Fake Payment Screenshots and Swapped QR Codes in the Philippines: What Shop Owners Should Do

While the customer is still in the shop: release goods on credit received

Hold one line at the counter: what counts is the credit the payee can see, and nothing on the customer's phone counts at all. The rule is simple. It breaks down in practice because the shop is busy, staff feel awkward, or the customer acts offended.

Steps staff can follow directly:

1. Look at your own device. Open the merchant app or wallet, refresh the transaction list, and match amount, time and reference number. A voice alert or SMS is a helpful prompt, but alerts can be imitated, so the in-app record is the final word.
2. If nothing has arrived, wait politely. Something like: the system has not shown it yet, please give it a moment and I will hand this over as soon as it does. There is no need to accuse anyone, because genuine network delays do occur, and a customer who really paid will usually wait a few minutes.
3. Stay calm when pressed. I am in a hurry, look, I already paid, and your system is the problem are the three lines heard most often in fake-screenshot cases. The more someone needs to leave, the more important the credit becomes.
4. Offer another route. Ask for cash or card, or invite the customer to open their own transaction history. A real transfer shows a debit and a reference number on the sender's side.
5. No goods and no change. A common variant is the overpayment, where you are asked to refund the difference in cash. Refund nothing until the credit is confirmed.

If the person takes the goods and walks out, do not chase them into a physical confrontation. Keep the camera footage and report it. A guard can be present, but do not detain anyone yourself. The limits that apply to shops are the mirror image of what is described in being held by mall security: a merchant has no general power to restrict a person's liberty.

How fake proof of payment is produced, and why eyes alone will not catch it

Do not invest effort in spotting a forged image, because a good one cannot be told apart by eye. Invest it in confirming the credit. The value of knowing the methods is that staff understand why a screen can never release goods.

Common methods:

• Edited images. A genuine success screen with the amount, time, payee and reference changed. Fonts and layout are identical to the real thing.
• Imitation apps or web pages. These reproduce the payment app's success screen, can generate one on the spot for any amount, and may even animate.
• Recycled receipts. A screenshot from a real earlier purchase at your shop, shown again with the date altered or simply in the hope that nobody checks it.
• Send, then cancel. A transfer that shows as processing is started through some channel and later cancelled or fails for lack of funds. Processing is presented as paid.
• Forged credit alerts. A text or email made to look as though it came from the provider, saying funds were received. Sender names can be imitated, so an alert is a prompt and never proof.
• The online-order version. A buyer in chat sends a screenshot and pushes for dispatch. By the time the missing credit is noticed, the parcel is in transit.

Conditions that get exploited include peak hours, new staff, an owner who is away while staff accept payment on personal phones, and a collection account that sits on the owner's phone where staff cannot see it. The last is the biggest gap. If the person at the counter cannot confirm the credit, the rule cannot be applied. The fix is a view-only sub-account or a payment speaker for staff; opening a business account is explained in how to open GCash Business.

If the goods are already gone: evidence, reconciliation and reporting

Whether anything can be pursued afterwards depends on how much evidence pointing to the person you kept that day. Many owners write off a small loss, but keeping a record costs little, and the same person often works the same area repeatedly.

1. Confirm the money truly did not arrive. Check the full transaction list and compare it with the day's settlement to rule out a delayed credit or a payment to another of your accounts.
2. Save the camera footage. Export the relevant period, because many systems overwrite on a loop. Pull stills that show face, clothing, companions and vehicle.
3. Keep the fake proof. If staff photographed the customer's screen or received the screenshot, keep it unaltered. For online orders, keep the whole chat, the buyer's account, the delivery address and the tracking number.
4. Write an account. Time, items and quantities, what was said, and which staff member dealt with it, written the same day.
5. Try to stop the delivery. If an online order is still in transit, ask the courier or rider platform to return it.
6. Report. Have the incident recorded at the local police station and file a complaint, following how to report to the police in the Philippines. Where forged electronic proof or online ordering is involved, you can raise it with the cybercrime units as well; see how to report cybercrime in the Philippines.
7. Warn neighbouring shops. Describe the method in merchant groups, but do not post the person's photo or personal details publicly. Naming someone before any finding has been made can expose you to libel and privacy complaints.

Realistic expectations: recovery in small cases is limited. A report mainly creates a record, supports an insurance claim or internal write-off, and gives you something to rely on if the person returns. Whether a civil claim is worthwhile depends on the amount and on whether the person can be identified.

If your QR code was swapped: take it down, then work out when it started

When more than one customer says they paid and nothing arrived, the first thing to check is whether the code on display is still yours. The method is crude: someone places their own code over the one on your stand, table sticker or counter poster. Customers scan as usual and the money goes elsewhere.

