How to Spot a Fake QR Code Before You Pay
To spot a fake QR code, look for a sticker stuck over the original, check the web address it opens before you tap, avoid short links and misspelled bank names, and never enter passwords or OTPs. For PromptPay, pay only if the account name in your banking app matches the shop.
Fake PromptPay stickers over a shop’s real code
A common scam in Thailand: a fraudster creates a PromptPay QR for their own account, prints it as a sticker and pastes it over the real code at a shop counter, market stall, kiosk or car-park payment sign. Customers scan and pay as usual, but the money goes to the scammer. Shops often only notice when a customer says they paid and the money never arrived.
The fake code is a perfectly valid PromptPay QR, and every banking app will read it. Two things give it away: the edge of a sticker layered on top (raised, crooked, or a different size or colour from the sign), and the account name your banking app shows before you confirm. If the name doesn’t match the shop, stop and ask the staff.
For shop owners: check your QR signs daily, laminate them or put them behind glass, print your account name under the code so customers can compare, and consider showing the QR on a screen or card terminal instead of a permanent sticker.
Where else fake QR codes show up
Parking signs and fake fines
Signs or “parking violation” notes with a QR code to pay a fine often lead to fake payment pages that ask for card details. Real government fines have payment channels you can verify on a .go.th site.
Parcels and deliveries
“Missed delivery” cards with a QR code asking you to confirm your address or pay a small fee usually lead to a fake courier site. Open the courier’s own app or website and type your tracking number instead.
SMS, email and LINE
Messages claiming to be from a bank, the electricity authority or the Revenue Department with a QR image to “claim a refund” or “verify your identity”. Real organisations don’t send QR codes for you to log in or install an app.
6-step checklist before you scan
- 1
Look at the code itself
Check for a sticker stuck over the printed code — raised or crooked edges, or a size that doesn’t fit the sign. If in doubt, ask the staff.
- 2
Read the web address before opening it
Your phone camera shows the domain before it opens the link. Read it in full, or use the QRLoom QR safety checker to see the real destination.
- 3
Distrust short links and look-alike names
Short links hide the real destination. Names like “kasikornbonk” or “scb-th” are not your bank. Real Thai government sites end in .go.th.
- 4
Never log in or enter an OTP from a QR page
If you need to log in to your bank, close the page and open your banking app yourself. Never type card numbers, OTPs or passwords into a page reached from a QR code.
- 5
PromptPay: check the payee name before you confirm
Your banking app shows the recipient’s account name before you confirm. Only pay if it matches the shop and the amount is what you owe.
- 6
Don’t install apps or add LINE accounts from unexpected codes
QR codes on flyers, fine notices or unexpected messages can lead to money-stealing apps or scam chats. Contact the organisation through its official channels instead.
What to do if you already paid a scammer (Thailand)
Speed matters — the sooner you act, the better the chance of freezing the money. Do this right away:
- Call your bank immediately (the number is on your card or in the app). Say you were scammed and ask them to hold the transfer and freeze the receiving account.
- Call 1441, Thailand’s Anti Online Scam Operation Center (AOC) hotline, open 24 hours.
- File a report online at thaipoliceonline.go.th, the Royal Thai Police’s official reporting site.
- Keep evidence: your transfer slip, screenshots, a photo of the QR code you scanned and any chat messages.
- If you typed a password or installed an app from the link, change your passwords from another device and tell your bank.
Watch out for a second scam: Thai police say the only official online reporting channels are the 1441 hotline and thaipoliceonline.go.th. Facebook pages, LINE accounts or apps offering to file reports or “recover your money” are fake.
You can also report the fake code to us on the QR checker page to help warn others.
Frequently Asked Questions
Does a fake QR code look different from a real one?
Usually not — fake codes follow the same standard, so the pattern itself tells you nothing. Look for a sticker on top, the web address the code opens, and the payee name in your banking app.
Is it dangerous just to scan a QR code?
Scanning alone is rarely harmful. The danger is in what follows: entering details on the page, installing an app, or paying a fake account.
Does my banking app protect me from fake PromptPay codes?
Your app shows the recipient’s account name before you confirm, which is the best protection there is — but it can’t know who you meant to pay. You have to compare the name with the shop.
Who do I call in Thailand if I paid a scammer?
Call your bank first to freeze the receiving account, then the 1441 hotline (24 hours), and file a report at thaipoliceonline.go.th.