PETALING JAYA: Malaysia has emerged as the second-highest user of QR (quick-response) codes globally, trailing only behind China, reflecting the nation’s rapid move towards a cashless society.
According to a recent study by global statistics platform Data Reportal, 66.1% of the population used QR codes on a monthly basis in 2023.
The global average stood at 50.8%, with five Asian countries ranking in the top ten for QR code usage.
The study, conducted in 2024, analysed smartphone-based QR code use among individuals aged 16 and above worldwide.
While QR payments are praised for their convenience, cybersecurity experts warn that sharing personal bank QR codes online may expose users to fraud, identity theft and financial loss.
RawSEC Malaysia CyberSecurity Community public communication secretariat Emma Rahim said cybercriminals could exploit QR codes for phishing attacks, unauthorised transactions and impersonation scams.
“If a payment website has security vulnerabilities, hackers could replace the QR code with their own, redirecting payments to fraudulent accounts,” she said.
“In social media groups in which users share QR codes, even administrators could alter the codes to misdirect funds.”
Emma added that hackers could extract sensitive data from bank QR codes to create fake websites or apps, tricking users into revealing login credentials and banking details.
“If scammers gain access to a victim’s bank account, they can initiate fraudulent transactions,” she said.
“In more advanced scams, they might transfer a small amount to the victim and follow up with a phishing email claiming the transaction is linked to illegal activities such as terrorism financing, creating panic to manipulate the victim.”
Despite the risks, QR payments have become a staple at Ramadan bazaars across Malaysia, embraced by both vendors and consumers.
For intern Amir Hakim, 22, cashless payments have made shopping more convenient.
“I rarely carry cash anymore because QR payments are so convenient. Almost every stall accepts them, making it easier to buy things without worrying about small change,” he said.
However, Amir acknowledged the occasional frustration of technical issues.
On busy nights at the bazaar, slow internet connections can delay transactions, leading to awkward moments while waiting for confirmation.
Kuih vendor Zainab Abdullah, 52, said the transition to QR payments has been gradual but inevitable.
“In the past two to three years, QR payments have surged. Most of my customers now prefer using them,” she said.
Initially hesitant, Zainab and other vendors have adapted by using QR code payment speakers that provide real-time transaction alerts.
“It gives us peace of mind because we instantly know when a payment goes through,” she added.
As QR code transactions continue to grow, Emma stressed the importance of immediate action if users suspect their QR codes have been compromised.
“The first step is to contact the bank, freeze or block the account, and change the password to prevent further unauthorised access,” she advised.
She also warned users to avoid downloading banking apps from unofficial sources, such as links shared via social media or messaging apps, which could contain malware designed to steal personal data.
“Only use official platforms when downloading banking apps,” she said.
Although legal protections are in place to safeguard consumers, Emma stressed the need for personal responsibility.
“Users must take proactive steps, such as enabling two-factor authentication and reviewing their bank’s privacy policies to ensure their accounts remain secure.”
As QR payments continue to dominate the digital landscape, she urged users to balance convenience with caution.
“Convenience should not come at the cost of security. Always verify the authenticity of payment platforms and remain vigilant against unsolicited messages or emails requesting personal or financial information.”
