666JILI QR Code Scam: How a Stranger's Code Takes Your Money
A QR code scam hides a fake address or a scammer's payment account inside a code.
| Fact | Value |
|---|---|
| 666JILI BSP Regulated | BSP regulated means a bank or non-bank financial institution is supervised by the Bangko Sentral ng Pilipinas. |
| 666JILI Pagcor Accredited Online Casino List | Open pagcor.ph, go to Regulatory, then Electronic Gaming Licensing, and open the list of accredited gaming system administrators and registered brands and domain names. |
| 666JILI Scam Checker | A scam checker tests an address against lists of known unsafe sites and looks for warning signs in the address itself. |
A QR code scam works because a code hides its destination. You cannot read the address in the square, and you cannot tell whose account a payment code points to. The Philippine Information Agency reported on 6 April 2026 that the Bangko Sentral is warning the public about this, using the term “quishing”. This page shows the red flags and the checks you can run yourself, and the look-ups are covered on the PAGCOR regulatory pillar.
How a QR code scam works
The Bangko Sentral’s banking officer, as reported by the Philippine Information Agency, defines quishing as scammers using malicious QR codes to trick people into visiting fake websites, downloading harmful content or sending cash. There are two routes.
- A fake website. The code sits in a poster, email, receipt or message and opens a fake login page for an e-wallet or a bank.
- A swapped payment code. Scammers physically replace a merchant’s legitimate code with their own. When you scan the altered code, the payment goes to the scammer’s account instead.
The United States Federal Trade Commission describes the same pattern: scammers covering a code on a parking meter with their own, or sending a code by text or email with an invented reason to scan it.
QR phishing: the messages that carry the code
QR phishing is the first route in practice. The Federal Trade Commission lists three reasons scammers invent:
- A package that could not be delivered.
- An account problem that needs your information.
- Suspicious activity that needs a password change.
All of them create urgency, so you scan before you think. A scam message does not need to mention gaming at all.
Red flags
Any one of these is a reason to stop and check before you scan or confirm.
| Red flag | Why it matters | What to do |
|---|---|---|
| A code sent to you that you did not ask for | The Federal Trade Commission advises not scanning a code in an unexpected email or text, especially one urging you to act at once | Contact the sender through a number or site you already know |
| A code stuck over another code | The Bangko Sentral lists this as something to check for | Do not scan; tell the shop or owner |
| A link preview that does not match the sender | Most smartphones display the link before launching, per the Bangko Sentral | Read it letter by letter |
| A page that asks for a PIN, OTP or password after the scan | The Bangko Sentral says never to enter sensitive details on a site reached through a code | Close it |
| A payee name that does not fit the shop or person | A payment app shows the recipient before you confirm | Cancel |
| A stranger asking you to pay a code to receive something | The route is the swapped-code or fake-page pattern above | Walk away |
Fake QR code: how to check one yourself
You are about to scan a code on a counter, poster or receipt.
Look for edges: a sticker, a seam or a second layer. Scan only codes from trusted and verified sources, preview the URL, and read the payee’s name before you confirm. Maya’s own scan-to-pay guide, as one wallet’s example, says the merchant name appears on your screen before you press Pay.
A message claims you need to scan a code to keep an account or claim something.
Do not scan it. Open your wallet or bank by its own app or site, and look for the same notice there. If the notice exists, it will be there.
What QR Ph changes, and what it does not
QR Ph is the Bangko Sentral’s national QR code standard. Its page says any participating bank or non-bank e-money issuer can scan it, for person-to-person transfers and person-to-merchant payments through InstaPay. The standard makes codes work across apps, but it does not tell you whether the particular code in front of you is the real one. The general rail is explained on the InstaPay casino payments explainer, which describes it in general and nothing more.
Who supervises the wallet that scans the code
The wallet or bank behind your scan is on a Bangko Sentral list, and that list is how you check the app is genuine. The BSP regulated directory and EMI list page explains where it is and how to search it. The gaming brand behind a link is a separate question, which the PAGCOR accredited online casino list walk-through answers by brand and domain.
If money has already left
You paid a code and now doubt it.
Tell your bank or wallet at once, and keep screenshots. If a gaming session is part of the picture, step away: responsible gaming and the 21+ rule covers pausing before you decide what to do next.
FAQ
What is a QR code scam?
It is a scam in which the code itself is the trap. The Bangko Sentral, as reported by the Philippine Information Agency, describes quishing as scammers using malicious QR codes to trick people into visiting fake websites, downloading harmful content or sending cash.
What is QR phishing, and is it the same as quishing?
Yes. The Philippine Information Agency's report says the term is short for QR phishing. A code placed in a poster, email, receipt or message leads to a fake login page for a wallet or bank.
How do I tell a fake QR code from a real one?
Look for a code stuck over another one, then preview the web address your phone shows before it opens. The Bangko Sentral lists both as precautions, and a payment app should also show the payee's name before you confirm.
What if I already scanned a code and paid the wrong account?
Contact your bank or wallet at once and use its complaint route. If the concern stays unresolved, the Bangko Sentral says you can file through BSP Online Buddy. Never share a PIN or OTP with anyone who contacts you afterwards.
Related guides
| Guide | What it covers |
|---|---|
| 666JILI BSP Regulated | bsp regulated |
| 666JILI Pagcor Accredited Online Casino List | pagcor accredited online casino list |
| 666JILI Scam Checker | scam checker |