Myanmar wallet fraud: recognise requests, verify receipts, respond

Treat authentication codes as private authority

A one-time code or PIN may authorise access or a transaction. It is not a routine customer-service reference. KBZPay’s security announcement warns users not to share OTPs or PINs with someone claiming to be from the bank. If a caller pressures you to read a code, end that interaction and initiate contact through the official app or a number independently obtained from the provider. Do not use a callback number supplied in the same suspicious message. A convincing name or profile photograph is not authentication.

Verify what a QR code actually asks you to do

A QR code may contain a payment instruction or simply a web address. Those are different actions. Before authorising payment, read the recipient, amount and currency in your own trusted application. If a code opens a browser asking you to sign in, install an unknown app or provide card details, pause and verify the purpose. The Singapore Police Force and CSA advisory explains QR phishing and malicious-download risks; its technical precautions are useful generally, but Singapore’s reporting route is not presented here as Myanmar’s local complaint authority.

Suspicious situation and safer response

Confirm receipt on the receiving side

For a sale or repayment, use your own account history rather than a screenshot supplied by the sender. Compare the amount, reference and time, and check whether the entry is completed or merely pending. Do not release goods because an animation or a cropped receipt looks convincing. If the sender reports a genuine debit but you see no credit, both sides should retain their respective references. Avoid asking for the other person’s login to investigate. The provider can trace the event without exchanging account secrets between customers.

Recognise a second scam after the first loss

Someone offering guaranteed recovery may ask for an unlocking fee, an advance tax or access to your phone. That creates a new transaction and a new risk. Do not grant remote control of a device containing financial applications to an unsolicited contact. Keep the original incident separate from any later approach, including the messages and claimed organisation. A real case number should be verified through the institution that issued it. Publication of a complaint on social media can attract impersonators, so avoid posting complete references or identity documents publicly.

Respond promptly without destroying useful evidence

If access or money appears compromised, use a trusted device or communication channel to reach the provider. Wave’s official care guidance directs suspected fraud cases to its support service. Explain what happened, which account is affected and whether a transfer has completed. Ask what restrictions or recovery steps are available. Preserve transaction records, timestamps and relevant messages before deleting suspicious material. Do not keep interacting with the suspected scammer to conduct your own investigation; the immediate goal is to limit further unauthorised activity.

Make a simple household verification rule

Agree with relatives that an urgent request for money will be checked using a second known channel. This is especially useful if a familiar messaging account is compromised. For a new recipient, compare the account details with the person directly before authorising the full intended payment. Set account notifications and review transactions regularly. Keep recovery information current through official processes. These habits do not guarantee that fraud will be prevented, but they reduce reliance on a single message, screenshot or unexpected caller at the moment a payment is authorised.

An immediate response checklist

• Stop the suspicious interaction and do not disclose further codes or grant device access.
• Contact the financial provider independently and ask about available account restrictions.
• Preserve the transaction reference, amount, time, recipient and relevant messages privately.
• Review recent account activity and secure associated email or mobile access as the provider advises.
• Use the appropriate local reporting route and retain every case reference.
• Reject unsolicited recovery services that demand another payment or account credentials.

Sources and verification

• Account security announcements — KBZPay — 2026-10-23
• Protecting yourself from malicious QR codes — Singapore Police Force / CSA — 2026-10-23
• Wave Care Centre and dispute support — Wave Money — 2026-10-23