SCROLL through any online shop or creator page this month, and you will likely see a small square with a QR (quick response) code. It is the Bureau of Internal Revenue (BIR) Registration Seal Badge, and online sellers, freelancers, service providers and content creators covered by the rule have until Oct. 31 to post it. The badge is supposed to tell buyers that the seller is registered with the BIR. But a QR code is just an image, and anyone with a phone can take a screenshot of it.
Revenue Regulations (RR) 7-2024 and RR 15-2024 require people who sell or earn online to post proof of BIR registration. Many did this by uploading their entire Certificate of Registration (COR), which shows their Taxpayer Identification Number and registered address, often a home address.
To address those privacy concerns, Revenue Memorandum Circular (RMC) 38-2026, issued on April 29, replaced the full certificate with the badge. “A taxpayer should not have to expose an entire registration document just to prove that a business is registered,” BIR Commissioner Charlito Martin Mendoza said. RMC 99-2026 later extended the deadline, with no penalties “arising solely from the non-display thereof.”
I sell roasted coffee online, so the rule covers me, too. We registered with the BIR a few years ago, but online selling was not among the business activities listed on our original COR. Before I could get the badge, I had to update our registration and add PSIC 47913, Retail Sale Via Internet. (PSIC is the Philippine Standard Industrial Classification, the code the government uses to classify a business by its activity.)
I could not log in to the Online Registration and Update System (ORUS), so I emailed the BIR to update my email address. It took only a day. I then logged in, added the new code and paid the P30 documentary stamp tax (DST) for the update.
When I scanned our badge, it took me to the BIR’s verification portal at verify.bir.gov.ph, where our COR appeared as valid under our registered name. Our business is a corporation, so buyers see the company’s name, and I don’t mind that. A sole proprietor is in a different position because the registered name is the owner’s own name.
That is where sellers have pushed back. On Threads, user @laykaaa_p asked, “Why is the BIR pushing all of the registered tax payers na i-display ang FULL NAME with MIDDLE NAME not initial, again FULL NAME sa PUBLIC?” Radar.ph reported on Oct. 13.
Antonette Aquino, a creator registered with the BIR since 2021, wrote an open letter to Mendoza on Facebook on Oct. 21. “For thousands of individual freelancers and home-based creators, this business name is their full legal name,” she wrote. She said its public display exposes women and home-based workers to stalking, harassment and identity theft. She also wrote that crafters and part-time digital earners face “overwhelming anxiety over administrative compliance and tax structures.”
The Data Privacy Act allows government agencies to process personal information when necessary to carry out their mandates, but the law still requires proportionality. As of this writing, the National Privacy Commission (NPC) has not issued a public statement on the badge. Aquino asked the BIR to suspend penalties and work with the NPC on another way to verify sellers.
In an Oct. 22 reply to Aquino, Mendoza said the BIR “is already coordinating with the National Privacy Commission” to evaluate safeguards, “including possible refinements to the information accessible through the verification system.”
The problem is that the name that worries sellers is also the detail a buyer can use to detect a copied badge. If someone screenshots our badge and posts it on a fake coffee page, the QR code still opens the genuine BIR page and shows our COR as valid. A buyer who compares the company name with the shop or payment account may catch a mismatch, but one who only looks for the word “valid” could end up paying a scammer.
There is another possible risk: a fake badge whose QR code points to a look-alike site. This is known as quishing, or QR phishing. On Oct. 16, the Cybercrime Investigation and Coordinating Center (CICC) warned that scammers may replace the QR codes displayed by legitimate merchants with fraudulent ones. “So we really have to be careful when scanning QR codes,” Robert Paguia of the CICC said, BusinessWorld reported. I found no report yet of a fake BIR verification site.
The badge is still a better idea than posting full certificates. Aquino proposed a central platform to verify compliance without publicly displaying identifying information, although her letter does not explain how buyers would check whom they are paying. For sole proprietors, the verification page could show the registered business or store name prominently and abbreviate the owner’s middle name. The BIR could also use the platforms where sellers post the badge to remind buyers that the link should lead to verify.bir.gov.ph.
The Christmas rush is when most of us buy online, and the CICC has warned about QR code scams ahead of the holiday season. Before paying a seller, scan the badge and check that the link leads to the BIR’s website. Then compare the name on that page with the name on the shop. If they don’t match, keep your money.
