Scammers are creating fake receipts — and a digital shoplifting boom

Johana Blanco, who worked for a ghost -kitchen company in Lima, sensed something was off when she received an image through WhatsApp last year. It was a receipt purportedly generated by Yape — Peru’s most popular mobile payments app. It was made out to her, complete with the date, time, amount paid, and the full name of the payer. “The voucher’s font seemed odd to me,” Blanco, who had previously worked as a graphic designer, told Rest of World. After checking her Yape account, she saw that no payment had gone through. Blanco confronted the customer, who stopped responding to her texts. “That’s when I knew they had tried to scam me with a fake receipt.”  

It was a relatively small amount — the scammer had wanted to get away with not paying for a meal —  but the practice has drawn scrutiny across some of Latin America’s most popular instant payment apps. To confirm payment, vendors often rely on customer screenshots of app-generated receipts since many apps don’t always notify users when they are paid. But this process also opens the door to easy, low-risk scams. Fake receipts are the most common because they are the easiest to create. Less common are fake SMSes and other scams. But despite their differences, all kinds of app payment fraud share the same purpose: to convince vendors that they’ve been paid when they actually haven’t been. The payment apps are aware of the scams, but they won’t say what they are doing, if anything, to prevent them, aside from counseling their users on how not to fall for them.

In countries like Colombia and Peru, there has been a rise in reports over the past year of scammers using makeshift apps to craft fake receipts to target users of payment apps. Rest of World spoke to representatives of the companies behind these apps, their users, and financial technology experts, and found that these scams are widespread because of how easy it is to fake the app vouchers, marking a new era of digital shoplifting. Users, companies, and experts all agree this new form of fraud is a growing issue, but there is little agreement on who is responsible for resolving the problem.

Since 2020, mobile wallets have boomed in places like Colombia and Peru. These are countries with long-standing unbanked populations that have leapfrogged past traditional banking, opting instead for digital alternatives. In Peru, the use of mobile wallets grew by 75% during 2020, while Colombia saw an increase of 99% between 2020 and 2021. Such broad adoption happened in part because governments have been using these apps to make financial aid payments to underserved populations, Edwin Zácipa, the founder of Latam Fintech Hub, a network of financial tech entrepreneurs, told Rest of World.

Yape was launched in 2016 by Banco de Crédito, Peru’s largest bank. In less than three years, it went from 2 million users to about 9 million — nearly 30% of the country’s population. In Colombia, two of the country’s largest banks, Davivienda and Bancolombia, launched their own apps, Daviplata and Nequi, respectively, which now have roughly 14 million users each. Their combined users add up to more than half the country’s population. Meanwhile, about 40% of Colombians do not have a traditional bank account.

But as payment apps have become more popular, scams have also become prevalent. The accessibility of these apps has lowered the entry barrier for scammers, according to Marcelo Tedesco, executive director of Global Ecosystem Dynamics, an international initiative that studies the economy’s social impact. “Technology catalyzes social phenomena, boosting existing behaviors like street-level shoplifting or scamming,” he told Rest of World.

Reports of these scams have been widely covered, and are easy to find simply by searching for “fake Yape” or “fake Nequi” on social media platforms like Facebook. Yape, Nequi, and Daviplata did not answer Rest of World’s questions regarding the total number of scam reports they had received from their users. A spokesperson from the Colombian police said they did not keep track of the number of digital payment app reports either. However, Brandon Omar Córdova, a social media adviser from Yape, did tell Rest of World that his team receives up to 30 daily reports concerning possible scams.

Córdova said some people have stopped using the app out of fear of being scammed, but that many still continue doing so despite the risk. Blanco, the ghost kitchen worker, agreed. “It’s just so convenient not to be carrying money around, and everyone uses Yape,” she said.

The prevalence of these sorts of scams is also related to the ease with which fake receipts and SMSes can be created. App stores unaffiliated with Google Play and Apple’s App Store — both of which tend to enforce policies that detect and ban malicious apps more rigorously — offer apps that allow users to create fake vouchers simply by typing in the target’s name and phone number, just as they would if they were making a genuine transaction. Then, scammers send these fake receipts over WhatsApp or show them directly to unsuspecting clerks. 

Apart from being easy to use, these scam apps are very easy to create, Diego Velazquez, a developer who had posted a how-to video on his YouTube channel to prove his point, told Rest of World. Scam apps are basically just copying templates based on the original app’s receipts, he said.

Another developer, who goes by the username “acidcoolffc,” published code of an app that creates fake Yape invoices on GitHub “for recreational and educational purposes.” Acidcoolffc’s code was taken down for violating the site’s terms of service, but many others continue to be available. There are also many explainer videos on social media walking users through the process of downloading and using these apps, some of which have thousands of views on TikTok.

It’s still unclear who is responsible for dealing with the fallout from these technologies. “Who warns users against these dangers? How should they learn to avoid them? Sometimes banks are too slow to address them,” Ulf Thoene, professor in the Department of Negotiation and International Trade at the Universidad de La Sabana in Bogotá, told Rest of World. 

Bank representatives interviewed by Rest of World said they are working on awareness campaigns to help users identify scam attempts. However, they wouldn’t say if they were implementing any specific changes on their apps to make these scams less easy. In a statement to Rest of World, Nequi said that it consistently shares advice on how to avoid falling for these schemes, adding that scams were a product of users’ lack of digital financial education. Córdova also said Yape has dedicated posts on its social media profiles that share tips on how to recognize a scam. 

Tedesco, the executive director of Global Ecosystem Dynamics, believes these sorts of answers from payment companies reveal that they are not taking sufficient responsibility for the rise in scams. “There’s a misconception [among financial institutions] in thinking that technology is trustworthy in and of itself, and that therefore, developers shouldn’t close the loopholes used by scammers,” he told Rest of World. “But they can’t just blame the user for being too trusting.”