The order of response:

1. Remove every displayed code immediately. Counter stands, each table sticker, door posters and stickers on takeaway packaging. Scan each one with your own phone and check that the payee name shown is your business.
2. Keep the planted code. Do not tear it up. Photograph it in place and keep the physical sticker, since the account behind it is the most direct lead.
3. Establish the time window. Review camera footage for the moment of the swap, and use the sales system or handwritten log to list every order in that period where the customer paid and no credit arrived.
4. Contact the payment provider. Through merchant support, report that another account has been collecting your shop's payments, give the account details from the planted code and the affected period, and ask for action on that account. Whether funds come back is decided by the provider and any investigation, and nobody can promise it in advance.
5. File a report with the planted code, footage and the list of affected orders.
6. Issue new codes and fix their position. Regenerate and reprint, and keep them behind the counter or in staff sight.

As for customers who already paid: they acted in good faith and the money did leave their accounts. Where you can reach them, ask them to keep their own payment records, which show where the funds went. Whether to ask them to pay again is a judgment that mixes law and goodwill, and most small shops choose not to.

One unpleasant possibility has to be considered: the swap was done by someone inside. Substituting a personal code for the shop's is a familiar form of skimming in retail and food service. Look at the evidence before drawing conclusions.

Controls a small shop can run: five rules beat any detection trick

Payment fraud is prevented by process, not by sharp eyes, and the heart of the process is that the person who can see the credit and the person who releases the goods have the same information. None of the five rules below needs much spending.

1. Let cashiers see credits themselves. Give staff view-only access to transactions or a payment speaker. Do not have them photograph the customer's screen and send it to the owner for approval, since that is exactly where a forged image does its work.
2. Put the rule in one sentence inside the counter. No credit seen, no goods, no refund, no change. Tell staff plainly that an unhappy customer caused by following it will not be held against them.
3. Prefer dynamic codes. A one-time code generated per order with the amount embedded defeats both swapping and mistyped amounts. If you must use a static code, keep it behind the counter and scan it at opening each day to confirm the payee name.
4. Reconcile daily. Match QR sales in the point-of-sale system against the provider's credits each day. Swaps and internal skimming both depend on nobody checking. With a daily check the loss is capped at one day.
5. Ship online orders on back-office credit only. A screenshot in chat is informational. For larger orders, wait until the status moves from processing to completed.

At company level, hold the collection account in the business's name and not in an employee's personal wallet, and separate the person who collects from the person who reconciles. The cost of controls that are too loose or too tight is discussed in what payment risk control is for, and operational problems such as a transfer to the wrong recipient are in GCash transfers and troubleshooting.

These rules have a price. Waiting for credits slows the queue at peak times, and an occasional genuine payer will be irritated. That is an acceptable cost. Asking the customer to show the debit status in their own history, or to pay another way, normally settles it without friction.

The report file, reactions that create trouble, and what Yixing can do

A report should make four things clear: who, when, what was taken, and which account the money should have reached but did not, each backed by material that can be checked independently. A complete file is accepted more smoothly.

A workable file contains business registration and proof that you hold the merchant account; a full export of merchant transactions for the period; footage and stills; photos of the fake proof or the planted QR sticker itself; a list of affected orders with a loss summary; written statements from the staff involved; and chats and delivery details for online orders.

Several reactions tend to put the merchant on the back foot: posting a suspect's image on social media or on the shop door; holding the person or their belongings; accusing a named employee without evidence and withholding wages; and accepting a private settlement far above the actual loss. Each can turn a victim into a respondent. If a dispute with a customer becomes physical, see what to do after a fight with a local.

Two further cautions. First, someone may contact you later claiming inside access that can recover the money for an advance fee; that is a recovery scam, discussed in what to do after being scammed. Second, if someone has used your documents to open a collection account that poses as your shop, the issue is identity misuse, covered in what to do when your ID is used to open an account. Transfer scams aimed at individuals, such as fake pleas from relatives, are in what to do about deepfake impersonation.

What Yixing can do. Yixing is a private consultancy registered with the Philippine SEC (Registration No. CS202009551), accredited by the Bureau of Immigration (Accreditation No. CA-202624381-1, valid to 30 June 2027), and by DOLE and the Philippine Retirement Authority. It is not part of any government body. For clients running small shops we can help assemble the report file and an English statement of facts, accompany you to the police station, assist in communicating with a provider's merchant support, and explain the compliant route to holding a collection account in a company's name. See our settling-in support. We cannot recover money, cannot influence a provider's or an agency's decision, and do not give legal advice. Consult a licensed lawyer about your own case; this article is not legal advice.