QR code scams in Asia: what six markets teach online sellers

Across Asia, the QR code has become the default way to pay instantly and one of scammers' favourite targets. Between 2019 and 2026, police and regulators in Singapore, Malaysia, Thailand, the Philippines, Hong Kong and India described the same four patterns: swapped or overlaid QR codes, fake payment pages, QR codes that take money from people who think they are receiving it, and pass-through accounts that scatter the funds. For anyone selling online in these markets the lesson is simple: the weakest point is the moment the buyer sees the QR code and approves the payment, and that moment happens on the merchant's page.

Why instant-payment QR codes became a target

PayNow and SGQR in Singapore, DuitNow in Malaysia, PromptPay in Thailand, QR Ph in the Philippines, FPS in Hong Kong and UPI in India share the logic of Pix, Brazil's instant payment system: the payer scans a code, checks the amount in a banking or e-wallet app and authorises the transfer. The money moves at once. There is no card terminal, card network or easy chargeback in between.

That simplicity is what makes these systems work, and it is also what scammers exploit. Whoever controls the QR code controls where the money goes. And because the payer authorises the transfer, a diverted payment looks like an ordinary transaction to the bank.

Four patterns that keep coming back

1. Swapped or overlaid QR codes. This is the most frequently cited scam. In May 2023, the Cyber Security Agency of Singapore (CSA) and the Singapore Police Force (SPF) jointly warned that businesses' payment QR codes can be tampered with so that money goes to the scammer, and urged people to look out for codes pasted over the original. In the Philippines, a central bank (BSP) officer repeated the warning in April 2026, according to local media, pointing to stickers placed over merchants' codes. In July 2026 the Philippine National Police (PNP) went beyond the shop counter: it described sellers' payment QR codes being replaced and announced joint action with the technology (DICT) and trade (DTI) departments against people distributing fraudulent codes, especially on online selling platforms.

2. Fake payment pages. A QR code can also open the door to sites that imitate banks, shops and payment gateways. In September 2026, the director of the Malaysian police's commercial crime department, Rusdi Mohd Isa, listed fake payment gateways and fake payment QR codes that divert funds to syndicate accounts among the methods in use. The BSP advises previewing the address before opening a link and never entering financial details on pages reached through a QR scan.

3. The QR code that charges instead of pays. Here the target is the seller. The scammer poses as a buyer, says they are about to pay and sends a QR code or link so the seller can “receive” the money. Scan and approve, and the victim is the one paying. Malaysian police described exactly this script against online sellers and stressed that, with DuitNow QR, the recipient only needs to show their own code. In India, the Reserve Bank (RBI) warned in 2022 that receiving money never requires scanning a QR code or entering a PIN, and that fraudsters misuse UPI's collect-request feature with messages asking for the PIN to “receive” funds. In Thailand, a Thai PBS report based on police guidance put the rule plainly: whoever scans is the one who pays.

4. Pass-through accounts. None of these scams works without an account to receive the money and move it on quickly. That is why these markets invest in checks before payment. In Malaysia, police run the SemakMule portal, where anyone can check bank accounts, phone numbers and company names. In Hong Kong, the Monetary Authority (HKMA) launched an FPS alert in November 2023 based on the police's Scameter tool: 44 banks and stored value facility operators now warn users when the payee's identifier (phone number, email or FPS ID) is flagged as high risk.

What the authorities ask for

The advice converges on a few points:

• Check the payee's name and the amount in the app before confirming (Singapore, Hong Kong, Thailand).
• Be wary of QR codes received by message, on social media or from unknown sources (Singapore, Malaysia, the Philippines).
• Never scan a QR code or enter a PIN, password or one-time code to receive money (Malaysia, India, Thailand).
• Inspect physical codes for stickers over the original (Singapore, the Philippines).
• On the institutions' side, Hong Kong stated back in 2019, in an official reply to the Legislative Council, that banks and wallets should verify that a QR code is genuine and show the payee's name before payment.

Notice that almost everything relies on the buyer checking something. That helps, but it is not enough when the swap is done well.

The Pix parallel: the swap moves to the checkout

In Brazil, the same idea has already moved from the sticker to the website. In September 2026, Kaspersky disclosed a campaign that replaces the Pix QR code and copy-and-paste code on legitimate stores' checkout pages the moment the customer chooses Pix. It identified 90 small and mid-sized stores with one thing in common: an unmaintained Magento installation. The campaign had been active since June 2025. For the merchant, the order shows as abandoned or pending; the customer only notices days later, after the money has passed through mule accounts, which makes recovery through the central bank's refund mechanism (MED) harder. See how this attack works on our page about Pix protection at checkout.

Nothing stops the same kind of code from doing this with a PayNow, DuitNow or UPI QR code: the PNP already talks about online sellers' codes being swapped. The difference is that in an online store nobody can look for the sticker: the fake QR code is generated on the page itself, with the right amount and an identical look.

Checklist for merchants selling in these markets

1. Generate a dynamic QR code per order, with amount and reference, instead of reusing a fixed code.
2. Show on the page the official name that will appear in the buyer's app and ask them to check it before confirming.
3. Reconcile every payment with its order automatically and alert on orders stuck at “awaiting payment”.
4. Slim down the checkout: fewer plugins and third-party scripts, an up-to-date platform and extensions, two-factor login for admins.
5. Monitor the live payment page as the buyer sees it, not just the code on your server.
6. Brief staff and customers: the store never asks anyone to scan a QR code or enter a PIN to receive a refund.
7. Use local check-and-report channels, such as SemakMule and the 997 hotline in Malaysia or Scameter in Hong Kong, and report incidents fast.
8. Treat “I paid but my order wasn't approved” complaints as a possible sign of a swap, not just a delay.

In every one of these markets the scam wins at the same instant: when the buyer sees the QR code and approves. Proteside protects that moment on the store's page: it checks, in the buyer's browser, that the QR code shown and the code copied (PayNow/SGQR, DuitNow, PromptPay, QR Ph, FPS, UPI or Pix) are exactly what the store issued, blocks any swap before confirmation and alerts you. Try it free for 14 days.