QR Code Payment Swap Scams: Always Verify the Recipient Name Before You Pay

Scammers swap legitimate QR codes in stores so your GCash or Maya payment goes to them instead of the merchant. Here's how to spot it and protect yourself.

What Is a QR Code Payment Swap Scam?

Cashless payments using QR codes have become a normal part of life in the Philippines — from sari-sari stores to mall stalls, a printed code on the counter is often all you need to settle a bill. This convenience, however, has opened a door for a deceptively simple trick: scammers quietly replace or cover a legitimate merchant's QR code with one linked to their own account. The swap can happen in seconds. A fraudster visits a store, stall, or market, and either replaces the printed QR standee entirely or sticks a new sticker over the original. When an unsuspecting customer scans the code and pays, the money flows directly to the scammer — not the merchant. The merchant may not discover the swap for hours, and by then the scammer is long gone. Understanding how this qr code scam philippines variant works is the first step to protecting your hard-earned piso. You can also check any suspicious payment detail on TsekMuna before you complete a transaction.

Why the Recipient Name Is Your Most Important Safety Check

Every legitimate GCash or Maya QR payment shows you a confirmation screen before you hit 'Pay.' That screen displays the recipient's registered name — this is your single most powerful defence against a QR swap scam. Scammers cannot easily change the name tied to their account to exactly match the merchant's business name or the person you expect to pay. Many people are in a hurry at the counter and simply tap 'Confirm' without reading the screen. This is exactly the habit scammers rely on. Taking three extra seconds to read the recipient name can save you from losing money to a complete stranger. Think of it like checking the name on a cash envelope before handing it over — the same care applies in the digital world. For a broader look at how fraudsters exploit everyday payment habits, visit our scam education hub for more practical guides.

How to Spot a Swapped QR Code

Warning signs

• The QR code standee or sticker looks newer, shinier, or slightly misaligned compared to the rest of the counter display.
• There are visible edges or bubbles under a sticker, suggesting something was placed on top of an original code.
• The recipient name on your confirmation screen does not match the store name or the cashier's name when you ask.
• The merchant looks confused or asks you to pay again after you insist you already paid.
• You are in a high-footfall area — wet markets, transport hubs, food courts — where a fraudster could blend in and tamper without attracting attention.
• The QR code is not laminated or secured in a permanent frame, making it easy to swap out.

Step-by-Step: How to Pay Safely with a QR Code

1. Open your GCash or Maya app and scan the merchant's QR code as usual.
2. BEFORE entering the amount, look at the recipient name displayed on screen. Ask yourself: does this match the store name or person I expect to pay?
3. If the name looks unfamiliar or generic (e.g., a random personal name when you are in a branded store), stop and ask the cashier for clarification.
4. Ask the cashier or vendor to confirm their registered account name verbally so you can compare it to what your app shows.
5. Only after the names match should you enter the payment amount.
6. On the final confirmation screen, read the recipient name one more time before tapping 'Pay' or 'Send'.
7. Keep your transaction receipt or screenshot as proof of payment, including the timestamp and reference number.
8. If the name does NOT match and the cashier cannot explain why, decline to pay via QR and offer cash or ask for an alternative payment method.

Make it a habit to read the confirmation screen out loud quietly — 'Paying to [Name]… yes, that's correct.' That tiny pause prevents most QR swap mistakes.

What to Do If You've Already Paid the Wrong Account

Discovering you paid a scammer is stressful, but acting quickly improves your chances of recovery. This guidance is advisory only and not legal advice.

What to do instead

• Take a screenshot of your transaction immediately — record the reference number, recipient name, and amount.
• Inform the merchant right away so they can also document the incident and secure their QR display.
• Contact GCash Support (in-app Help Center) or Maya Support and report the erroneous transfer using your reference number. Request a transaction hold if possible.
• File a complaint with the Bangko Sentral ng Pilipinas (BSP) Consumer Assistance Mechanism if your e-wallet provider is unresponsive.
• Report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) at their official hotline or e-mail, providing all screenshots and details.
• You may also lodge a complaint with the NBI Cybercrime Division for a formal investigation.
• Ask the merchant to report the physical QR tampering to their local barangay or police station so the area can be monitored.

Advice for Store Owners and Merchants

Merchants are often the silent victims of QR swap scams — a customer pays but the money never arrives, creating confusion and distrust. Protecting your payment display is just as important as protecting your stock. Learn how to spot a scam before it affects your business.

What to do instead

• Laminate your QR code and mount it inside a sealed, hard-to-open frame so it cannot be easily replaced.
• Place your registered account name visibly beside the QR code so customers can verify it themselves.
• Check your QR display at the start of every business day and after any period when the counter was unattended.
• Brief your staff to watch for anyone lingering near the payment area without making a purchase.
• Confirm with customers that their app shows your correct account name before they complete payment.
• Report any discovered tampered codes to your e-wallet provider's merchant support line immediately.

Some merchants write their registered account name in large, bold text right next to the QR code. This simple step alone helps customers self-verify every single payment.

Common Myths About QR Code Payments

There are a few widespread misconceptions that make people more vulnerable to this type of fraud. Let's clear them up. **Myth 1: 'QR codes are hack-proof.'** A QR code itself is just a link or an account identifier — it is not encrypted in a way that prevents physical replacement. Anyone can print a new one. **Myth 2: 'I would notice if a QR code was tampered with.'** Scammers are skilled at making swaps look seamless. A high-quality sticker printed on glossy paper can be nearly indistinguishable from the original. **Myth 3: 'The store is responsible, so I'll get my money back automatically.'** Responsibility depends on the circumstances. E-wallet providers investigate on a case-by-case basis, and recovery is not guaranteed — which is why prevention is far better than cure. **Myth 4: 'This only happens in sketchy places.'** QR swap incidents have been reported in busy, reputable markets and commercial areas. Scammers follow foot traffic, not venue reputation.

How TsekMuna Can Help

If you receive a QR code, payment link, or account number through a message or social media and you are unsure whether it is legitimate, you can run a free scam check on TsekMuna to see if it has been flagged by other users. While physical QR swaps happen in person, fraud often begins with a digital message directing you to scan a code — and that is where our database can help you pause before you pay. For a deeper dive into the many forms of payment fraud in the Philippines, explore our guide on GCash and Maya safety tips to build stronger habits across all your digital transactions.

Run a free scam check · More scam-safety guides