Quishing is QR phishing: scammers put a fake QR code in front of you, and scanning it takes you to a fake payment page, a fake login screen or a payee that is not who you think. In 2026, GCash and Philippine news outlets repeatedly warned users about this kind of fraud, and the Bangko Sentral ng Pilipinas flagged it as a growing threat.

The word comes from combining QR and phishing. Classic phishing tricks you into typing your details into a fake website. Quishing does the same thing but hides the link inside a square picture, so you do not see the address before you scan.

How the trick works

A scammer creates a QR code that points to their own page or account. They then put that code where victims will see it. When you scan it, one of several things can happen. You might land on a web page that imitates a GCash payment page and asks for your login. You might be shown a payee that sends your money to the scammer. Or you might be sent to a site that tries to install harmful software on your phone.

The page can look convincing. It may copy official colors and logos. It may even say your payment is being processed. Scammers count on you being in a hurry and not checking the details.

Where fake codes appear

GCash and several news reports describe fake codes placed in posters, in emails, on receipts and in messages. A sticker pasted over a genuine code at a counter is another known trick. Fake sellers on social media may also send a code in chat and pressure you to pay quickly.

Some scams use a story to make you act. A message might say you have been given financial aid or a prize and must scan a code to claim it. GCash warned about a spoofed text of this type that pretended to offer calamity assistance, and advised people not to click suspicious links or scan unknown codes.

What GCash says to watch for

Public statements from GCash point to a few warning signs. One is a web address that imitates GCash, with extra words or swapped letters, instead of the official payment page under GCash's own domain. Another is a payment page that looks unfamiliar even though it shows official logos. A third is a merchant name that looks like a random string of characters. A fourth is a page layout that does not match what you normally see in the app.

GCash has also said it blocks suspicious merchants and accounts linked to these schemes and works with regulators and law enforcement. That is useful, but you still need your own habits, because new fake codes appear faster than any list can catch them.

Example GCash app screen for our guide on gcash qr code scam

A simple routine that protects you

Step one: scan only codes that come from places you trust, such as a shop you can see or a seller you have verified.

Step two: use the scanner inside the GCash app, not a random scanner app, so the payment stays inside the app you know.

Step three: read the payee name and amount before you confirm. If the name looks odd, stop.

Step four: if a web page opens and asks for your login, MPIN or one-time code, close it. Real payments inside the app do not need you to type those into a website.

Step five: keep your MPIN and one-time codes to yourself, no matter who asks.

Why scammers like QR codes

A QR code hides its destination, so it is hard for a person to inspect. It also feels modern and official, and people have learned to trust it for everyday payments. A scammer can print a thousand stickers cheaply and leave them in places where people pay without thinking. That low cost and high trust make codes attractive for fraud.

Who is most at risk

Anyone can be fooled when they are tired, rushed or distracted. People who pay in busy places, such as markets and transport hubs, may be more exposed to pasted stickers. Online shoppers can be targeted by fake sellers who send codes in chat. Older relatives who are new to QR payments may not know the warning signs, so it is worth teaching them.

What to do if something feels wrong

Screenshot of the GCash app related to gcash qr code scam

Stop before you pay. Take a screenshot of the code or page if you can. Close any web page that asked for personal details. Check your transaction history to make sure no payment went out. If you shared any codes or logged in on a fake page, follow the steps in our guide on what to do after scanning a fake code.

Report the incident. GCash has said you can report scams through the Help Center, by chatting with its virtual assistant and selecting the option to report a scam, or by calling the hotline, which is 2882 for Globe and TM users.

Teaching others

Share these ideas with family and friends. A short rule of thumb is: check the name, never type secrets into a web page after scanning, and when in doubt, ask. Teach older relatives to call a family member before they pay a code that arrived in a message.

If you run a shop, check your own sticker regularly. Make sure nothing has been pasted over it. Customers trust that your code goes to you, and a swapped sticker harms both of you.

A short example

Lani receives a message saying she has won a prize and must scan the attached code to claim it. She does not scan. She remembers that prizes do not require a payment, and that a code from a stranger is a red flag. She deletes the message and reports it using the Help Center. A friend who scanned a similar code ended up on a page asking for a login, and had to secure her account afterward.

This guide is independent and not affiliated with GCash. We last checked these points against GCash statements and Philippine news coverage in November 2026. Scam methods change, so keep following official advisories.

Keep reading

More guides in this section: GCash QR Code Safety and Business Guides: Scams, Sellers.

Back to the main guide: GCash QR Code: How to Generate, Scan & Pay with QR Ph.