PromptPay QR Code Scams in Thailand: How to Protect Your Money

PromptPay (พร้อมเพย์) has become Thailand's default payment method. From street food vendors to department stores, scanning a QR code to pay is faster than counting cash. But this convenience has attracted a wave of sophisticated scams. Thailand's Cyber Crime Investigation Bureau reported a sharp rise in QR-related fraud cases throughout 2025, with losses running into hundreds of millions of baht.

Here is how the scams work and how to protect yourself.

How PromptPay QR Code Scams Work

1. The Fake QR Overlay

Scammers print their own QR code sticker and paste it directly on top of a legitimate merchant's QR code. You scan what appears to be the shop's payment code, but the money goes straight to the scammer's account. This happens at market stalls, parking meters, and even convenience store counters.

Why it works: The physical QR code looks identical to the original. Unless you check the recipient name carefully, you will never notice the swap.

2. The Fake Payment Request

You receive a PromptPay payment request notification — seemingly from a legitimate source like your landlord, a delivery service, or a utility company. The request looks authentic, complete with the correct logo and amount. But the receiving account belongs to a scammer.

3. SMS and LINE Phishing

A text message or LINE message arrives claiming there is a "problem with your PromptPay registration" or a "pending refund." The link leads to a fake bank login page that harvests your credentials and OTP codes.

4. The Refund Reversal Scam

A buyer at a market claims they "accidentally overpaid" via PromptPay and asks you to transfer the difference back. The original payment was made from a stolen account and will eventually be reversed, leaving you with a double loss.

5. Fake Merchant QR in Online Marketplaces

On platforms like Shopee, Lazada, or Facebook Marketplace, sellers provide a PromptPay QR code for "direct payment" to avoid platform fees. The QR code leads to a mule account. Once you pay, the seller vanishes.

PromptPay Scam Types at a Glance

Scam Type	Where It Happens	Risk Level
Fake QR Overlay (แปะ QR ปลอม)	Markets, parking, stores	Very High
Fake Payment Request	LINE, SMS notifications	High
SMS/LINE Phishing (ฟิชชิ่ง)	Text messages, LINE chats	Very High
Refund Reversal	Markets, online sales	High
Fake Merchant QR	Facebook, Shopee, Lazada	High
Fake Bank App Screenshot	Person-to-person sales	High

Your PromptPay Verification Checklist

Before scanning or paying any QR code, run through this checklist:

Before Scanning

• Check for sticker overlays — Feel the QR code. Is there a sticker on top of another sticker?
• Look at the edges — Does the QR code align with the sign, or is it slightly crooked or different material?
• Ask the merchant — Confirm the recipient name before completing the payment
• Check the URL — If the QR opens a website, verify it is a legitimate bank domain

Before Confirming Payment

• Verify the recipient name — Does it match the merchant or person you intend to pay?
• Check the account type — Merchant accounts show business names, not personal names (for stores)
• Confirm the amount — Make sure the amount has not been altered
• Never share your OTP — No legitimate payment requires you to share your OTP with anyone

After Payment

• Save the transaction slip — Screenshot the confirmation immediately
• Verify with the merchant — Confirm they received the correct amount
• Monitor your account — Check for any unauthorized follow-up transactions

What Makes Thailand Particularly Vulnerable

Thailand's rapid adoption of cashless payments through PromptPay has outpaced security awareness. Several factors increase vulnerability:

1. High QR adoption rate — Over 70 million PromptPay registrations means a massive target pool
2. Trust in QR codes — Most users assume any QR code at a business is legitimate
3. Limited verification habits — Many users confirm payment without checking the recipient name
4. Language barriers — Scam awareness content is often in English, not Thai
5. Market environments — Busy, loud settings make careful verification harder

How to Report PromptPay Fraud

If you suspect fraud, act immediately:

1. Contact your bank — Call the hotline on the back of your card (not a number from a text message)
2. File a police report — Visit your local police station or use the online system at thaipoliceonline.com
3. Report to the Bank of Thailand — Call 1213 for financial consumer protection
4. Notify the Anti-Online Scam Operation Center — Call 1441

Share Payment Details Securely

When you need to share PromptPay account numbers, bank details, or payment QR codes with someone you trust, avoid sending them through LINE or SMS where they can be intercepted or forwarded. Use LOCK.PUB to create a password-protected link that auto-expires. The recipient enters the password to view your payment information, and it disappears after expiration — no trace left in chat history.

Advanced Protection Tips

• Enable transaction notifications for every PromptPay payment on your banking app
• Set daily transfer limits to reduce potential losses from unauthorized transactions
• Use biometric authentication (fingerprint or face) instead of PIN for banking apps
• Regularly review your PromptPay registration through your bank to ensure no unauthorized changes
• Be skeptical of urgency — Scammers always pressure you to act fast

The Bottom Line

PromptPay is safe when used with awareness. The key is verification: always check the recipient name, always inspect QR codes physically, and never act on payment requests received through SMS or LINE without independent verification.

When you need to share sensitive payment information with family, roommates, or business partners, visit LOCK.PUB to create free encrypted links that self-destruct after use.