PETALING JAYA: More than 5,000 QR code scam cases have been recorded from January to June this year, leading to nearly RM30mil in losses.
Known as “quishing”, this scam tactic has risen sharply since 2023, said Bukit Aman Commercial Crime Investigation Department (CCID) director Comm Datuk Rusdi Mohd Isa (pic).
“The significant increase shows that QR codes are increasingly being exploited by syndicates as a medium to disguise malicious links, redirect payments and trick victims into surrendering banking information or approving transactions without realising the actual purpose.
“Quishing is a form of phishing that uses QR codes to direct victims to fake websites, payment gateways or applications.
“The trend shows that QR codes are no longer merely being used as convenient payment tools, but are increasingly being exploited as vehicles for various online scams,” Comm Rusdi told The Star.
He said 223 QR code scam cases were recorded in 2023, involving losses of RM4.59mil.
ALSO READ: Scammers turn woman’s public plea for aid into legal nightmare
The number of cases rose to 655 in 2024, with losses of RM6.76mil.
“However, the real jump came last year, when the number of cases increased more than eightfold to 5,907, while losses rose nearly sixfold to RM40.85mil,” he added.
This year, the number of cases recorded between January to June was at 5,134 with losses at RM28.67mil.
Comm Rusdi said QR code scams were no longer an isolated form of fraud, as syndicates were using the technology to facilitate various types of online scams.
Selangor recorded the highest number of cases, followed by Johor and Kuala Lumpur.
Comm Rusdi said this was closely linked to the high number of digital transaction users, e-commerce activity and cashless payment facilities in these areas.
“Overall, 11,919 QR code scam cases involving losses of RM80.86mil were recorded between January 2023 to June 2026,” he said.
Comm Rusdi said every report received was investigated according to the circumstances of the case and the relevant laws.
“Investigations do not only focus on individuals who created or distributed QR codes, but cover the entire criminal chain, including tracing the flow of money, identifying recipient accounts and investigating mule accounts.
“Investigations also include analysing devices and digital evidence, tracing telephone numbers, website addresses and social media accounts, as well as working with financial institutions, telecommunications providers and relevant agencies,” he said.
Comm Rusdi added that mule accounts were a key component that enabled syndicates to receive and transfer proceeds from scams.
Account holders who knowingly sell, rent out, hand over or allow their accounts to be used to receive criminal proceeds may also be investigated, depending on their level of involvement and the evidence obtained.
“If there is sufficient evidence, prosecution will be initiated regardless of whether the individual is the mastermind, operator of a fake website, owner of the recipient account or a facilitator for the syndicate,” he said.
Comm Rusdi urged the public to exercise caution before scanning any QR code, particularly codes sent by unknown individuals or accompanied by urgent requests for payment, refunds, prizes or account verification.
