A laminated QR code sits taped to the counter at a char kway teow stall in Petaling Jaya. It is curling at one corner, a little grease-stained, the kind of sticker that has been there since the stall owner printed it years ago. Except this one is not years old. Underneath it, barely visible, is a sharper edge of plastic where a fresh sticker was pressed on top of the original sometime last week. The stall owner has no idea. He glances at his phone when it buzzes, sees nothing, and keeps flipping noodles. The money went somewhere else entirely.
This is sticker-swap fraud, one form of a QR scam problem Malaysia's police are tracking closely. Bukit Aman's Commercial Crime Investigation Department recorded 5,134 QR code scam cases and RM28.67 million in losses in the first half of 2026 alone, a figure that covers every kind of QR scam, including codes that lead to fake websites, payment pages or apps. The mechanism is almost insultingly simple: someone prints a QR code linked to their own bank account or e-wallet, then physically pastes it over the merchant's real code, betting that no customer checks the recipient name before paying. Most payment apps show the registered recipient name on the confirmation screen before you approve the transfer, and that check, made at the point of sale, is the one a swapped sticker hopes you skip. Knowing how DuitNow QR and KHQR are built, and where their design leaves a gap for a physical sticker to exploit, is the difference between catching a swap in two seconds and finding out after your money is gone.
How does a QR code payment actually verify who gets paid?
A QR code is not money and it is not a bank account. It is a compressed data object, following the EMV QR Code Specification for Payment Systems, that encodes a merchant ID, an account reference, and a checksum. Malaysia's DuitNow QR standard mandates this structure so that any participating bank app or e-wallet can read the same code and route payment correctly, regardless of which bank issued it. Cambodia's KHQR works the same way: it is the National Bank of Cambodia's national QR standard, built on the EMVCo specification and routed through the Bakong system. KHQR itself launched in July 2022.
Here is the part that matters for fraud: the security in both systems lives in the data, not in the printed appearance. A Cyclic Redundancy Check (CRC) confirms the payload has not been corrupted or misread. It does not stop a fraudster from printing a perfectly valid, perfectly legitimate-looking QR code that simply points to a different account. The checksum validates that the code is readable and well-formed. It says nothing about whether the account behind it is the one you intended to pay. That is the gap a physical sticker swap lives in.
Why are sticker swaps possible if the QR systems are standardized?
Standardization solves interoperability, not physical custody. DuitNow QR and KHQR were designed so a single code works across every participating bank, which is genuinely useful: a customer with a Maybank app can pay a stall that only accepts CIMB, because the standard handles the routing. But that same universality means any printed DuitNow QR or KHQR sticker looks, to the human eye, identical whether it belongs to the stall owner or to someone who taped it there an hour ago.
Think of it like a mailbox. The postal system can guarantee a letter reaches whatever address is written on the envelope with total reliability. It cannot guarantee that the address written on the envelope is actually yours, if someone swapped the label while you weren't looking. The QR network is the postal system. The sticker is the envelope. Fraud happens at the label, not in the delivery.
This is why Bank Negara Malaysia's oversight, exercised through the Interoperable Fund Transfer Framework (IFTF) and the Policy Document on Merchant Acquiring Services, focuses on how banks and acquirers onboard and authenticate merchants, not on tamper-proofing a piece of laminated paper sitting on a counter. The same logic applies in Cambodia, where the National Bank of Cambodia sets the KHQR standard but cannot control what happens to a sticker after a merchant prints it.
What does a swapped sticker actually look like in person?
Building on the mechanism above, the practical question is what to look for before you scan. A few warning signs are worth checking for:
- Double adhesive edges. A fresh sticker pressed over an older one often leaves a visible lip or thickness difference around the border, especially under direct light.
- Mismatched print quality. The overlay sticker is frequently glossier or a slightly different size than the surrounding laminate, because it was printed separately and later.
- Loose or peeling placement. Swapped codes are often applied in a hurry, so corners lift more than a sticker that has been there for months.
