DuitNow QR in Malaysia: how it works and how to stop QR swaps

DuitNow QR is Malaysia's national QR payment standard: a single code, run by PayNet, that can be paid from any participating bank or e-wallet app. For anyone selling online, that has a direct consequence: the QR code shown on the payment page decides who receives the money. If someone swaps that code, the buyer pays, the transfer settles instantly and the store sees nothing. Defending against it starts with understanding where the swap happens and what can be checked before the payment is confirmed.

How DuitNow QR works

DuitNow QR came out of the Interoperable Credit Transfer Framework (ICTF), the Bank Negara Malaysia (BNM) rulebook that called for a common, interoperable QR code. PayNet, which operates the country's shared payment infrastructure, was tasked with implementing it, and in 2019 the first banks and the first e-wallet began accepting it. Merchants display one code instead of several proprietary ones; buyers pay with the app they already use.

On 30 June 2026, BNM published the Interoperable Fund Transfer Framework (IFTF), which replaces the ICTF. According to legal analyses of the document, banks, e-money issuers and acquirers have until 30 June 2028 to shut down proprietary QR networks, and cannot onboard new merchants to them during the transition. QR transactions are to run through the shared infrastructure, which supports fraud monitoring, and banks and e-wallets must send an instant notification for every movement of money.

In practice, DuitNow QR is becoming the payment QR code in Malaysia. And the more universal a code is, the more attractive it becomes to anyone trying to divert it.

Where the swapped QR scam happens

At the counter, the classic scam is physical: a sticker with another QR code placed over the real one. In April 2025, a security expert interviewed by the newspaper Sinar Harian warned that genuine codes can be replaced with fake ones and advised checking the beneficiary name right after scanning. A year earlier, in April 2024, the police Commercial Crime Investigation Department (CCID) warned about QR codes printed on free gifts handed out door to door, which led victims to pages asking for banking details.

In e-commerce, the swap needs no sticker. The QR code is an image that the payment page generates and shows in the buyer's browser. A malicious script loaded on that page (from an outdated plugin, a compromised third-party service or a breach of the store) can replace the legitimate code with another, equally valid one for the same amount. The buyer scans, the app shows a payee name and, if they don't look closely, they confirm. The money lands in the fraudster's account within seconds.

Three details make this dangerous:

• The code is valid. Nothing technical alerts the bank: it is a real DuitNow QR, just for a different payee.
• The store does not notice right away. The order stays pending; the customer believes they paid the store, and the complaint arrives later.
• Settlement is instant. Recovering funds depends on acting very fast, and is not always possible.

Checklist for online stores

A practical list that works with any platform and any payment provider:

• Generate a dynamic QR per order, with amount and reference, instead of a fixed static code. It makes reconciliation easier and mismatches easier to spot.
• Show next to the QR the name the customer should see in their app (for example, your registered business name) and ask them to check it before confirming.
• Cut what loads on the payment page. Every third-party script is a door; keep only what is essential and review the list often.
• Keep platform, theme and extensions up to date, and remove anything unused.
• Reconcile against your statement, not screenshots. Release orders only on confirmed credit at your bank or provider, and turn on instant notifications.
• Treat "I paid but my order didn't go through" complaints as security alerts, not just support tickets: they are often the first sign of a swap.
• Monitor the live payment page, checking what the buyer actually sees, not only the code stored on your server.

What to tell buyers

Buyers can help stop the diversion too. A short note on the payment page goes a long way: after scanning, check the beneficiary name and amount before approving; be suspicious if the name does not match the store; and if you suspect a scam, call your bank and the National Scam Response Centre (NSRC) on 997 immediately. In March 2026, the Malaysian government stressed that calling 997 is enough to start the process, with no separate police report needed, and that speed improves the chance of freezing the funds.

Where on-screen verification comes in

The steps above lower the risk, but one gap can only be closed in the buyer's own browser: making sure the QR code on screen is exactly the one the store issued. Proteside performs that check on the payment page, blocks any DuitNow QR swap before confirmation and alerts the store immediately. See how DuitNow protection works. You can try it free for 14 days, with any platform and payment provider.