Skip to content

FPS and HKQR in Hong Kong: QR scams and good practices

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

FPS settles payments in seconds using a phone number, email, FPS ID or QR code, and its scam alerts only recognise identifiers already reported. To stop swapped QR codes at checkout, merchants should use dynamic QR codes, slim down the payment page, confirm on received credit and verify on the buyer's screen that the QR is the one issued.

FPS (the Faster Payment System, or 轉數快) is Hong Kong's instant payment system: it moves money between banks and e-wallets in seconds, around the clock, using a mobile number, an email address, an FPS ID or a QR code instead of bank details. For an online store, that means the QR code or identifier shown on the payment page decides who gets paid. QR scams exploit exactly that point, and because settlement is immediate, the defence has to happen before the buyer confirms.

How FPS and HKQR work

The Hong Kong Monetary Authority (HKMA) launched FPS in September 2018, with transfers starting on the 30th of that month. It connects banks and stored value facility (SVF) operators on a single platform, supports Hong Kong dollars and renminbi and runs without a break. At launch there were 21 participating banks and 10 SVFs. Payees register a mobile number, email address or FPS ID; payers don't need to register.

Alongside FPS, the HKMA released the Common QR Code Standard for Retail Payments and the free HKQR app, developed by the interbank clearing house HKICL. It merges QR codes from different providers into one, so small merchants don't have to display several codes at the counter.

What Hong Kong already does against FPS scams

In November 2023, the HKMA, the police and HKICL launched the FPS Suspicious Proxy ID Alert. Before a transfer, the app warns the payer if the payee's mobile number, email address or FPS ID is tagged “High Risk” in Scameter, the police anti-fraud search engine. At launch, 44 banks and SVFs took part. In August 2024 the alert was extended to transfers by account number, and by the end of June that year more than 655,000 alerts had been issued, around 3,000 a day.

The police also warn specifically about QR codes. The Anti-Deception Coordination Centre (ADCC) notes that phishing messages often carry links, QR codes or attachments that install malicious software, and recommends checking payee accounts on Scameter before paying.

The blind spot: the payment page

The FPS alert depends on the fraudster's identifier having already been reported. A fresh mule account with no history may not trigger anything. And in e-commerce there is a form of diversion that no bank warning can see: a QR swap inside the payment page itself.

It works like this: a malicious script loaded at checkout (through a vulnerable plugin, a compromised third-party service or a breach) replaces the HKQR code or FPS ID on screen with another valid one for the same amount. The buyer scans, sees some payee name and confirms. This has already been documented with another instant payment system: in September 2026, Kaspersky disclosed a campaign that swapped the Pix QR code on the payment pages of 90 small and medium-sized online stores in Brazil, while the store's system showed the order as abandoned or pending.

Good practices for online merchants

  • Generate a dynamic QR per order, with amount and reference, and avoid showing a fixed FPS ID as the only payment option.
  • Show the payee name that will appear in the app next to the QR and ask customers to check it before confirming.
  • Slim down the payment page: only the scripts you truly need, with regular reviews of what loads there.
  • Keep platform, theme and extensions up to date, removing anything unused.
  • Confirm orders against credit at your bank or provider, never a screenshot sent by the buyer.
  • Treat “I paid but the order didn't go through” as a security incident, and check whether the QR shown was altered.
  • Monitor the live payment page, checking what buyers actually see.

If something goes wrong

Tell the customer to contact their bank or e-wallet immediately. For questions, the ADCC's Anti-Scam Helpline 18222 runs 24 hours a day, but only for advice: suspected scams must be reported at a police station, and emergencies on 999. On the store side, record the order, the time and the QR code shown, and alert your payment provider.

FPS alerts protect the transfer; the integrity of what your page displays is the store's responsibility. Proteside checks, in the buyer's browser, that the HKQR code and FPS ID shown are exactly the ones issued, blocks any swap before confirmation and alerts your team. See FPS and HKQR protection. Try it free for 14 days, with any platform and payment provider.

Back to blog

Read next