At a mamak counter on Jalan Alor, the cook flips roti canai on a blackened griddle while his cousin pours teh tarik from shoulder height. You scan the DuitNow QR taped to the drinks fridge, check the merchant name and the ringgit amount, and slide to pay. Done. Twenty minutes later, on a packed monorail toward KL Sentral, a hand slips into your bag. What did it just get?
What can a card skimmer actually capture from a travel card?
A card skimmer copies the data on your card's magnetic stripe: the card number, expiry date and cardholder name. It cannot capture the CVV2 on the back or the one-time code an EMV chip creates for each purchase. A pickpocket who takes the card itself gets more than any skimmer, because the CVV2 is printed right there, and the cash next to it is gone for good. A QR wallet works differently. You scan the merchant's code, so no card is swiped or handed over, and a stolen phone still has to get past your lock screen and an in-app payment confirmation. Moreta runs a wallet that travelers use on local QR networks such as DuitNow in Malaysia, KHQR in Cambodia, Pix in Brazil and WeChat Pay in China.
From the stripe, a skimmer captures:
- the Primary Account Number
- the expiry date
- the cardholder name
It cannot capture the CVV2 printed on the back of the card. It also cannot capture the dynamic code an EMV chip generates for each purchase.
The difference comes down to static versus dynamic data. The stripe works like a key cut from a mold. Copy it once and the copy opens the same door every time. The chip works like a doorman who reads out a fresh code for each visit, so a code intercepted today is useless tomorrow. That is why good card skimmer protection is mostly about how the card gets read:
- Insert the chip or tap. Never hand the card over for a swipe.
- Use ATMs inside bank branches rather than standalone machines on the street.
- Cover the keypad with your other hand when you type your PIN.
- Check the card slot before inserting your card, and walk away if it feels loose or looks like an add-on.
What does a pickpocket get from a wallet with cards and cash?
If the skimmer is overrated, the pickpocket is underrated, because a physical card carries more than its stripe. A thief holding your card has the number, expiry date, name and the CVV2, which covers what most online checkouts ask for. The cash is simply gone.
Liability decides how much of that loss lands on you. For US-issued cards:
- Credit cards: under the Fair Credit Billing Act, your maximum liability for unauthorized charges is 50 USD.
- Debit cards: under Regulation E, liability depends on when you report. Report within two business days of learning the card is gone and your liability is capped at 50 USD under the CFPB's Regulation E text. After that it can reach 500, USD and if you miss the 60-day window after the bank sends the statement showing an unauthorized transfer, you can be liable for later transfers with no cap.
- Cash: no protection at all.
The practical difference is whose money moves first. A fraudulent credit card charge sits on the issuer's credit line while you dispute it. A debit card draws straight from your checking account, so you are arguing to get your own money back.
What can a thief do with a stolen phone that has a QR wallet on it?
A QR wallet moves the risk from the wallet in your pocket to the phone in your hand. So the real question is what a phone thief can reach. At the counter, you scan a code the merchant displays. That code identifies the merchant, not you. No card number appears at the counter for a skimmer to read, and no waiter carries your card to a back room.
A thief holding your phone runs into several layers:
- Your phone's lock screen, protected by a strong passcode.
- In-app confirmation. Moreta requires your confirmation in the app for every payment. You see a review screen showing the amount, exchange rate and merchant name before you pay.
- Monitoring and alerts. Transactions are monitored around the clock, and you get real-time alerts on your account.
- Per-country limits. Each country has a maximum single payment and a weekly limit, shown in the app. Moreta lists Malaysia at 12,000 MYR per payment and 24,000 MYR per week. Brazil is 16,000 BRL per payment and 32,000 BRL per week.
There is one honest limit. If someone gets past your lock screen, the wallet balance is what's at stake. Keep the balance modest by topping up for a few days at a time rather than loading a month's worth of spending.
How do cash, credit cards, debit cards and QR wallets compare against each threat?
