Bánh mì cart, District 1. Extra pâté.
You scan the QR taped to the cart, your phone chimes, you walk off chewing.
Three hours later the vendor is still standing there because nothing landed on her side.
You paid. Somebody got the money. It was not her.
The rails are not usually the weak point. The bank moved the money correctly. It just moved it to somebody else.
What VietQR actually did right
VietQR was supposed to fix payments. It mostly does. You can tap a sticker taped to a coffee cart, hit send, and pay in eight seconds without unfolding a single banknote. Most days, it works. Most vendors are honest. Most foreigners walk away thinking Vietnam has solved something the West is still arguing about.
That part is real. Do not let the rest of this essay take it away from you.
What nobody briefs you on
The part nobody briefs you on is what the scammers learned while QR payments became the default.
The mechanic is small and beautifully boring: someone walks past a busy street vendor, slaps their own printed QR sticker on top of the vendor’s QR sign, and walks away. You arrive thirty minutes later, scan, transfer, watch your screen confirm, and pay the scammer instead of the vendor. The vendor sees no money. You see a successful transfer. The rails in the middle did exactly what they were supposed to do. The piece of paper at the top of the stack did exactly what it was forged to do.
Sometimes it runs the other way. The vendor is the scammer and the customer is the mark — the vendor presents a faked “received” screen on their own phone, you wave goodbye, and an hour later the bank statement disagrees with everyone in the room. This version is rarer because vendors are stationary and reputational. Substitution stickers are anonymous and travel-light.
Most of the time, nobody in the room is malicious. The gap is not in the system. It is taped to the pole. Street-level Vietnam fills gaps like water finds cracks.
Why this version is specific to foreigners
A local catches it because they read the recipient name on the confirmation screen automatically. You do not, for four boring reasons.
Speed pressure. Street commerce here moves fast. The vendor is already handing you the food. Pausing to read the recipient name feels rude and obstructs the queue.
Language gap. The account holder name is in Vietnamese. Even if you scan it, “NGUYEN VAN A” is not a sentence you can quickly evaluate for plausibility. Locals can tell whether a name fits the vendor of a bánh mì cart in District 1 within half a second. You cannot.
The chime. Vendors trust their own audible “ting” more than your screen. If the chime did not fire on their phone, you did not pay them. By the time the chime should have fired, you are already two steps down the alley, and the conversation now has to start by SMS in a language you do not speak.
The sticker layer. The QR is paper. Paper is mutable. The bank rails are not the weak point. The sticker is. Vietnam has historically punished the layer closest to the customer, and right now that layer is a piece of tape.
The right frame is not “VietQR is unsafe.” It is the rest of it. Payment is a stack. The bottom of the stack is bank rails. The top of the stack is a piece of tape, and the country has had plenty of practice printing better tape.
What to check before scanning
Treat this as a thirty-second routine, not a paranoia spiral. You will do most of it without thinking once it is in your hands.
- Look at the sticker. Peeling corners, fresh edges over a curled older sticker, a square sticker stuck slightly off-axis on a laminated background, a new white sticker on a sun-faded sign — all signal recent substitution. A sticker that is screwed, laminated, or visibly weathered into the surface is unlikely to be the scam.
- Read the recipient name on your confirmation screen. Before you tap send. If it’s a generic personal account — three Vietnamese given names with no business indicator — on a place that should be a registered business (a chain coffee shop, a hotel, a phone repair counter), slow down.
- Listen for the vendor’s chime. Their phone, not yours. The “ting” should fire within two to four seconds of your tap. If the vendor is glued to their phone and visibly not reacting, the transfer did not land where you think it did.
- For amounts that hurt, ask first. Verbally confirm the account holder name with the vendor before tapping send, or hand them the screen and let them read it. This is not rude. This is the version of due diligence that locals already perform with their eyes.
What to do if something feels wrong
You will know the moment it goes wrong. Either the vendor’s chime never fires, or the vendor’s face does the thing where they stop being friendly because they have just realised the money is somewhere they cannot reach.
- Do not tap send again. A second transfer goes to the same place. The scammer wins twice.
- Open the bank app and request a recall. Some banks support it within a window of minutes. Most do not. It is still worth the thirty seconds.
- Ask the vendor to show you their bank app receiving screen. Not their customer-facing display. The actual app feed. If the transfer is not on it, the money is somewhere else.
- Photograph the sticker before you walk away. If it is the substitution version, the same sticker is about to catch the next ten people. Your photo is the only forensic evidence the next victim’s police report will have.
- For amounts that hurt: file at the local công an phường. They will not recover the money. They will record it. Recording it is the only way the same account has a chance of showing up across enough reports.
The honest scope
Most VietQR transactions land. Most vendors are honest. The rails are not the weak point. The vendor is, in the substitution version, also a victim — their day’s revenue is being skimmed by somebody they will never meet. Read the sticker before you scan and you have removed yourself from the funnel.