Fake bank transfer slips: how online shops get fooled, and how to stop it
Taking payment by asking customers to send a picture of their transfer slip is the easiest method there is, and also the easiest to cheat. This article explains three ways people really cheat, and what a shop can do itself to stop them.
Many Thai online shops take payment the same way. The customer makes a bank transfer and sends a picture of the slip, the receipt screen from their banking app. The shop sees the slip and ships. There are no fees, you can set it up in a day, and it is also the easiest method to cheat.
I have built a payment system like this myself, and before writing it I had to sit down and think about how I would cheat it. The three methods below are what you have to block from the start.
One: reusing the same slip
The easiest method and the one that works best. It needs no skill at all. The customer makes one real transfer, gets one real slip, and sends that same slip again with the next order.
If a different person checks it, or the same person days later, there is almost no way they will remember seeing that slip before. And the slip is genuine in every way, so however you check it, nothing looks wrong.
This is why the system has to remember the reference number of every slip it has ever accepted, not just check whether a slip looks real. In the system I built, I enforce this rule in the database, not in the code. Code has many ways in, and one day someone may write a new path that forgets the check. A rule inside the database cannot be skipped.
Two: editing the number in the picture
Transfer 60 cents for real, then edit the picture to say $60. Today this can be done on a phone in under a minute, and more convincingly than most people think.
A seller busy with ten customers at once glances to see there is a slip, sees a number that looks about right, and ships. The mistake here doesn't come from being careless. It comes from a person checking the same kind of thing dozens of times a day.
Three: a slip made up from scratch
There are websites and apps that create a complete fake slip. Pick the bank, type a name and an amount, and you get a picture that looks real in every detail, including the QR code on the slip.
You can't tell slips like this apart by eye at all, and you shouldn't try to.
Fixes, starting with what you can do yourself today
- Check in your banking app that the money really came in, every time before you ship, not just the slip picture. It is free and works best, but you can't keep it up once orders grow.
- Write down the reference number of every slip you accept, and check for repeats. Doing it on paper or in Excel is still better than not doing it.
- Ask each order to pay an amount with its own odd satang (the Thai cents), different for every order. It makes matching transfers to orders far more accurate.
- Use a PromptPay QR code, Thailand's national QR payment, with the amount fixed for each order, so the customer can't pay the wrong amount.
- Use an automatic slip checking service that reads the QR code on the slip and confirms it with the real bank.
The last one is the only way that really stops a slip made from scratch, because it doesn't look at the picture. It asks the bank whether the transaction exists. It does come with a monthly fee, though. A shop that doesn't have many orders yet can start with the first four.
The point people miss most
However accurately you check slips, if the system still lets the customer say how much they have to pay, it can still be cheated. The price must always be worked out on the server, never taken from a number sent by the web page.
Wrong the customer sends amount = 0.60 and the system believes it Right the system looks up what this item costs and uses that number
This sounds technical, but the result is not technical at all. If your website accepts the number from the customer's side, someone who knows how can order a $150 item for 60 cents, with a slip that is genuine in every way, and the best slip checker there is won't catch it.
Summary
Taking payment by slip is not wrong. Many Thai shops do it and do fine. The point is not to let the slip picture be the only proof that the money has arrived. Remember reference numbers to block reused slips, let the server set the price, and check that the money really came in before you ship. These three stop most problems without paying anything extra.