Guide · Singapore
Payment fraud: what a merchant actually controls
Most of what is sold as fraud prevention is about transactions you cannot see. The losses a small Singapore merchant actually takes are mostly at their own counter, mostly small, mostly repeated, and mostly caused by a member of staff being asked to make a judgement call they should never have been asked to make.
In short
- The fake payment screenshot is the one that costs Singapore counters real money.
- It exists because a static QR sticker makes your staff verify payment on the customer’s phone.
- Dynamic PayNow removes the judgement: the code carries the amount and you get the notification.
- Card-not-present is where online losses land, and the controls there are the checkout’s, not the terminal’s.
- The internal one — refunds and voids by staff — is real, and it is fixed with an authorisation step, not suspicion.
The screenshot, which is the one that matters here
A static PayNow sticker carries no amount. The customer types the figure themselves, taps pay, and turns their phone around. Your member of staff looks at a screen someone else is holding and decides whether the sale is complete.
That is the vulnerability, and it is not a technology problem — it is that the merchant has been made to verify payment on the customer’s device. Convincing payment-confirmation screens are trivially available. The person judging is usually the newest member of staff, during the busiest twenty minutes of the day, with a queue watching.
The loss is small each time and it does not appear in any report, because the transaction never existed. There is nothing to reconcile against and no record to find. A merchant discovers it, if at all, as a slow unexplained gap between what the till says and what the bank says.
Dynamic PayNow removes the judgement call entirely. The QR is generated per sale and carries the exact amount, so the customer cannot underpay by typing a different figure, and the merchant receives a payment-success notification — your team reads your own system rather than the customer’s screen. The PayNow guide covers the mechanics.
Why there are no numbers on this page
You will find figures circulating for how much QR screenshot fraud costs Singapore merchants. None of them traces to a source that survives being checked, and a licensed institution quoting an unverifiable loss statistic is the institution that gets quoted back. The mechanism is describable without a number, and the mechanism is what a merchant can act on.
The card counter
Card-present fraud is the least of a Singapore merchant’s problems and the most designed-against: chip and contactless carry cryptographic authentication, and the schemes have spent decades on this half.
What is worth knowing is that the entry method changes where liability tends to sit. A magnetic stripe transaction is the weakest of the three, which is exactly why it is worth having available for the visitor whose card requires it and not worth reaching for otherwise. If the chip works, use the chip.
The practical counter controls are unglamorous and they are the ones that work: complete the transaction on your own device rather than on anything a customer produces, keep the terminal where staff can see it, and treat an unusually large sale from a walk-in the way you would treat any unusual request — by slowing down rather than by speeding up.
Online, where card-not-present losses land
When the card is not physically present, the merchant carries more of the exposure, and that is the structural reason card-not-present interchange is higher — see how fees are built.
The controls that matter online are properties of the checkout rather than of the terminal: whether cardholder authentication is applied, what data the checkout collects, and how quickly you notice an unusual pattern of orders. 3-D Secure is the scheme mechanism for shifting the authentication step to the issuer, and whether and how it is applied is a question for whoever runs your checkout.
Uniweb Pay does not publish fraud screening, scoring or authentication specifics, so nothing on this site should be read as a claim about them. Ask, and get the answer in writing — from any provider, including this one.
The one nobody wants to name
Refunds and voids issued by staff are a real source of loss in retail and F&B, and the reason it goes unaddressed is that raising it feels like an accusation. It is not: an unmonitored refund function is a design problem, and design problems are fixed with design rather than with trust.
The fix is the same one the refunds guide arrives at from the opposite direction. Staff should be able to refund on the device, because a refund that needs a support ticket will not happen when a customer is standing there — and there should be an authorisation step, so that the answer to "who can refund what" is not "anyone, any amount, unrecorded".
Then look at the report occasionally. Refunds concentrated on one shift, one device or one operator are visible in a transaction list filtered by outlet and by method, and they are invisible in a monthly total.
What to ask a provider
- Is the QR dynamic — does the code carry the amount — and do I get a payment-success notification on my own system?
- Can staff refund and void on the device, and is there an authorisation step?
- Can I see transactions filtered by outlet, by device and by method, and export them?
- What happens when a card sale is disputed, who handles it, and what will you need from me?
- What is the administration fee on a dispute, separate from the disputed amount?
The first three are answerable by any provider today and are the ones that change your exposure at the counter. Uniweb Pay answers yes to all three: Dynamic PayNow carries the amount and notifies, and the merchant portal filters and exports by outlet and by method.
Four and five are the ones this site does not publish. That is a decision rather than an oversight, and it is stated here so that a merchant asks rather than assumes.
Questions merchants ask
What is the fake PayNow screenshot scam?
A customer shows the merchant a convincing but fabricated payment-confirmation screen for a payment never made. It works against a static QR sticker, because the sticker carries no amount and the merchant is verifying payment by looking at the customer’s phone rather than at their own system.
How do I stop it?
Use a dynamic QR rather than a printed sticker. Dynamic PayNow generates the code per sale carrying the exact amount, and the merchant gets a payment-success notification — so the confirmation comes from your own system and there is no judgement call to make at the counter.
Is contactless less secure than chip?
Both carry cryptographic authentication and both are strong. Magnetic stripe is the weakest of the three entry methods, which is why it is worth having available for a visitor whose card requires it, and not worth using when the chip works.
Does Uniweb Pay screen transactions for fraud?
Uniweb Pay does not publish fraud screening, scoring or authentication specifics, so nothing here should be read as a claim about them. It is a fair question to ask before signing, and the answer belongs in the agreement.
How do I control refunds issued by my own staff?
Not with suspicion — with design. Staff should be able to refund on the device, because a refund needing a ticket will not happen with a customer standing there, and there should be an authorisation step so refunds are attributable. Then review the transaction list filtered by outlet and device; concentration is visible there and invisible in a monthly total.
Talk to us about your counter
Uniweb Pay is a Singapore merchant acquirer, licensed by MAS as a Major Payment Institution (No. PS20200612). Tell us what you sell and who pays you, and we will tell you whether we are the right fit — including when we are not.