If you scanned a suspicious or fake GCash QR code, stop what you are doing, close any page that opened, check your transaction history, secure your account and report the incident through official GCash channels. Acting quickly gives you a real chance of limiting harm.

First, a note on tone. Many people feel embarrassed after being tricked. There is no need. Scam codes are designed to look normal, and careful people fall for them. What matters now is the next fifteen minutes, so let us walk through them.

Step one: stop and do not enter anything

If a web page is open, do not type your MPIN, login details, card number or any code. If the page asks for more information, close it. If your phone started to download something, cancel the download and do not open the file.

If you are still in the app and a payment screen is showing a payee you do not recognize, do not tap Pay. Back out.

Step two: check whether money moved

Open GCash and look at your transaction history. See whether any payment went out that you did not intend. If you tapped Pay before you noticed the problem, find the entry and note the amount, time and payee name. Take screenshots.

If nothing has gone out, that is good news. Continue with the next steps anyway.

Step three: secure your account

If you entered your login or any code on a suspicious page, assume it could be misused. Change your credentials through the official app, using the in-app settings. If you cannot log in, use the app's account recovery steps, not a link sent in a message.

If you entered card details, contact your bank through the number printed on your card or the official bank app, and tell them what happened. Banks can often block cards quickly.

Think about other accounts that share the same password, and change those too.

Step four: check your phone

If you downloaded or installed anything after the scan, remove it. Review the apps on your phone and uninstall anything you do not recognize. Update your phone's operating system and your security settings. If you are worried, consider running a scan with a trusted security tool from your phone's official store.

Step five: report it

GCash says you can report scams through the Help Center, by messaging its virtual assistant and selecting the option to report a scam, or by calling the hotline, which is 2882 for Globe and TM users. Other networks may use a different number listed in the Help Center. Use only the official channels you reach from the app or the official help pages.

Give clear details: when it happened, where you saw the code, what the page asked for and what you did. Attach screenshots. If money moved, include the transaction details.

You may also report to the Bangko Sentral ng Pilipinas consumer protection channels, which news coverage has named as an option for people who suspect fraud. If you are a victim of a crime, you can also consider reporting to the police or to government cybercrime units. We cannot give legal advice, but a record can help.

Step six: warn others

If the code was a sticker at a shop or a poster in a public place, tell the owner. They may not know it was replaced. If the code came through a message or a social post, report the account to the platform. Warn your family chat as well, because scammers often send the same lure to many people.

What not to do

Do not pay anyone who contacts you offering to recover your money. Recovery scams are common, and they target people who have just been tricked. Do not share your MPIN or one-time codes with anyone who says they work for support. Do not click links in messages that claim to be from GCash. Do not post your full details in public comment sections.

Keep evidence

Save screenshots, messages and any receipts. Write a short timeline in your notes: the time you scanned, what you saw, what you entered and what you did next. A clear timeline makes it easier for support to help, and it helps you stay calm.

Recovering

Whether you lost money or not, take a moment to reset your routines. Review your account settings. Tell the people close to you what happened, so they can learn from it. Set a rule for yourself: scan only known codes, read the payee name every time, and never type secrets into a web page after scanning.

If money was lost, be realistic. Recovery depends on many factors, and we cannot promise any outcome. The most useful things you can do are act fast, report through official channels and keep records.

Emotional note

Scams can leave people feeling anxious. If you are struggling, talk to someone you trust. It helps to share the experience, and your story might prevent someone else from being tricked.

A short example

Dino scans a code from a flyer and a page opens asking for a login. He types his number and then realizes the address looks wrong. He closes the page, opens GCash, checks his history and sees no payment. He changes his credentials through the app and reports the flyer through the Help Center, sending a screenshot. He also tells his barangay group chat to ignore similar flyers.

This guide is independent and not affiliated with GCash. We last checked these points against GCash statements and Philippine news coverage in November 2026. For your own case, rely on official GCash channels and your bank.

Keep reading

More guides in this section: GCash QR Code Safety and Business Guides: Scams, Sellers.

Back to the main guide: GCash QR Code: How to Generate, Scan & Pay with QR Ph.