Putting the three sections side by side shows that each method fails in a different way.
| Method | Card skimmer | Pickpocket |
|---|---|---|
| Cash | Nothing to copy | Takes all of it, with no recovery |
| Credit card | Gets number, expiry and name from the stripe. No CVV2, no chip code | Gets the card and its printed CVV2. US liability capped at 50 USD |
| Debit card | Gets the same stripe data. ATMs are a common skimming site [duncanlegal.com] | Same as credit, but the money comes from your checking account. Liability depends on how fast you report |
| QR wallet | Nothing, because no card is presented | Gets a locked phone. Payments need in-app confirmation and are capped by country limits |
Are chip credit cards from the US still worth carrying for travel money safety?
Yes. Chip cards from US issuers carry the 50 USD liability cap and work as backup when you need to book a hotel, rent a car or pay online. Use yours for:
- hotel deposits and car rentals
- flight and tour bookings
- the afternoon your phone battery dies
Keep the card in a different pocket from your phone so one lift cannot take both. At terminals and ATMs, you may see an offer to charge you in US dollars instead of local currency. That is dynamic currency conversion. Decline it and always choose to be charged in local currency.
How should you split travel money across a QR wallet, a card and cash?
Building on that, the safest setup spreads your money so that no single theft ends the trip. The QR wallet handles daily spending, and it covers more counters than most visitors expect:
- Brazil: Locals pay with Pix, but setting it up yourself needs an account at a Brazilian bank or fintech, which asks for a CPF tax number. That is the usual wall for anyone looking up Pix for tourists. With Moreta Pay you top up in your own currency and scan the same Pix QR at an Ipanema kiosk selling água de coco.
- Malaysia: DuitNow QR covers mamak stalls and the hawker stands along Jalan Alor.
- Cambodia: KHQR works at the Russian Market in Phnom Penh. We covered Cambodia's two-currency quirk in our Cambodia guide.
- China: Moreta supports WeChat Pay codes only while you are physically in China.
Cash still has a job, though. Keep a few 1,000-riel notes for a tuk-tuk outside Siem Reap, some RM1 and RM5 notes for a petrol-station toilet on the North-South Expressway, and a few small real notes for a beach chair in Rio. A QR payment also needs mobile data or Wi-Fi at the moment you pay.
The five-second version: a QR wallet for daily spending, one chip credit card as backup, and a small, specific cash reserve.
Do this before you board:
1. Install Moreta Pay, verify your identity with your passport and a selfie, and top up a few days of spending.
2. Set a strong phone passcode, and learn how to freeze each card from its issuer's app.
3. Put your backup credit card in the hotel safe or a money belt, and your cash reserve in a separate pocket.
Frequently Asked Questions: what else do travelers ask?
Can a card skimmer steal my CVV?
No. Skimmers read the magnetic stripe, which does not hold the CVV2 printed on the back.
Is a QR wallet safer than a credit card abroad?
The two carry different risks. Scanning a merchant QR leaves nothing to skim, while a credit card has stronger legal liability protection. Use both.
Should I use a debit card at ATMs abroad?
Only when you need cash. Use machines inside bank branches, and report a lost or stolen card immediately, because debit liability grows the longer you wait.
Do I need a local SIM or bank account to pay by QR?
No. Moreta Pay needs only mobile data or Wi-Fi when you pay. No local bank account or SIM required.
Can tourists use Pix in Brazil?
Yes, through a wallet like Moreta Pay that pays Pix QR codes. You do not need a Brazilian bank account.
What should I do if my phone is stolen?
Report it to Moreta, watch your account alerts, and remember that payments still require confirmation in the app.
About Moreta
Moreta Global Inc. is a Delaware corporation, FinCEN-registered Money Services Business, and Y Combinator-backed (Summer 2024 batch). Moreta Pay lets travelers add money from home in their own currency and pay merchants on local QR networks across Asia and Latin America, including DuitNow, KHQR, Pix and WeChat Pay. Each account is identity-verified, funds are held with licensed partner banks, and each payment shows the merchant name, amount and exchange rate before you confirm. Moreta charges one 1.5% fee per payment, with no monthly plan.
If you want to keep your cards in reserve and pay the way locals do, learn more at https://moretapay.com/.
References
- Google (google.com)
- ATM Skimming in 2025: How to Protect Your Finances and Identity - Duncan Legal (duncanlegal.com)
