dislike the lack of a more anonymous way to transfer money but given how prevalent scams are here I feel like there was no better option.
Also, before PIX bank transfers required a person's full name, full CPF number, full account and branch numbers so arguably PIX is helping to improve privacy a little bit.
However the big issue is when people register their phone numbers as PIX keys because it means strangers can easily get full names from phone numbers.
It helps to prevent scams because you know who the money is going to (not foolproof, of course).
CPF in Brazil is not as fragile or sensitive as the SSN in the US. You can't easily wreck someone's life just because you know their name and CPF. CPF numbers are shared pretty much everywhere since it's a unique identification code for a single person. All businesses ask for it when they're generating invoices/receipts etc. You basically use your CPF everywhere and there's virtually no risk in sharing it.
That's not to say that identity theft is not a thing in Brazil. It definitely is, however the damage is usually not as bad as the stories you hear in the US and the blame is usually put on the banks / service providers for not doing the proper KYC to verify the documents. It'll be a headache for the person, but usually something that is quickly fixed.
