PHLRUBY on QRPh: There Is No QRPh App to Download

QRPh Is a Standard, Not a Product

Before 2019 every Philippine wallet and bank printed its own QR code, and a GCash code was useless to a Maya user. The BSP fixed that with Circular No. 1055, which set a single National QR Code Standard built on the international EMVCo specification. Every participating institution now generates the same kind of code, so one scan works across issuers. That standard is what QRPh is. It has no logo you download, no installer, no APK, and no company behind it that could publish one.

There are two flavours in daily use. QRPh P2P moves money person to person, which is what you use when a friend shows you a code to settle a bill. QRPh P2M moves money person to merchant, which is what you scan at a sari-sari store, a fuel pump or a payment page. Both settle over the same clearing rails that already carry your transfers: InstaPay for near-instant, low-value payments and PESONet for batch settlement.

Where QRPh Already Lives on Your Phone

If you have any of the apps below, you already have QRPh. Look for the scan or QR icon on the home screen. The feature is usually labelled Scan QR, Pay QR, or Generate QR, and the code produced is a QRPh code whether or not the app spells that out.

• GCash: Scan QR on the dashboard, plus Generate QR to receive money into your wallet.
• Maya: Scan to Pay, with a personal receive code under your profile.
• GoTyme Bank: QR pay and receive inside the main account view.
• UnionBank, BPI, BDO, Metrobank, RCBC, Landbank and most BSP-supervised banks: QR scan built into the mobile banking app.
• Merchant acquirers such as Bux, PayMongo and Xendit issue QRPh codes on the receiving side.

The practical test is simple. Open your wallet, tap the QR scanner, and point it at any QRPh code from a different issuer. If it resolves to a merchant or a person's masked name, interoperability is working exactly as designed and there is nothing further to install.

Limits, Timing and What It Costs

QRPh inherits the limits of the rail underneath it rather than setting its own. That means the ceiling you hit is an InstaPay ceiling, and the daily cap is whatever your own wallet or bank applies to your verified account.

Never trust a fee quoted on a web page over the number your own app shows you at the moment of payment. Issuers change pricing, promotional waivers expire, and the confirmation screen is the only figure that binds.

Why the Fake QRPh APK Search Is Dangerous

Because millions of Filipinos search for QRPh by name, a market has grown for sideloaded Android packages that claim to be the official app. They are not. There is no institution that could publish one, so every file offered under that name is by definition unofficial. The common patterns are an overlay app that harvests your banking credentials when you open a real wallet, an accessibility-service abuser that reads OTP notifications, or a plain adware wrapper.

• Only install payment apps from the Google Play Store or the Apple App Store, and check the publisher name matches the institution.
• Never enable Install from unknown sources for a payments app. There is no legitimate reason to.
• Never grant an app Accessibility or Notification Access unless you understand exactly why it needs them.
• If a QR code is sent to you by a stranger in Messenger or Telegram, treat it as a payment request from an unknown party, not as a link to install anything.
• Report suspected fraud to your issuer immediately and to the BSP consumer assistance channel if the issuer does not resolve it.

Using QRPh Around Casino Deposits and Cashouts

PAGCOR-licensed operators generally do not ask you to scan a QR code to deposit. The normal flow is a redirect into your GCash, Maya or GoTyme app where you approve the payment with your MPIN or biometrics, and the funds ride InstaPay to the operator. If a site instead shows you a static QR code pointing at a personal wallet number, stop. That is a hallmark of an unlicensed operator and there is no chargeback route once you have authorised the push payment.

On the way out, the rule that matters more than any QR question is name matching. Licensed operators must pay winnings to an account in the same verified name as the player account. A QR code belonging to a relative or an agent will be rejected, and attempting it usually freezes the withdrawal while compliance reviews it. PHLRUBY is an information site, not an operator or a licence holder, and we always point readers back to PAGCOR's own published list of licensed operators before they fund anything.