- You scan QR codes every day. At the counter of your favorite restaurant. At the cashier of your sari-sari store. On printed posters in malls and terminals. On stickers taped to payment terminals. On links sent through Messenger. Most of the time, it is completely safe. But a growing number of those QR codes are fake — and scanning one could hand your bank account, GCash wallet, or personal information directly to a scammer. The Bangko Sentral ng Pilipinas has issued a formal warning about a fraud method now rising sharply in the Philippines: Quishing.
- Quishing is a combination of "QR code" and "phishing." It works the same way as a fake link sent through email or text — except instead of a suspicious URL, the scammer hides the fraudulent link inside a QR code.
- When you scan it, you are taken to a fake website designed to look exactly like GCash, Maya, your bank's login page, or a payment portal. You enter your mobile number, PIN, or one-time password — and the scammer captures everything.
You scan QR codes every day. At the counter of your favorite restaurant. At the cashier of your sari-sari store. On printed posters in malls and terminals. On stickers taped to payment terminals. On links sent through Messenger. Most of the time, it is completely safe. But a growing number of those QR codes are fake — and scanning one could hand your bank account, GCash wallet, or personal information directly to a scammer. The Bangko Sentral ng Pilipinas has issued a formal warning about a fraud method now rising sharply in the Philippines: Quishing.
What is Quishing?
Quishing is a combination of "QR code" and "phishing." It works the same way as a fake link sent through email or text — except instead of a suspicious URL, the scammer hides the fraudulent link inside a QR code.
When you scan it, you are taken to a fake website designed to look exactly like GCash, Maya, your bank's login page, or a payment portal. You enter your mobile number, PIN, or one-time password — and the scammer captures everything.
The reason Quishing works so well is simple. With a regular phishing link, most people have learned to check the URL before clicking. With a QR code, there is no URL to read before you scan. You point your camera, the code resolves, and you are already on the page before you realize something is wrong.
Fake QR codes are showing up in the Philippines.
Scammers are placing fake QR codes in the exact locations where Filipinos expect to pay digitally. Stickers placed over legitimate GCash and Maya QR codes at store counters. Printed flyers are posted in terminals, markets, and public areas. Links sent through Messenger, Viber, or SMS asking you to scan a code to claim a reward, verify your account, or receive a refund. Fake payment terminals at pop-up stalls and events. Even restaurant menus — a QR sticker placed over the real one redirects you to a page asking for your login details before showing the menu.
The five Quishing red flags every Filipino needs to know.
1. The QR code looks like it was placed on top of something else. Legitimate store payment codes are printed directly on signage or laminated displays. A sticker placed over an existing QR code is a major warning sign. Peel it back if you can — many scammers simply put their fake code on top of the real one.
2. Scanning the code takes you to a login page you were not expecting. A legitimate payment QR code for GCash or Maya takes you directly to a payment confirmation screen — not a login page asking for your full credentials. If it asks for your password or MPIN after scanning, stop immediately.
3. The URL in your browser looks slightly wrong. After scanning, always check the address bar before entering anything. Scammers use URLs that look almost right: gcash-official.com, maya-app-ph.com, bpi-secure-login.ph. The official sites are gcash.com, maya.ph, and bpi.com.ph. One extra word or character in the URL means it is fake.
4. Someone sent you a QR code through a message. Financial institutions will not send QR codes through SMS, Messenger, or Viber and ask you to scan them to verify your account, claim a reward, or process a refund. If you receive a QR code this way, do not scan it.
5. The offer feels too good to be true. A QR code promising a cash prize, a refund you did not request, or exclusive access to a promo is almost always a trap. Legitimate promos from GCash, Maya, GoTyme, and banks are announced through their official apps — not through unsolicited messages with a code to scan.
How to protect yourself at every QR payment.
1. Before you scan any QR code for payment, take five seconds to do this.
2. Look at the code physically. Is it a sticker placed on top of something? Is it printed directly on the display? A sticker that does not belong there is the first red flag.
3. After scanning, read the name on the payment screen before confirming. GCash and Maya both show the registered name of the merchant or account you are about to pay. If the name does not match the store or person you are paying, cancel immediately.
4. Never enter your MPIN, password, or OTP on a page that opened from a QR scan unless you are certain you are on the official app. When in doubt, close the browser and open the GCash or Maya app directly to make your payment instead.
5. If a QR code takes you to a website instead of directly into your payment app, treat it as suspicious. Legitimate GCash QR codes open directly inside the GCash app. Legitimate Maya QR codes open inside the Maya app. A website that asks you to log in after scanning is not the same thing.
What to do if you think you scanned a fake code.
1. If you entered any personal information or financial credentials after scanning a suspicious QR code, act immediately.
2. Change your GCash MPIN and password right now through the official app. Change your Maya PIN and password through the official Maya app. If you use mobile banking, change your app password and notify your bank's fraud hotline.
3. Speed matters. The faster you act, the better your chances of stopping unauthorized access before any money moves.
If you think you've been Quished:
Report it to your e-wallet or bank immediately through their official app. For GCash, go to Help → Report a Scam. For Maya, go to Help Center → I want to report fraud. File a complaint with the BSP Consumer Assistance Mechanism at consumeraffairs@bsp.gov.ph or call 1800-10-BSP-3564 (toll-free). Under BSP regulations, institutions must investigate fraud claims and may reverse transactions if proven unauthorized — provide transaction IDs and evidence as soon as possible.