BSP Warns of QR Code 'Quishing' Scam Hitting Filipinos
Bangko Sentral ng Pilipinas issued a consumer advisory about quishing — a scam where fraudsters use manipulated QR codes to trick people into visiting fake websites, downloading harmful content, or sending cash to criminal accounts.
Key Takeaway
QR code tampering is now the easiest way for scammers to steal digital payments in the Philippines.
Fraudsters paste malicious QR codes over legitimate merchant codes to redirect customer payments straight into scammer accounts, according to Bangko Sentral ng Pilipinas.
The attack works because QR codes mask the underlying web address, making malicious links nearly impossible to spot before scanning. Fraudsters physically tamper with legitimate codes by pasting stickers over the original, diverting funds to their own accounts before merchants realize what happened.
Bangko Sentral ng Pilipinas Banking Officer V Dr. Gregorio Baccay III recommended four specific defenses: scan codes only from verified sources, physically inspect codes for signs of tampering like stickers over the original, preview the URL on your smartphone before opening it, and never enter sensitive financial details on sites accessed through a QR scan.
BSP Circular No. 1160 separately urges financial institutions to transition away from SMS-based one-time passwords toward stronger security measures including biometrics and in-app approvals.
The advisory also covered smishing — fraudulent text messages pretending to be from official institutions to steal passwords or OTPs. BSP processed 43,115 consumer complaints in 2023, nearly double the 22,142 complaints filed in 2022, with the central bank publishing the consumer advisory on April 7, 2026.
🇵🇭 Filipino Impact
Filipino consumers using GCash, Maya, PDAX, and Coins.ph QR payment features face direct risk from tampered codes at merchants. BSP's push to replace SMS-based OTPs with biometrics under Circular No. 1160 will affect all Philippine banks and e-money issuers. Physically checking for sticker overlays on QR codes is now essential before every scan at stores and restaurants.
This article was written based on reporting from Fintechnews.
