Chinese criminals have found a new scam – stealing people’s QR payment codes, which are vital in the mainland’s cashless society.

Tencent Holdings Limited apologized to victims after a man was arrested in Chongqing, a municipality in southwestern China, after four shoppers told police that money was transferred from their accounts via the WeChat Pay account, without their authorization, news website HK01.com reported.

Police said the suspect looked for his targets – people who were queuing up to pay in supermarkets and had their WeChat payment app turned on. The man moved near his targets and scanned their QR Codes from behind, then transferred money from the victims’ bank accounts. He stole 500 to 900 renminbi (US$72 to US$129) each time.

He always left immediately once the transactions were completed, with the whole process only taking about 10 seconds. He was arrested on May 13.

The QR code, or quick response code, scanning allows consumers to make small payments or transfer money by simply scanning the image and confirming the transaction. Similar cases happened in Shanghai in February when a man was arrested after scanning people’s QR codes to steal a total of 2,940 renminbi. More cases have been reported in Hebei and Jiangsu provinces.

Authorities said users should set passwords for each transaction. Tencent apologized to users and said they could apply the claims via the insurance protection scheme on the WeChat platform. Tencent will compensate those who were robbed, but they have to prove it.