Protection for PromptPay payments
PromptPay made QR payments mainstream in Thailand, from street markets to e-commerce. Online, the QR code displayed by the page is the target: swap it and the entire transfer is diverted.
The payer is about to scan the PromptPay QR code.
Illustrative animation
PromptPay · Thailand
With PromptPay, the payer transfers money to an ID (phone number, national ID or business registration) or scans Thailand’s standardized QR code. What the page displays decides where the instant transfer goes.
How the attack happens without anyone noticing
PromptPay QR code swapped
The checkout QR code is replaced with another valid one, for the same amount, pointing to the scammer’s account.
Tampered destination ID
The displayed identifier is swapped for a similar one, and the app shows a plausible name at confirmation.
Manipulated amount
Dynamic charges have their amount altered on display.
How it works
Four layers between the scam and your payment
- 1
Record what’s legitimate
Proteside records the legitimate QR code, ID and amount of the PromptPay charge.
- 2
On-screen check
On the payer’s screen, it checks that what’s displayed matches what was issued.
- 3
Block before confirmation
Any mismatch is blocked before confirmation, essential on a rail with immediate settlement.
- 4
Alert and evidence
An alert and a record of the attempt for your team.
The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works
Protection scope
What’s covered
- The PromptPay QR code shown on your checkout, payment links and logged-in web areas
- PromptPay ID and amount shown to the payer
- Content copied with the “copy code” button
- Scripts and extensions that try to alter the payment page
Out of scope
- Printed QR codes or stickers displayed in physical stores
- Scams that happen outside your page (messages, phone calls or fake profiles)
- Settlement between institutions, which is already protected by the payment scheme’s infrastructure
Also protected by the same installation
One installation, every payment method in your checkout.
Frequently asked questions
Does it work for foreign payers?
Yes, including when apps from other countries pay Thai QR codes: what we guarantee is that the QR code on display is the legitimate one.
Do I need a separate installation for each country?
No. One installation covers every payment method your page displays, in any market.
Protection for PromptPay payments
Choose the path that fits your business: start a free trial for your store or book a demo built on your real payment flow.