QR code scams surge in Malaysia, causing $9.4 million in losses in the first half of 2026

Malaysia recorded more than 5,000 QR code scam cases in the first six months of 2026, with losses nearing RM30 million, as police warn that a tool associated with convenient payments is increasingly being used for fraud.

The tactic, known as “quishing,” combines QR codes with phishing. Victims may be directed to fake websites, payment gateways or applications, or tricked into revealing banking information and approving transactions without understanding their purpose. Bukit Aman Commercial Crime Investigation Department director Comm Datuk Rusdi Mohd Isa said the method had risen sharply since 2023.

Police recorded 223 cases involving RM4.59 million in losses in 2023. The figures rose to 655 cases and RM6.76 million in 2024, then jumped to 5,907 cases and RM40.85 million in losses last year. From January to June 2026, authorities recorded 5,134 cases and RM28.67 million in losses. Overall, 11,919 cases involving RM80.86 million were recorded between January 2023 and June 2026.

“

The significant increase shows that QR codes are increasingly being exploited by syndicates as a medium to disguise malicious links, redirect payments and trick victims into surrendering banking information or approving transactions without realising the actual purpose.

Selangor recorded the highest number of cases, followed by Johor and Kuala Lumpur. Rusdi linked the concentration to high levels of digital transactions, e-commerce activity and cashless payment use in those areas. Investigations examine the entire criminal chain, including QR-code creators and distributors, money flows, recipient and mule accounts, devices, digital evidence, telephone numbers, websites and social-media accounts.

Account holders who knowingly sell, rent out or allow their accounts to receive criminal proceeds may also face investigation. Rusdi said prosecution could follow when there is sufficient evidence, regardless of whether a person is a mastermind, fake-website operator, recipient-account owner or facilitator.

“

The trend shows that QR codes are no longer merely being used as convenient payment tools, but are increasingly being exploited as vehicles for various online scams.