- Codes taped to moveable surfaces. A QR code on a freestanding tent card or loose paper, rather than fixed to the register or wall, is easier to swap and harder for the merchant to notice has changed.
None of these visual cues are foolproof, which is the entire point. Public figures on QR fraud in Cambodia are harder to find than Malaysia's, but the underlying vulnerability, a static printed code with no visual authentication layer, is identical across both national standards. The physical check is a first pass. The real verification happens on your screen.
What is the one step that actually catches a swapped QR code?
The recipient name. Most legitimate payment apps, whether it's a Malaysian bank's DuitNow interface, a Cambodian wallet on Bakong, or a digital wallet for travelers, display the registered merchant or account name tied to the QR code before you confirm the transaction. If you scan a code at a nasi lemak stall called Warung Pak Din and the confirmation screen shows an unrelated personal name, stop. Do not proceed because the amount looks right or because you are in a hurry and the queue is backing up behind you.
This single habit, pausing to read the name field before tapping confirm, closes the gap that sticker fraud depends on. It takes two seconds and it works regardless of how convincing the physical sticker looks, because it checks the data payload rather than the paper it is printed on.
How does payment verification work when you scan a merchant QR?
When you scan a merchant's DuitNow QR in Kuala Lumpur or a KHQR code at a Phnom Penh market stall, your payment app shows you the merchant name, the exact amount in local currency, and the live exchange rate. You top up from your home bank or card in your own currency. You scan the same standardized code every local pays with. You see exactly who you are paying before the transfer executes. That confirmation screen is the moment of truth a sticker swap is designed to slip past, and it is the one step that catches the fraud before your money leaves.
Frequently Asked Questions
Is QR code sticker fraud common in Cambodia?
Public figures on QR fraud in Cambodia are hard to find, unlike Malaysia, where police recorded RM28.67 million in losses to QR code scams of all kinds in the first half of 2026. The physical vulnerability, a static printed code with no visual authentication, exists in KHQR the same way it does in DuitNow QR.
Can a fake QR code pass the CRC checksum check?
Yes. The checksum verifies the code is technically well-formed and readable, not that the underlying account belongs to the merchant you intend to pay.
What should I do if the name on my payment confirmation doesn't match the store?
Cancel the transaction immediately and pay with cash or another method. Report the sticker to the merchant, since they are often unaware their code was tampered with.
Does Moreta Pay work with both DuitNow QR and KHQR?
Yes. Moreta Pay lets you scan the same standardized merchant QR codes used across Malaysia (DuitNow QR) and Cambodia (KHQR) directly from your wallet balance.
Are tourists more at risk of sticker-swap scams than locals?
Tourists generally lack the familiarity with a specific stall's usual QR placement that would let them spot an added sticker, making the on-screen name check more important for travelers.
Does a legitimate-looking laminated QR code guarantee it's safe?
No. Lamination, print quality, and placement are not security features of DuitNow QR or KHQR. The only reliable verification is the recipient name shown at confirmation.
Before your next trip
Set up your Moreta Pay wallet before you board. Fund it from your home bank or card so you arrive ready to scan. Always read the merchant name on your confirmation screen before tapping approve, whether you're at a Kuala Lumpur hawker stall or a Phnom Penh market.
About Moreta
Moreta Global Inc. is a Delaware corporation and FinCEN-registered Money Services Business, backed by Y Combinator. The Moreta Pay wallet lets travelers top up from a home bank or card and pay directly on local QR networks in 15 countries, including Malaysia, Cambodia, Brazil and Peru, converting currency automatically at the point of payment. Every transaction displays the merchant name, amount, and exact exchange rate before you confirm, giving travelers the same verification step locals rely on to avoid swapped or fraudulent codes. Every account is identity-checked and transactions are monitored around the clock, built by a team that treats payment security as the starting point rather than an add-on.
Learn more at https://moretapay.com/.
