Malaysian police recorded 5,134 QR code scam cases and RM28.67 million in losses between January and June 2026, according to figures from the Bukit Aman Commercial Crime Investigation Department. The figures point to a sharp multi-year rise in so-called quishing fraud, with cumulative losses since 2023 now approaching RM81 million.
Key Facts At A Glance
- 5,134 QR code scam cases were reported in Malaysia between January and June 2026, with losses of RM28.67 million
- Cumulative figures since January 2023 stand at 11,919 cases and RM80.86 million in losses
- Annual case counts rose from 223 in 2023 to 655 in 2024 and 5,907 in 2025
- Annual losses rose from RM4.59 million in 2023 to RM40.85 million in 2025
- Selangor recorded the highest number of cases, followed by Johor and Kuala Lumpur
- Figures were provided by Bukit Aman Commercial Crime Investigation Department Director Rusdi Mohd Isa
- Police investigations extend to fund movement, receiving accounts, and coordination with banks and telecommunications companies
- Account holders may face investigation if evidence shows they knowingly allowed scam networks to use their accounts
Scam Method And Regional Concentration
QR code scams, known as quishing, work by concealing the true destination of a link or transaction behind a scanned code. Scammers use the technique to divert payments or direct victims to fraudulent sites that request banking credentials and transaction approvals. Rusdi Mohd Isa linked the concentration of cases in Selangor, Johor and Kuala Lumpur to heavier use of online shopping and digital payments in those areas.
Multi-Year Escalation Pattern
The first-half 2026 figures continue a rapid escalation visible since 2023. Case counts grew roughly threefold each year through the period, while losses increased nearly ninefold from 2023 to 2025. The first six months of 2026 already represent more than a third of the entire 2023-to-2026 case total, though publicly available reporting does not include a full-year 2026 projection.
Investigative Scope Beyond Code Distribution
Police investigations reportedly extend beyond individuals who create or circulate fraudulent QR codes to examine the broader flow of funds, including the accounts used to receive scam proceeds. This work involves coordination with banks and telecommunications companies and other agencies. Officials said account holders could themselves face investigation if evidence indicates they knowingly allowed their accounts to be used by scam networks. The public has been advised to verify the origin of a QR code before scanning, particularly when it comes from an unknown sender applying pressure for immediate payment or account information.
Publicly available information does not specify what additional regulatory or technical measures, if any, are planned specifically to address QR code fraud beyond existing investigative and public-awareness efforts.