Guides / Payment QR codes

Is it safe to share your GCash or Maya QR code?

Updated 5 November 2026 · By the FirstHour team

Short answerShowing it to the person who is paying you is what it's for. The Bangko Sentral ng Pilipinas (BSP) describes the person who scans a code as the one who sends the money. What we couldn't find is an official page saying what a code tells people about you, so we won't guess. Our advice: before you post one publicly, check what shows up when someone scans it, and keep the rest of the screenshot clean.

What a payment QR code is for

GCash says you can make a free personal QR code to send money to the right person, and save it to use later. In GCash, you tap QR, then Generate QR, then Receive Money via QR Code. Or you tap Send, then Generate QR.

BSP's FAQ on QR Ph, the national standard, says the person receiving money shows their code and the payer scans it to start the payment. It says the payer then checks the details and approves the transaction. For payments at a distance, it says you can screenshot your code and send the picture by email or a messaging app. It also says that if you're the one receiving, you don't have to share your account number with the sender. The FAQ file appears to be from June 2020, so apps may have changed since.

What someone learns from your code

We looked for an official page that says what a personal GCash or Maya code shows (your name, a partly hidden name, your number) and didn't find one. GCash's page on generating a code doesn't say. BSP's FAQ says only that a code can hold personal and financial information. Maya's page, which is about paying a shop, says that when you scan a merchant's static QR code, the merchant's name shows on your screen and you type in the amount. It doesn't describe personal codes.

So we can't tell you what yours reveals. Our advice, which you can do in a minute:

  1. Look at it as a stranger would. Ask a friend to scan your code with their own payment app, and tell you what name and details appear before they confirm anything. They shouldn't send money.
  2. Decide from that. If it shows more than you'd say to a stranger, keep the code for people you know.
  3. Post it only where you must. A code on a public post can be copied by anyone who sees it.

Keep the rest of the screenshot clean

What's around the code matters too. A screenshot of your wallet can include your balance, your number, or a notification. Our advice: generate the code, screenshot only that screen, and look at every corner before you send it. Here's what to cover on a payment screenshot, and what to do with old ones. A solid black box is safer than blur (why).

Fake codes and swapped codes

GCash's newsroom advises people to be careful with QR codes from unknown or untrusted sources, and says scammers may put fake QR Ph codes on posters, emails, receipts or messages. It also tells people to check the merchant name shown before confirming a payment. That's advice for when you scan someone else's code, including one a person sends you.

Our advice: if you put your code on display, such as in a shop or on a poster, check now and then that it's still yours and hasn't been covered with another. We didn't find an official source on that, so it's only a sensible habit.

Remember that BSP's FAQ says transactions are final and can't be reversed, so a wrong payment can't simply be cancelled. The FAQ says a sender who overpays can ask the receiver to send the extra back in a new payment. If your phone is lost, here's how to block GCash and Maya.

How FirstHour helps

FirstHour doesn't look for payment QR codes. Protect lists QR codes only for Wi-Fi passwords, and payment codes aren't among its groups (the full list), so it won't tell you which pictures have yours. It also can't change, cancel or limit a code, and it can't tell you who scanned it. Its bank account number group leaves out e-wallet numbers.

It can help when you share a screenshot with your code on it. In Share, FirstHour suggests boxes over the card numbers, codes and account numbers it finds, and you can add or move boxes over your balance or name yourself. The copy you send has no location or camera details, and your original isn't changed. Here are the steps. Don't cover the code you want people to scan, and look over the whole picture before you send it. It doesn't find faces, and handwriting and very blurry pictures are often missed.

Questions

Can someone take money from my account with my QR code?

BSP's FAQ describes the code as something the payer scans to send money to you, and the payer approves the payment. We didn't find an official page that answers every worry about it, so don't treat this as a guarantee. Our advice: never share a PIN or a code sent to your phone.

Is my Maya code the same as my GCash code?

We don't know. BSP says a QR Ph code can be read by any participating bank or e-money app, but we didn't find an official page comparing what each app's personal code shows.

Can I reuse the same code?

BSP's FAQ says yes, if your app didn't ask you for any extra information when you made it. GCash says you can save yours to use later.

Sources

All guides