Skip to content

PromptPay QR scams: best practices for online stores in Thailand

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

On PromptPay, whoever scans the QR code pays, so any request to scan a QR code to receive a refund is a scam. Online stores protect themselves by charging with a per-order merchant QR code, showing the payee name and making sure the checkout QR code cannot be swapped.

On PromptPay, whoever scans the QR code pays, every time. That is why any request to scan a QR code “to receive” a refund is a scam signal, as Thai police and the public broadcaster Thai PBS have warned. For an online store, the critical point is the QR code shown at checkout: it decides which account gets the money, and the name the banking app displays before confirmation is the customer's last line of defence.

How PromptPay and Thai QR work

PromptPay is the instant payment infrastructure promoted by the Bank of Thailand (BOT), in service since 2016. Instead of an account number, the payee can be identified by a national ID number, a mobile number or another registered number. Each number is linked to a single account.

The QR code follows the Thai QR Code Payment Standard, set out in a BOT policy guideline of April 2019 and based on EMVCo's international QR specification for payments. Inside the code, specific fields indicate how the money is received: one is used for transfers to PromptPay identifiers such as a mobile number, ID number or account; another is reserved for businesses registered with a Biller ID or Merchant ID, which service providers must verify before they can start collecting. Further fields carry the amount and the payment reference.

The same guideline requires providers to educate users about counterfeit QR codes, offer real-time payment notifications and provide a way to check the data in a QR code (for example, by verifying and displaying the payee's or merchant's name from the system). That name is what the customer sees before confirming.

The documented scams

  • “Scan to receive” refund QR codes: in October 2025, Thai PBS published a warning from the Central Investigation Bureau (CIB) about scammers who call customers posing as the shop they bought from, armed with accurate purchase details, and offer a refund for a supposedly faulty batch. The QR code they send actually transfers money to an overseas account, with instant currency conversion that makes it harder to trace.
  • Reversed roles: in September 2024, Thai PBS, drawing on police guidance, stressed that a PromptPay QR code is for receiving money and that whoever scans it pays. Scammers claim the opposite to get victims to scan.
  • Mule accounts: the same report lists warning signs such as online sellers whose account name does not match the expected payee, and accounts opened with other people's documents.

The first case deserves every merchant's attention: the scammer uses your store's name and your customers' data. Even with no flaw in your own systems, it is your brand that takes the damage.

Where the risk sits in online checkout

In an online store, the QR code is generated by the merchant's or payment provider's system but displayed in the buyer's browser, alongside everything else the page loads: plugins, marketing tools, chat widgets, third-party scripts. Malicious code on that page can replace the store's payment QR code with another valid one, for the same amount, pointing to a mule account. The buyer sees a name that looks plausible and confirms. The store is not paid, and the customer is certain they paid.

In the card world, this blind spot is already covered by rules: PCI DSS requirements 6.4.3 and 11.6.1 call for controlling payment page scripts and detecting unauthorised changes to what reaches the browser. The PCI Security Standards Council published dedicated guidance on these two requirements in March 2025. The same logic applies to a PromptPay QR code.

Best practices for online stores

  1. Collect with a merchant QR code linked to your company's Biller ID or Merchant ID, not with a partner's or employee's personal PromptPay.
  2. Generate one QR code per order, with an amount and reference, and reconcile each credit against that reference.
  3. Show, as text, the name that will appear in the banking app and ask customers to check it before confirming.
  4. Release orders only on confirmation from your bank or provider, never on a payment slip sent by the customer.
  5. State clearly that your store never asks customers to scan a QR code to receive a refund, and that refunds go back through the original payment method.
  6. Cut the scripts on your checkout and keep platform, theme and plugins up to date, removing anything unused.
  7. Monitor the live payment page, comparing the QR code on screen with the one your system issued, and treat “I paid but my order didn't go through” as a security signal.
  8. Know where to send victims: according to the CIB warning, Thai police take reports online at thaipoliceonline.go.th and on the 1441 hotline.

To see what can be swapped in a PromptPay charge, and what lies beyond the reach of any on-page protection, read about protection for PromptPay payments.

Proteside checks, in the buyer's browser, that the QR code, PromptPay ID and amount shown at checkout are exactly the ones your store issued, and blocks any swap before the payment is confirmed, alerting you and generating PCI DSS evidence. It works with any e-commerce platform and payment provider. Try it free for 14 days.

Back to blog

Read next