PromptPay & QR code payment scams in Thailand
PromptPay is Thailand's everyday payment rail — which is exactly why scammers built several distinct tricks around it.
PromptPay links a bank account to a phone number or national ID and is used everywhere in Thailand via QR code — a legitimate, useful system on its own. The scams built around it don't attack PromptPay itself; they exploit how casually people scan a QR code or send money to a stranger through it.
Common PromptPay-related scams
- A QR code sticker at a shop or street stall looks slightly different, peeling, or placed over another one — some scammers paste a fake QR code over a merchant's real one so payments go to their own account instead
- A message from a 'friend' or 'relative' on LINE, urgently asking you to transfer money via PromptPay — often because their account was hijacked, not because they're really asking
- An investment or loan "agent" asks you to pay via PromptPay to a personal phone number rather than a registered business account
- An SMS claiming to be from your bank, with a link to a fake page asking you to 'confirm' a PromptPay transaction or account
- Someone offers you money to receive a transfer into your bank account and forward it on — this makes you a money mule, and can be treated as a crime in Thailand even if you didn't know the source
If you already sent money or acted as a mule
A wrong or scam PromptPay transfer is not automatically final — what to do next covers calling your bank and the AOC hotline in the first hours, which matters even more for instant transfers like PromptPay since the destination account is often emptied within minutes. If you were paid to receive and forward money, stop immediately and be prepared to explain the transfers if your bank or the police ask.
Questions
No — PromptPay is a legitimate national payment system; the scams here exploit how people use it (trusting a QR code, or a stranger's payment request), not a flaw in PromptPay itself.
Look for signs of tampering (a sticker on top of another, misaligned edges), and when possible confirm the receiving name shown after scanning actually matches the shop or person you expect — PromptPay displays it before you confirm, and it's worth actually reading.
Verify through a different channel first — call them, or ask something only the real person would know — before sending anything. Account takeovers on messaging apps specifically target the trust of an existing contact list.
It can be, even if you didn't know where the money came from — Thai authorities treat facilitating the movement of scam proceeds as a form of money laundering. Refuse any offer to use your bank account for someone else's transfers.