Paying by PromptPay QR is routine in Thailand. But a code on a counter is just paper or a sticker, and anyone can put another one on top. If it has been swapped, your money goes to someone else the moment you confirm.
This guide is for both sides of the counter: people paying, and shop owners whose signs are on display.
What a PromptPay QR actually contains
Very little:
- The PromptPay ID the money goes to: a mobile number, a 13-digit ID or an e-Wallet ID.
- An amount, if whoever made the code added one.
- A checksum (CRC) at the end, calculated from everything before it, which shows whether the data was damaged or edited.
- Sometimes a merchant name, typed in by whoever made the code.
What it does not contain is a bank-verified name. The payee's real name lives in the banking system and appears in your app after you scan.
How to check a code on the Read QR page
- Open the Read QR page on your phone or computer.
- Press "Open camera" and point it at the code, choose a picture (PNG, JPG, WebP, a screenshot or a photo), or paste a copied image.
- Read the result. It shows the kind (PromptPay, bill payment or TrueMoney Wallet), who it pays, with the full number, the amount or "Payer enters it", a merchant name if the code carries one, and the checksum result.
- Compare the number with the one the shop or seller gave you, if you have it.
The page reads on your device and uploads nothing, so it is a comfortable way to check a code someone sent you in a chat: save the image or take a screenshot, then pick it. A code inside a PDF cannot be read directly, so take a screenshot first.
What the check can and can't tell you
| It can tell you | It can't tell you |
|---|---|
| Which PromptPay ID gets the money | Who owns that ID |
| The amount in the code | Whether the seller is honest |
| Edits made without fixing the checksum | A fake code made from scratch |
This is the key point. If the result says the checksum does not match, do not pay: the data may have been altered. But a correct checksum does not mean the code is safe. Anyone can generate a fresh code with their own PromptPay number, and that code will have a perfectly valid checksum.
The merchant name inside a code is no proof either; it is whatever the maker typed. A reader shows where the money will go, not whether that is the right place.
The final check: the name in your banking app
Whether or not you used a reader, never skip this:
- Scan the code with your banking app as usual.
- On the confirmation screen, read the payee's name.
- Compare it with the shop, the name on the sign, or the person you mean to pay.
- If it does not match or looks odd, stop. Ask the staff or seller, or pay another way.
The name in your app comes from the bank, so it is the most reliable information you have at that moment. Signs made with QRnaka's printable card show the account name for exactly this comparison.
For shop owners: check your own signs
A code on public display can be covered at any time, so make checking a habit:
- Keep a note of your correct PromptPay ID and account name.
- Scan your signs regularly, for example when you open, with the Read QR page or a banking app, and confirm the number and name are still yours.
- Check straight away if a sign looks different (a sticker on top, raised edges, different paper) or was left unattended.
- Print your account name on the sign so customers can compare. See making a PromptPay payment sign.
- If a sign has been swapped, take it down at once and use a spare you have checked.
If you think you already paid the wrong account
Contact your bank immediately. Our report page also points people who were tricked into a transfer to the Thai police online reporting site, thaipoliceonline.go.th, and the 1441 hotline. Other QR scams are covered in QR code scams and how to stay safe.
FAQ
The checksum is correct. Is it safe to pay?
Not necessarily. A correct checksum only means the data is intact; a fake code made from scratch passes too. Always compare the payee's name in your banking app.
Does the Read QR page upload my picture?
No. It runs on your device and does not upload the picture.
The name in the app doesn't match the sign. What now?
Don't confirm yet. Ask the staff first. Some shops use the owner's personal account, which is normal, but get the shop to confirm before you pay.
Next time you are unsure, open the Read QR page, then finish with the name check in your banking app. Two quick steps can keep your money out of the wrong account.
