A fake GCash payment page usually gives itself away through its web address, a strange payee name or a layout that does not match the app. If a QR scan opens a web page that asks for your login, MPIN or one-time code, close it, because a normal in-app payment does not need those details typed into a website.

GCash and Philippine media have reported scams in which fake sites imitate GCash payment pages and use QR Ph style codes to collect money. Some of these sites are linked to illegal gambling and fraudulent merchants. The pages can look neat and professional, so learn the checks below rather than relying on a quick glance.

Check one: where did you end up

The first question is whether the scan stayed inside the app. When you scan a code with the scanner inside GCash, the app shows its own payment screen with the payee name and amount. If your phone's camera or another scanner opened a web browser, you are looking at a website, not the app. A website can be real, but it can also be a copy.

If a browser opens, look at the address bar before you type anything. Scammers rely on you ignoring it.

Check two: the address

GCash has said the official payment page lives under its own domain. Fake pages use addresses that try to imitate it by adding extra words, hyphens or a different ending, or by swapping a letter for a lookalike. Media reports of the warning included examples of this style of address. Do not memorize examples, because scammers invent new ones constantly. Instead, treat any address that is not exactly the official one as untrustworthy.

If you are not sure what the official address looks like, do not guess. Open the GCash app yourself and make the payment there, or use the Help Center to verify.

Check three: what the page asks for

A genuine payment flow does not ask you to type your MPIN or a one-time code into a web form that appeared after scanning a sticker. If a page asks for a login, your MPIN, a card number, a code from an SMS, or a photo of your ID, stop. That is the pattern of a phishing page.

Also be suspicious of pages that pressure you with timers, threats that your account will be closed or promises of rewards. Urgency is a scammer's friend.

Check four: the payee name

Fake merchants often have names that look like random strings of letters and numbers, or names that do not match the place you are standing in. GCash has listed odd merchant names among the warning signs. Compare the name with the shop sign or the seller you are dealing with. A mismatch is a reason to stop.

Check five: the layout

A page that looks unfamiliar, with different fonts, odd spacing, spelling mistakes or buttons that do not behave like the app, deserves caution. GCash has said that pages which look inconsistent with the standard interface are a warning sign, even when the logo looks right. A logo is easy to copy. The full experience is harder.

Check six: the context

Where did the code come from? A sticker at a busy counter that looks pasted over another one, a poster in a public place, a receipt or an email can all carry fake codes. A code sent by someone you do not know, along with a story about a prize, a refund or an urgent bill, should make you think twice. Trust the situation as well as the screen.

What to do if you see a suspicious page

Example GCash app screen for our guide on fake gcash payment page

Do not enter anything. Close the tab. If you have already typed something, do not wait: change your credentials through the official app, contact support through the Help Center and consider notifying your bank if you entered card details. Our guide on scanning a fake code lists the steps in order.

Take a screenshot of the page and its address bar if you can do so safely, because it helps when you report it.

Reporting

GCash says users can report scams through the Help Center, by messaging its virtual assistant and choosing the option to report a scam, or by calling the hotline, which is 2882 for Globe and TM users. News coverage also mentions that consumers can use the Bangko Sentral ng Pilipinas consumer protection channels. Reports help GCash block fraudulent merchants and take down fake sites.

Building the habit

Make three checks automatic: stay in the app, read the payee name, never type secrets into a web page after a scan. You will not need to think about it after a few weeks. Teach the same rule to friends and relatives, who may be more likely to click or scan without looking.

A note for merchants

If you run a shop, check your own displayed code often. Make sure the name that appears when you scan it is yours. A fake sticker over your code means customers will pay a scammer. Tell customers to check your shop name on their screen before paying, and place your code where you can watch it.

A short example

Gelo scans a code at a pop-up stall using his camera app, and a web page opens with a logo and a login box. The address looks odd and the page asks for his MPIN. He closes it and opens GCash instead. He scans the same sticker with the in-app scanner and sees a payee name that does not match the stall. He decides not to pay and tells the organizers that the sticker may be fake.

This guide is independent and not affiliated with GCash. We last checked these points against GCash statements and Philippine news coverage in November 2026. Scam tactics evolve, so stay alert and follow official advice.

Keep reading

More guides in this section: GCash QR Code Safety and Business Guides: Scams, Sellers.

Back to the main guide: GCash QR Code: How to Generate, Scan & Pay with QR Ph.