A payment screen on a customer’s phone does not prove the money reached you. The only reliable proof is the payment showing up on your side: your merchant app, your payment alert or your bank statement. Make that check a habit before handing over goods or confirming a booking, and most counter payment scams stop working.

Why are payment scams hitting businesses in Nepal now?

Because QR payments are now everywhere, and scammers follow the money. Nepal Rastra Bank’s Payment Systems Oversight Report for FY 2024/25 says QR code-based payments remained the most widely used retail payment medium, and that merchants with QR in Nepal have reached around 2.9 million.

QR payments are fast and cheap, which is good for you. But speed also creates a gap between “the customer says they paid” and “we actually received it”. Scammers work in that gap, usually at the busiest moment of the day, when staff are serving several people at once.

We run businesses ourselves, so we know what a full counter at peak hour feels like. Everything below is meant to work in that moment, not only on paper.

What are the most common tricks?

Five tricks come up again and again. All of them rely on you trusting the customer’s screen, a message or a caller instead of your own records.

  • The fake or old screenshot. The customer shows a “successful” screen that was edited, taken on another day, or shows a payment to someone else.
  • “Pending” shown as “paid”. The payment is still processing or has failed, but the customer shows the screen quickly and leaves.
  • The swapped QR code. Someone sticks their own QR over yours, or sends staff a “new QR” by WhatsApp or Viber, pretending to be the owner or a supplier.
  • The fake support call. A caller says they are from your wallet or bank and need your OTP, password or PIN to “verify” or “upgrade” your merchant account. eSewa says plainly that banks and digital wallets never ask for OTPs, passwords or PINs.
  • The “I paid too much” trick. A customer claims they sent extra and asks for the difference back in cash or by transfer, before you have confirmed the original payment.

How do we confirm a payment is real?

Check on your side, every time, before the customer leaves. A simple routine at the counter:

  1. Look at your own notification, in the merchant app, the payment alert or your bank, not at the customer’s phone.
  2. Match the amount exactly, and check the time. An old payment of the same amount is not today’s payment.
  3. Treat “pending” as unpaid. Ask the customer to wait or pay another way.
  4. Note the transaction ID on your copy of the bill, so you can match it later.
  5. Never accept a forwarded screenshot on WhatsApp or Viber as proof for a delivery, a room or a trek deposit. Wait until the payment shows on your side.

For online orders and bookings, the same rule applies in software: your system should confirm the payment with the provider before it marks an order as paid. We explain how that works in our guide to accepting eSewa, Khalti and Fonepay online.

How do we stop QR code tampering?

Keep control of your QR, and check it every day. It takes a minute.

  • Scan your own QR each morning with a phone and check that it shows your registered business name.
  • Fix the QR standee in place, laminated, with your business name printed next to it. Look for stickers on top.
  • Never switch to a “new QR” sent by message. Call the owner or supplier back on a number you already have.
  • Tell staff to say it out loud: “Please check the name shows as our business before you pay.”
  • Consider a dynamic QR. Fonepay describes a dynamic QR as one generated for each bill, which can be linked to a point-of-sale system. The amount is already filled in and the payment is recorded against that bill, which removes a lot of manual checking.

What should staff never share?

Your OTP, PIN, password and merchant login, with anyone, by phone or by message. No genuine provider needs them to help you.

  • Give each staff member their own access where your provider allows it, rather than sharing the owner’s login.
  • Turn on two-factor login for your bank, wallet, email and website accounts. Our guide to domains, hosting and security covers this for your online accounts.
  • Agree a rule: any call about “account problems” is ended politely, and the owner calls the provider back on the number shown in the official app or website.

What should we do if we have been scammed?

Act quickly and keep everything. Recovery depends on each case, and nobody can promise it, but fast reporting gives you the best chance.

  1. Contact your bank or payment provider at once, using the number in their official app or website. Nepal Rastra Bank’s oversight report says payment providers have been directed to run a help desk for at least 16 hours a day and to keep toll-free numbers.
  2. Keep the evidence: the transaction ID, the time, the phone number, screenshots of chats, and CCTV footage if you have it.
  3. Report to the Nepal Police Cyber Bureau (cyberbureau.nepalpolice.gov.np) or your nearest police office. Computer-related offences in Nepal are covered by the Electronic Transactions Act, 2063 (2008).
  4. Escalate to Nepal Rastra Bank if needed. Its Gunaso portal (gunaso.nrb.org.np) lets customers raise and track complaints about financial services from licensed institutions.
  5. Ignore “recovery agents” who contact you offering to get your money back for a fee. That is often a second scam.

How can software reduce the risk?

Good software takes the decision away from a busy person at the counter. The bill should only be marked paid when the provider confirms it.

  • Payments linked to the bill: a dynamic QR or payment integration connected to your POS or booking system.
  • A daily match: a short report that lists every paid bill next to its transaction ID, and flags anything that appears on only one side.
  • Owner alerts: a message to the owner when a refund, a large payment or a mismatch happens.

This is the kind of systems integration work we do: connecting payments, billing and records so the numbers agree without someone checking by hand.

FAQ

Is a payment screenshot ever enough proof? No. Treat a screenshot as a hint, not proof. Confirm the payment on your own app, alert or statement.

Is a printed static QR still safe to use? Yes, as long as you check it daily and confirm every payment on your side. A dynamic QR linked to your billing removes more of the manual checking.

Someone called from “eSewa” or “the bank” asking for an OTP. What now? End the call. eSewa says banks and wallets never ask for OTPs, passwords or PINs. If you already shared one, contact your provider immediately through their official number.

Who do we contact first after a scam? Your bank or payment provider, then the Nepal Police Cyber Bureau. If a licensed provider does not resolve your complaint, use Nepal Rastra Bank’s Gunaso portal.

Want payments that confirm themselves?

If you would like your counter, website or booking system to mark payments as paid only when they really arrive, talk to us. We will look at how you take payments today and suggest the simplest fix that works.

Sources