How the scam unfolded
Store owners in Cavite lost more than P23,000 from their e-wallet after a suspect used a QR Code scam to trick them, according to a report by Ian Cruz on GMA News' “State of the Nation.” The incident occurred in a store in Cavite, where the suspect posed as a customer requesting to “cash in” money using a QR Code. CCTV footage captured the suspect scanning a QR Code and leaving quickly after the transaction.
The victims, who run a small store, initially thought the transaction was legitimate. They discovered the loss only when they checked their e-wallet balance later, finding that over P23,000 had been deducted without their authorization. The suspect used a method known as QR code phishing, or quishing, to redirect the payment to a fraudulent account.
How the scam works
In a QR Code scam, the fraudster generates a fake QR code that, when scanned by the victim, directs to a malicious website or a payment page controlled by the scammer. In this case, the suspect allegedly asked the store owners to scan a QR Code to “cash in” money, but the code actually triggered a transfer of funds from the store’s e-wallet to the scammer’s account.
The Philippine National Police Anti-Cybercrime Group (PNP-ACG) said that QR code scams are becoming more common, especially targeting small businesses. The scammer typically uses social engineering to convince the victim to scan the code quickly, without verifying the destination.
What victims should do
The PNP-ACG advises victims to immediately report the incident to their e-wallet provider and the police. Affected store owners in Cavite have filed a complaint at the local police station. They also urged others to secure their accounts by enabling two-factor authentication and monitoring transactions regularly.
How to avoid the QR Code scam
The police and cybersecurity experts recommend the following measures to avoid falling victim to QR code phishing. First, always verify the source of the QR code before scanning. Do not scan codes from unknown individuals or suspicious posters. Second, check the URL that appears after scanning—if it looks unfamiliar or misspelled, do not proceed.
Third, use e-wallet apps that have built-in security features, such as transaction limits and alerts. Fourth, never share your e-wallet PIN or password with anyone. The store owners in Cavite reported that they did not receive any security notification from their app, which the PNP-ACG is now investigating.
Authorities warn public
The National Bureau of Investigation (NBI) and PNP-ACG have issued separate warnings about the rising number of QR code scams across the country. In a statement, the NBI said that scammers often target high-traffic areas, including markets and sari-sari stores, where owners are busy and may not be vigilant.
“We urge the public, especially store owners, to be extra cautious when processing cash-in transactions using QR codes. Always double-check the transaction details before confirming,” the PNP-ACG said in a statement.
The Cavite police are now reviewing CCTV footage and other evidence to identify the suspect. They are also coordinating with e-wallet companies to trace the fraudulent account.
Impact on small businesses
For small store owners, losing over P23,000 is a significant blow. The victims in Cavite said they are now more cautious about accepting digital payments. One of the owners, who requested anonymity, told GMA News that they will no longer allow customers to scan QR codes unless they personally know them.
Consumer groups have also raised concerns, calling on e-wallet providers to improve security measures and provide better consumer protection. The Department of Trade and Industry (DTI) said it is monitoring the situation and may issue new guidelines for digital payment systems.
Forward-looking statement
As investigations continue, authorities remind the public to stay updated on the latest scam tactics. The police expect to release more information on the Cavite case in the coming days, while urging all store owners to report any suspicious QR code transactions immediately.
