Bank letter with a QR code: genuine or a scam?

The fake letter arrives in the name of a bank and asks you to “update” a security procedure or your online banking. A prominent QR code is meant to make it quick. It leads to a copied website that asks for your login details, personal data or an activation code. With these, criminals can take over your account or make transfers.

The same trick appears with other senders, in emails and on QR stickers placed over genuine codes, for example at parking meters.

• A generic greeting such as “Dear account holder” instead of your name.
• The letter mentions an account or procedure you do not use.
• The QR code is supposed to take you to a login page or ask for bank details.
• Time pressure or threats, such as blocking your account.
• Clumsy, unusual wording, especially towards the end of the letter.

A letterhead and logo prove nothing: both are easy to copy.

1. Open your banking app or type your bank's web address yourself. If there is no message asking you to act, that speaks clearly against the letter.
2. Call your bank on a number you already know: from your card, your statement or the official website, not from the letter.
3. If you want to see where the code leads, use a QR code scanner that shows the address before opening it. Look for small differences: a zero instead of an “o”, an unfamiliar ending or extra characters right after the bank's domain. Do not enter anything there.

QR codes for payments on invoices are common, by contrast. They fill in a transfer in your banking app. Check the recipient and account number before you confirm it.

• If you entered details, contact your bank immediately via its official number and have online banking and your cards blocked.
• Check your transactions and change your login details.
• Report it to the police.
• Keep the letter and envelope as evidence.

If you only scanned the code and entered nothing, close the page and still report the letter to your bank.

Scanning with ExplainThisDoc captures the letter as a document and does not open the QR code. With Pro, the analysis checks the letter's text for typical phishing signs: time pressure, threatened account blocks, requests to enter login or payment details, unusual links and web addresses that do not match the sender. If it considers the letter a likely scam, a security notice appears at the top. The app does not follow the QR code and does not check links. The free Light analysis does not assess these signs.

In your archive, the letter stays with your note: when you called the bank and what they said. That helps if more letters arrive or you report it. A warning is not a proof of authenticity, and the absence of a warning does not prove a letter is real.