To pay by QR code safely, scan only codes displayed by the merchant, check that the code is not a sticker covering another one, and always confirm the receiver name and amount in your banking or e-wallet app before you press pay. If the name does not match the shop, stop and ask.
Paying by QR code is fast and convenient. In Thailand, PromptPay QR codes are used everywhere from street food stalls to department stores, and many other countries have similar systems through bank apps and e-wallets. The technology is secure, but scammers target the moment of payment. This guide shows you how to protect your money.
How QR payments work
A payment QR code contains the details your banking app needs to send money: who receives it, and sometimes a fixed amount and reference. When you scan it inside your bank or e-wallet app, the app reads those details and prepares a transfer. Nothing is sent until you confirm.
There are two common kinds:
- Static merchant QR codes are printed and displayed at the counter. They identify the receiver, and you usually type the amount yourself.
- Dynamic payment QR codes are generated on a till, terminal or screen for one specific purchase, often with the amount already filled in.
A PromptPay QR code, for example, links to a receiver's PromptPay account, which is tied to a phone number, national ID or business tax ID. You can create one for your own shop with a PromptPay QR generator, but the safety checks below apply whoever made the code.
The main QR payment scams
Most QR payment fraud is low-tech. It relies on people paying in a hurry without looking. The most common tricks are:
- Fake QR stickers. A scammer prints their own payment code and sticks it over the shop's real one. Customers pay the scammer, and the shop owner may not notice until takings fall short.
- Fake receipts or screenshots. A "customer" shows an edited payment confirmation on their phone instead of actually paying. This targets merchants rather than shoppers.
- QR codes in messages. Someone sends a QR code by chat, email or social media claiming you need to scan it to receive money, pay a fee, or unlock a refund.
- Fake websites. A QR code opens a web page that looks like a bank or payment page and asks for your card number or online banking login.
- Overpayment and refund tricks. A buyer "accidentally" pays too much and asks you to refund the difference through a QR code they send.
Consumer-protection agencies and banks in several countries have warned about these patterns, especially fake stickers at unattended payment points.
Checklist: before you press pay
Make these checks every time. After a few days they become automatic.
- Scan inside your banking or e-wallet app, not with a random scanner app. Your bank app shows the payment details clearly and will not open strange websites.
- Look at the code itself. Is it a sticker on top of another code? Is it peeling, crooked or newer than the sign around it?
- Read the receiver name. Your app displays the receiver's name, sometimes partly hidden for privacy. Make sure it matches the shop, stall or person you are paying.
- Check the amount. If the amount is filled in automatically, confirm it matches your bill.
- Pay only in your banking app. A genuine payment QR opens a transfer in your app. If it opens a website asking for card details or your banking password, close it.
- Keep your confirmation. Show the merchant the completed transfer screen, or let them check their own notification.
If the receiver name does not match the business, do not pay. Ask the staff.
Remember: you never need to scan to receive money
One rule stops a lot of fraud: scanning a QR code is for sending money, not receiving it. If someone asks you to scan a code to get a refund, a prize or a payment from them, it is a scam. To receive money, you share your own payment details or QR code; the other person scans it.
The same goes for codes arriving in unexpected messages. Banks generally do not send QR codes by SMS or chat asking you to pay fees or confirm your account. When in doubt, contact your bank using the number on your card or in its official app.
Tips for merchants and small shops
If you accept QR payments, a few simple habits protect both you and your customers:
- Display your business name clearly next to the QR code, so customers can match it with the receiver name in their app.
- Check your payment signs daily, and especially at opening, for stickers or replaced cards.
- Put printed codes behind a clear cover or inside a stand that is hard to tamper with.
- Verify payments in your own app, not on the customer's screen. Turn on instant notifications from your bank so you see every incoming transfer.
- Tell staff what to look for, including edited screenshots and overpayment stories.
- Separate marketing codes from payment codes. If you use QR codes for menus or promotions, keep them visually distinct from your payment code so customers know which is which.
For more ways to secure printed codes, read our guide to protecting your business QR codes.
What to do if you paid the wrong person
Act quickly. Speed can make a difference:
- Contact your bank straight away through its official hotline or app, and explain that you paid a fraudulent receiver.
- Keep evidence: screenshots of the transfer, the receiver name, the time, and a photo of the QR code if possible.
- Tell the shop or venue so they can remove the fake code and warn other customers.
- Report the fraud to the police or the relevant authority in your country.
If the QR code also led you to a website where you typed passwords or card details, follow our steps in what to do after scanning a malicious QR code.
FAQ
Is paying by QR code safe?
Yes, when you take a moment to check. The payment systems themselves are secure; most fraud happens when someone pays a fake code without checking the receiver name.
Why does my bank app hide part of the receiver's name?
Many apps partly mask names to protect privacy. You should still be able to see enough to confirm it matches the business you are paying.
Can someone steal money just because I scanned their QR code?
A genuine payment QR code cannot take money without you confirming the transfer. The danger is confirming a payment to the wrong receiver, or a fake website collecting your banking details.
Should I use a general QR scanner app for payments?
It is safer to scan payment codes inside your official banking or e-wallet app, which shows the receiver details clearly before you confirm.
QR payments are quick and convenient, and a few seconds of checking keeps them safe. If you run a shop, create a clear, properly labelled payment code with the QR-TH PromptPay QR generator and display your business name right beside it.