QR Ph in the Philippines: the national QR and online store scams

QR Ph is the Philippines' national QR payment standard: a single code format that any participating bank or e-wallet can read, with real-time settlement. It made life easier for merchants and buyers, and it also handed scammers a single target. The most common scams swap the legitimate code for another one, either stuck on top at the counter or replaced on the online store's own payment page. Here is how the standard works, how these scams operate and what to do about them.

What QR Ph is

The Bangko Sentral ng Pilipinas (BSP) adopted the national QR standard through Circular No. 1055 in October 2019. QR Ph was developed by Philippine Payments Management, Inc. (PPMI), the BSP-accredited payment system management body, based on the international EMV standard. The goal was to end fragmentation: one interoperable code for everyone instead of a separate QR for each bank or e-wallet.

In 2023 the BSP made adoption mandatory: from 1 July that year, payment service providers offering QR-based services must use and display QR Ph on their internet and mobile channels, and proprietary codes were disabled. Person-to-person and person-to-merchant payments were the priority use cases. On the merchant side, QR Ph payments run over InstaPay, settling in real time around the clock, and one merchant QR works with more than 40 participating banks and e-wallets, according to payment provider PayMongo.

Scams that target buyers

In April 2026 the BSP again warned the public about quishing, the malicious QR code scam. At a briefing in Bohol, BSP officer Gregorio Baccay III explained that fraudsters use tampered QR codes to lure victims to fake websites, install harmful software or trick them into sending money. One method he described is the simplest of all: pasting their own QR code over a merchant's legitimate one, so customers' payments go to the wrong account.

The BSP's advice to consumers is straightforward: scan only codes from verified sources, look for signs of tampering (such as a sticker over the original), check the address before opening a link from a QR code, and never enter financial details on a site reached by scanning one.

When the swap happens inside the online store

In e-commerce, the QR code is not on a poster: the payment page generates it and shows it in the buyer's browser. That opens a variant that is much harder to spot. A malicious script running on the page (from a vulnerable plugin, a compromised third-party service or a breach) can replace the legitimate code with another valid QR Ph code for the same amount. The buyer scans, pays and only finds out when the order is never confirmed.

This scenario has already been documented with another instant payment system. In September 2026, Kaspersky disclosed a campaign that swapped the Pix QR code and copy-and-paste code on the payment pages of 90 small and medium-sized online stores in Brazil; on the store's side, the order showed up as abandoned or pending. The same logic applies to any QR code displayed on a web page, QR Ph included.

Checklist for stores that accept QR Ph

• Use a dynamic QR per order, with amount and reference, instead of reusing a static code. Reconciliation is easier and mismatches stand out.
• Show the payee name the customer will see in their app next to the QR, and ask them to check it before confirming.
• Slim down the payment page: keep only the scripts you truly need and review regularly what loads there.
• Update your platform, theme and plugins, and remove what you don't use.
• Release orders on confirmed credit at your bank, e-wallet or provider, never on a screenshot sent by the customer.
• Treat "I paid but it wasn't confirmed" as a possible incident, and check whether the QR shown was altered.
• Monitor the live payment page, checking what buyers actually see.

If money is diverted

Move fast: tell the customer to contact their bank or e-wallet immediately, and alert your payment provider with the order details. Since July 2024, the Anti-Financial Account Scamming Act (AFASA, Republic Act No. 12010) penalises acting as a money mule for scam proceeds, allows institutions to hold disputed funds while they verify a transaction, and gives the BSP powers to investigate accounts linked to fraud. The sooner the dispute is raised, the better the chance that the funds are still held.

These steps shrink the attack surface, but a swap inside the page can only be stopped by checking, on the buyer's screen, that the QR code displayed is the one the store issued. That is what Proteside does at the moment of payment: it verifies the QR Ph code, blocks any swap before confirmation and alerts the store. See QR Ph protection. Try it free for 14 days, with the platform and payment provider you already use.