Quishing in Malaysia: RM28.67M Lost to QR Scams

Quishing in Malaysia: RM28.67M Lost to QR Scams

QR codes have become so normal in Malaysia that we barely notice them anymore.

At a mamak stall. At a parking machine. On a restaurant table. At a checkout counter. Inside an e-wallet app.

Scan, confirm, done.

That convenience is exactly what scammers are exploiting.

According to figures reported by The Star and picked up by Amanz on September 4, Malaysians lost RM28.67 million to QR-code scams during the first six months of 2026 alone.

The growth is even more worrying.

Reported cases increased from 223 in 2023 to 655 in 2024, before jumping to 5,907 in 2025.

That's more than 26 times the 2023 case count.

And we're not even looking at a full year of 2026 yet.

What is "quishing"?

The name is simple:

QR + phishing = quishing.

The underlying attack isn't particularly new. It's phishing delivered through a QR code.

The problem is that QR codes hide the thing you normally inspect first: the destination.

With a normal phishing email, you can often see the URL before clicking it.

With a QR code, what you see is this:

█████████████████
██ ▄▄▄▄▄ ██ ▄▄▄ ██
██ █   █ ██ █   ██
██ █▄▄▄█ ██ █▄▄▄ ██
██       ███████ ██
██ ▄▄▄▄▄ ██ ▄▄▄ ██
█████████████████

There is no obvious visual indication of whether it leads to:

https://legitimate-bank.example/

or:

https://bank-login.example-attacker.com/

The QR itself doesn't tell you.

Your scanner has to decode it first.

And that's the opening scammers need.

How quishing actually works

There are several common patterns.

1. Payment redirection

A legitimate-looking payment QR is replaced or covered with one controlled by the attacker.

You think you're paying the merchant.

You're actually paying someone else.

This is particularly effective in physical locations because the QR code is part of the environment you already trust.

A sticker placed over a genuine QR can be enough.

2. Fake payment pages

The QR sends you to a website that looks like a bank, payment provider or e-wallet.

The page may ask you to:

• log in;
• verify your account;
• enter card information;
• provide an OTP;
• or approve a transaction.

At that point, the QR code has simply become the delivery mechanism for a conventional phishing attack.

3. Malicious or unwanted downloads

A QR code can also point to a website designed to convince you to download an application or file.

The QR isn't inherently malicious.

The destination is.

That's an important distinction because it explains why the same technology can be completely legitimate in one context and dangerous in another.

The Malaysian numbers

The reported figures show just how quickly this category has grown:

Table figures: CCID Director Rusdi Mohd Isa via The Star, September 2026 — see also Fintech News Malaysia and The Straits Times.

Selangor recorded the highest number of reported cases, followed by Johor and Kuala Lumpur.

That isn't particularly surprising.

These are areas where digital payments, e-commerce and e-wallet usage are heavily embedded into everyday transactions — Shopee accepting TNG eWallet via DuitNow QR is what that embedding looks like.

More digital payment infrastructure means more opportunities for abuse.

The important thing is not to interpret that as "QR payments are unsafe".

The problem is the layer around them:

people, interfaces, physical QR codes, websites and social engineering.

For context, Malaysia recorded billions of ringgit in total scam losses in 2025. QR scams are only one part of a much larger fraud problem.

But they're an interesting category because they bridge the physical and digital worlds.

A scammer doesn't necessarily need to compromise your phone.

Sometimes they just need to replace a sticker.

The physical attack nobody thinks about

One of the simplest quishing attacks is also one of the least technical.

Imagine this:

REAL MERCHANT QR
       ↓
┌──────────────────┐
│     [ QR ]       │
│ Pay Merchant     │
└──────────────────┘

       ↓

ATTACKER STICKER
       ↓
┌──────────────────┐
│     [ QR ]       │
│ Pay Merchant     │
└──────────────────┘

From a distance, nothing looks wrong.

The table still has a QR code.

The sign still says "Pay here".

Your brain fills in the rest.

That's why QR fraud isn't purely a cybersecurity problem.

It's also a human-interface problem.

Why "just scan it" is bad security advice

A QR code is not trustworthy just because it looks professional.

Anyone can generate one.

For example:

import qrcode

qr = qrcode.make(
    "https://example.com/login"
)

qr.save("qr.png")

That's it.

There is no special certification involved in creating the image.

A malicious QR can have the same visual quality as a legitimate one.

Legitimate QR       Malicious QR

██████████          ██████████
██      ██          ██      ██
██ ████ ██          ██ ████ ██
██ █  █ ██          ██ █  █ ██
██ ████ ██          ██ ████ ██
██      ██          ██      ██
██████████          ██████████

The difference exists in what the QR encodes, not in whether the pixels look "safe".

