In Vietnam almost everything is paid by scanning a QR code, and the 11.11 sales are when people scan fastest. Three scams come up again and again: a fake QR sticker over a shop’s real code, a “wrong transfer, please scan this to send it back” message, and a fake courier asking for an extra fee by QR. Police and banks have warned about all three. One habit protects you from each of them: after you scan, read the payee’s name in your banking app before you confirm.
Why sale season is QR scam season
On 11.11 you scan more than usual: delivery fees, deposits, the coffee on the way to pick up a parcel. You are also in a hurry, because a flash sale lasts minutes. That is exactly what a scammer needs: lots of transactions and little time to look.
Vietnamese police call this family of scams Quishing, from “QR code” and “phishing”. Hanoi police have warned that it is spreading, and their list of 25 scam scripts for 2026 names malicious QR codes and fake transfer receipts (both sources in Vietnamese).
Scam 1: a fake QR code stuck over the shop’s own
The scammer prints a new QR code that points to their own account and sticks it over the payment code at a restaurant, a café or a bus station. You scan, and the money lands in a stranger’s account. The shop gets nothing, and you find out when the owner asks whether you’ve paid yet.
Hanoi police describe exactly this: codes pasted over or swapped at restaurants and bus stations to take the money when people pay. The Vietnam Banks Association summarised warnings from Vietcombank, ABBank, KienlongBank and VRB that list fake QR codes stuck over real ones in restaurants, stations and payment points.
Signs: a code stuck on top of another, peeling edges, a brand-new sticker on an old counter, or two codes side by side.
What to do: ask the seller “is this your code?” before you scan. After scanning, the payee name in your banking app should match the shop or its owner.
Scam 2: “I sent it by mistake, scan this to send it back”
Money you weren’t expecting arrives in your account. Minutes later, a message or a call: “I transferred it to you by mistake, please send it back”, with a QR code or a different account number. Sometimes the caller claims to be from the bank, offering to “help you get the money back”.
Phú Thọ provincial police describe two versions. In the first, scammers send a small “bait” amount, then pose as the mistaken sender or a debt collector and pressure you to transfer money to an account they choose. In the second, they pose as bank staff and ask you to scan a QR code in your banking app “to verify”. According to the warning, once the victim scans, the code carries out a transfer of the whole balance.
The safe way to handle it, per the same police advice:
- Money arrives that isn’t yours: don’t withdraw it or send it anywhere. Tell your bank, and return it only through the bank’s official channel or with the authorities as witness.
- You sent money by mistake: keep the transaction screenshots and ask your bank to trace it. Never pay a “fee” to a stranger online who promises to recover it.
- Don’t scan QR codes or tap links that strangers send.
Scam 3: the fake courier, “your order still has a fee”
Sale season means the most parcels, so it is also peak season for fake couriers. The usual script: a delivery call at a time you’re out, then a message asking you to transfer first, or “your order still has a fee, scan this code”.
Vietnam’s Ministry of Public Security has warned that fake couriers call when you’re likely not home, send transfer details, deliver fake or low-quality goods and refuse inspection. Its advice includes one short line: don’t scan QR codes from unclear sources.
A newer twist: in August 2026, Hưng Yên provincial police warned of callers posing as couriers who say they sent the wrong payment account for an order, then steer the victim to a fake Facebook page of the delivery company to “file a refund complaint”. A second person, posing as customer care, sends a “refund confirmation code”. When the victim enters it in their banking app, it is actually a transfer of more than 28 million đồng.
What to do:
- Open the shopping app and check whether the order is paid and what the delivery fee is. A real courier won’t need any amount beyond what the order says.
- Pay only for orders you placed, preferably through the marketplace or directly to the seller.
- If in doubt, call the delivery company’s official hotline, not a number a stranger gives you.
The 3-second rule: after you scan, read the payee’s name
All three scams share one weakness: the money has to go to an account that isn’t the one you meant to pay. And before you confirm, your banking app shows the payee’s name on the transfer screen.
So before you tap send, take 3 seconds:
- Read the payee’s name. It doesn’t match the shop, the seller or the friend you’re paying? Stop. Don’t send.
- Don’t scan codes strangers send you by text, Zalo or Messenger, however urgent the story.
- Never read an OTP out to anyone, including people who say they are the bank or the police. Hanoi police repeat this in their 2026 warning: never share passwords or OTPs, and don’t transfer money before you’ve verified who receives it.
Send this to your parents. Older family members may scan less, but they are also less likely to doubt a “wrong transfer” message.
What 6pm does, and what it doesn’t
6pm is an expense tracker. When you scan a VietQR code with 6pm, it reads the account number, amount and message in the code, logs the spend, then opens the banking app you choose. The payment still happens in your banking app, where you see the payee’s name and confirm as usual.
- 6pm never moves money. It only counts.
- 6pm never asks for an OTP, a password or your bank login.
- We never store your transactions.
- 6pm can’t detect fake codes, and we don’t claim it can. The 3-second rule is still yours to follow, in any app.
Where 6pm helps: every scan lands in your log, and at 6pm you go through each spend when you close the day. A strange amount, two payments for one order, or an odd “delivery fee” is easier to spot when they sit side by side on one receipt.
FAQ
What is a QR code scam (Quishing)?
A scam that uses a fake or malicious QR code: stuck over a real payment code, sent by message or email, or printed on fake goods. You scan, and the money goes to the scammer, or you land on a fake site that collects your login details.
Someone sent money to my account by mistake. What should I do?
Don’t withdraw or forward it, and don’t scan any code they send. Tell your bank and return the money only through the bank’s official channel or with the authorities as witness, as Phú Thọ police advise.
A courier says my order has an extra fee. Should I scan their code?
Not straight away. Check in the shopping app whether the order is paid and what the fee is. If you still have doubts, call the delivery company’s official hotline or contact the seller.
Is scanning with 6pm safer?
6pm doesn’t move money and doesn’t recognise fake codes. It logs the spend and opens your banking app, where you still read the payee’s name and confirm yourself. The 3-second rule applies exactly as it does in your banking app.
I’ve been scammed. What now?
Call your bank’s hotline straight away and ask for the transaction to be traced, keep screenshots, call recordings and statements, and report it to the nearest police station.
Try 6pm
6pm arrives on the App Store at 18:00 on Friday 6 November 2026 (Vietnam time), in time for 11.11. Want it sooner? Join the public TestFlight beta: testflight.apple.com/join/a8UrvT5P. More at at6pm.app.
Every spend, caught.