Malaysia has recorded 5,134 QR-code scam cases in just the first six months of 2026, with losses of RM28.67 million. Royal Malaysia Police say the tactic — often called quishing, short for QR phishing — has grown rapidly as QR codes have become normal for payments, menus, ticketing, promotions and account logins.
The warning is especially relevant in Kuala Lumpur because the city is one of Malaysia's most cashless environments. Police data reported on 3 September places Kuala Lumpur behind Selangor and Johor among the areas with the highest number of QR-code scam cases. The figures cover the public generally, not tourists specifically, but visitors routinely scan unfamiliar codes in restaurants, malls, attractions and shops — exactly the moment when a quick verification habit matters.
Scanning a QR code is not automatically dangerous. The risk is that the code can hide where it sends you. Police say losses usually happen after the victim then enters banking details, approves a transaction, provides an OTP/TAC, pays a fee or installs malicious software.
How big is the QR-code scam problem in Malaysia?
The latest figures supplied by Bukit Aman Commercial Crime Investigation Department show a steep rise:
- 2023: 223 cases, RM4.59 million in losses.
- 2024: 655 cases, RM6.76 million in losses.
- 2025: 5,907 cases, RM40.85 million in losses.
- January–June 2026: 5,134 cases, RM28.67 million in losses.
Across the period from January 2023 to June 2026, police recorded 11,919 QR-code scam cases involving RM80.86 million in losses. The jump is not simply more people using QR payments; police say criminal syndicates are actively exploiting QR codes as a way to disguise malicious links, redirect payments and obtain banking information.
What exactly is “quishing”?
Quishing is phishing delivered through a QR code. Instead of tapping a suspicious-looking link in an email or text message, the victim scans a square code and is taken somewhere they did not expect. Because the destination is hidden until after the scan, a fake code can look no different from a legitimate one printed on a menu, poster, payment stand or message.
Police say current tactics include QR codes that lead to fake bank, e-commerce or corporate login pages; fraudulent payment gateways; pages requesting card details or verification codes; and links that prompt victims to install malicious apps.
The payment scam travellers should understand
Malaysia's DuitNow QR system is widely used by local merchants. In the normal merchant-presented flow, the customer scans the merchant's QR code using a banking or payment app, checks the recipient and amount, and authorises the payment. PayNet's technical documentation describes that same basic flow: the merchant presents the code and the customer scans it.
That matters because police are specifically warning about the reverse scenario. If someone says they are paying you and then tells you to scan a code they sent, log in, enter a TAC/OTP or pay an “activation” fee to receive the money, stop. Police say a recipient does not need to do those things simply to receive a normal DuitNow QR payment.
Fake QR stickers are only one version of the scam
A common mental picture is a scammer placing a fake sticker over a real restaurant or parking-payment QR code. That is possible, but Malaysia's current cases are broader. Police say QR codes are also being distributed through social media, messaging apps and e-commerce conversations under stories involving refunds, prizes, parcel deliveries, sales campaigns, account verification or supposed payments.
In other words, do not focus only on whether a physical sticker looks suspicious. The bigger question is whether the action you are being asked to take makes sense.
What to check before scanning a QR code in Kuala Lumpur
- Look at where the code came from. A code on a staffed restaurant counter or inside an official app is lower-risk than one sent by an unknown person in WhatsApp, Telegram, SMS or social media.
- Use your banking or payment app for payments. Do not let a random QR code push you into downloading a separate app or APK.
- Check the merchant or recipient name before confirming. If the name does not match the business or person you expect, cancel the transaction.
- Check the amount carefully. A legitimate QR payment still requires you to confirm what is being paid.
- Never provide an OTP, TAC, PIN or password because a QR page asks for it unexpectedly.
- Do not approve a banking-app notification you do not understand. A scam often fails unless the victim completes the final approval.
- Be wary of urgency. “Scan now to get your refund”, “verify your account immediately” and “claim this prize before it expires” are classic pressure tactics.
Menus and attraction information: the risk is different
Many Kuala Lumpur restaurants use QR menus, and attractions may use QR codes for maps, tickets or information. A menu QR code should normally open a straightforward web page. It should not need your internet-banking username, card PIN, TAC, OTP or permission to install an application.
If a simple menu or information code suddenly asks for financial credentials, close it. Type the venue's official web address yourself or ask staff for another way to view the information.
Why scanning alone usually isn't the moment money disappears
This is one of the most useful points from the police warning. Bukit Aman says simply scanning a QR code rarely triggers an immediate money transfer by itself. The victim normally has to take another step — entering credentials, authorising a payment, installing malware or approving access.
That gives you a second chance. If the page after the scan looks wrong, asks for unusual permissions or turns a simple action into a complicated financial process, stop there.
What if the code asks you to install an app?
Treat that as a major red flag unless you independently know exactly what the application is and are obtaining it from the official Apple App Store, Google Play or the service provider's verified channel. Police warn that malicious applications can obtain access to messages, device information or screen content when victims install them and grant requested permissions.
For a visitor, there is almost never a good reason for a restaurant, parking sign, street promotion or stranger to require an unknown app installation simply to complete a routine QR interaction.
If you think you have paid the wrong QR code
Act quickly. Malaysia's authorities advise scam victims to contact their bank immediately and contact the National Scam Response Centre (NSRC) on 997. Current police and Bank Negara Malaysia material describe 997 as the national rapid-response channel for financial scams. You should also lodge a police report.
Do not wait until you are back at your hotel, at the airport or home from Malaysia if you have just noticed the transaction. The sooner the bank and authorities know, the better the chance that suspicious funds can be traced or frozen.
Use Semak Mule before sending money to a suspicious account
Royal Malaysia Police operates the Semak Mule portal, which can be used to check suspicious bank accounts, phone numbers and related scam information recorded by the Commercial Crime Investigation Department. It is not a guarantee that an unlisted account is safe, but it is a useful extra check when something about a payment request feels wrong.
Why Kuala Lumpur travellers should care without becoming paranoid
QR codes are not the problem. Kuala Lumpur's cashless payment culture is convenient, and millions of legitimate QR transactions happen normally. The lesson from the 2026 surge is much simpler: a QR code is only a hidden link or payment instruction until you verify what appears after you scan it.
You do not need to stop using QR payments. Use official apps, read the recipient name and amount, refuse unexpected credential requests, and never let urgency push you through a banking approval you do not understand.
Official and primary sources
- The Star — police figures and CCID warning, 3 September 2026
- The Star — CCID explanation of current QR-code scam tactics
- Royal Malaysia Police — Commercial Crime Investigation Department
- Bank Negara Malaysia — what to do if you have been scammed
- Royal Malaysia Police — Semak Mule
- PayNet — DuitNow QR merchant-presented payment flow