That's why the correct question isn't:

"Does this QR look legitimate?"

It's:

"Where does this QR actually take me, and what is it asking me to do?"

How to scan more safely

You don't need to stop using QR codes.

You just need to stop treating them as trusted by default.

Check the destination

After scanning, pay attention to the destination shown by your phone or payment application.

Look at the actual domain.

Don't rely on:

[Bank logo]
"Secure verification"
"Official payment"

A convincing logo proves nothing.

The domain matters.

And watch for deceptive domains such as:

secure-bank.example-attacker.com
bank-login.example.net
verify-wallet.example.org

The important part of a hostname is not always the first word you see.

Check the physical QR

If you're paying at a physical location, look at the code itself.

Does the sticker appear to be placed over another sticker?

Does the surface look tampered with?

Does the payment name shown by your banking or e-wallet application match the merchant?

If something doesn't match, stop.

Never enter banking credentials into a random QR destination

A QR code that takes you to a page asking for banking credentials should immediately raise suspicion.

Don't assume the page is legitimate because it contains the correct logo or uses HTTPS.

HTTPS tells you that the connection is encrypted.

It does not tell you that the website is trustworthy.

Be careful with QR codes sent through messages

A QR code received through WhatsApp, Telegram, email or social media is still a link — and as messaging identity changes, the sender name above it means less than it used to.

The fact that it is an image doesn't make it safer.

Treat it exactly as you would treat an unknown URL.

Verify payment details before confirming

For payment QR codes, the final confirmation screen is another security boundary.

Check:

Merchant / recipient
Amount
Reference
Account details where available

If the recipient doesn't match who you intended to pay, stop.

The developer perspective

There is an interesting lesson here for developers.

We often think about phishing as a problem with malicious URLs.

But QR codes demonstrate that the delivery mechanism can be almost anything.

A URL can arrive through:

Email
SMS
WhatsApp
QR code
NFC
Browser redirect
Short URL
QR sticker
PDF
Image

The security property doesn't come from the transport mechanism.

It comes from what happens after the user follows it.

That's why applications handling QR-based payments should make the destination and transaction context as explicit as possible.

Good interfaces should help users answer:

Who am I paying?
How much?
Why?
Where is this payment going?
Can I trust this destination?

before irreversible actions are taken.

The same principle applies to developers building authentication flows. If those flows touch Malaysian user data, the PDPA logging and retention rules apply to every step above.

Don't assume:

QR code
    ↓
trusted

Instead:

QR code
    ↓
decode
    ↓
validate
    ↓
display context
    ↓
user confirmation
    ↓
transaction

Every step is an opportunity to reduce risk.

QR codes aren't the enemy

It's worth making this distinction clear.

QR codes themselves are not a security vulnerability.

They're just a convenient encoding mechanism.

The same QR code technology can be used for:

Restaurant menus
Wi-Fi credentials
Event tickets
Payments
Authentication
Product information
Malicious phishing links

The security depends on what is encoded, how it is processed, what the user sees and what happens after the scan.

The bigger problem is that people have learned to associate QR codes with "scan and continue".

Scammers are exploiting that reflex.

The uncomfortable part

Malaysia's cashless ecosystem is growing because QR payments are convenient.

That's a good thing.

But convenience also removes friction — and friction is sometimes exactly where security checks happen.

The lesson from RM28.67 million isn't:

"Stop using QR payments."

It's:

Stop assuming that a QR code is trustworthy simply because someone put it in front of you.

A QR code is just another way of delivering data.

Treat it like a link.

Inspect the destination.

Verify the recipient.

And when something asks you to surrender credentials, approve a payment or install something unexpectedly, stop and verify through an official channel.

Because the most dangerous QR code isn't necessarily the one that looks suspicious.

It's the one that looks completely normal.

---

Sources:

• Amanz — Rakyat Malaysia Kerugian RM28.67 Juta Akibat Penipuan Kod QR Pada H1 2026
• The Star — Cops: QR code scams on the rise
• Fintech News Malaysia — Malaysians Lose RM28.67 Million to QR Code Scams in Six Months
• The Straits Times — QR code scams on the rise in Malaysia
• Fintech News Malaysia — Malaysians Lost RM2.8 Billion to Scams in 2025
• Malay Mail — E-duit raya, QR scams drive 76pc jump in Malaysia's fraud losses

Sources

• The Star: Cops: QR code scams on the rise
• Fintech News Malaysia: Malaysians Lose RM28.67 Million to QR Code Scams in Six Months
• The Straits Times: QR code scams on the rise in Malaysia, with $9.4 million in losses in first half of 2026