QR code summons scam Malaysia: Never scan this

A fake summons slip with a QR code stuck to your windshield is not from PDRM or JPJ, it's a scam designed to steal your banking details the moment you scan it, and it has already helped drive Malaysia's QR code fraud losses to RM28.67 million in the first half of 2026 alone.

If you've ever walked back to your car and found a printed "summons" tucked under your wiper, telling you to scan a QR code to settle it or attend a "discussion session," you've seen this scam. It's been circulating since mid-2025, it's still active in 2026, and it works because it borrows the one thing that makes real JPJ and PDRM notices scary: the fear of a blacklisted car.

Key Takeaways

• Fake summons slips with QR codes have been left on windshields at shopping mall car parks in Malaysia since May 2025, neither PDRM nor JPJ issue summonses this way.
• Scanning the QR code can lead to a phishing page that harvests your banking login or OTP, a technique known as "quishing."
• Malaysia lost RM28.67 million to QR code scams across 5,134 cases in H1 2026 alone, per Bukit Aman's Commercial Crime Investigation Department.
• Cumulatively, Malaysians have lost RM80.86 million to QR scams across 11,919 cases since January 2023, and case numbers jumped from 655 in 2024 to 5,907 in 2025.
• The only safe way to check a real summons is through official channels, MyBayar (PDRM), MyJPJ, or the Motorist App's AutoConcierge, never through a QR code found on your car.

What the Fake Summons Scam Actually Looks Like

The setup is deliberately convincing. Scammers print slips that mimic official summons formatting  a case number, a "discussion session" appointment, and a QR code positioned as the quickest way to "resolve" it. They're usually left on cars parked at malls and stadiums, where a driver returning from shopping is more likely to react in a hurry.

The QR code is the trap, not the fine. Scanning it typically routes you to a fraudulent payment or login page that requests your banking credentials or one-time password (OTP). Once entered, scammers can drain the linked account this is the "quishing" technique authorities have flagged as the fastest-growing QR scam pattern in Malaysia.

Not every windshield QR notice is fake. To be fair, some councils, Johor Bahru City Council (MBJB) among them, do issue legitimate parking fine reminders with QR codes during discount campaigns. The problem is that a driver standing in a car park has no reliable way to tell a council's real QR code from a scammer's fake one, which is exactly why authorities recommend skipping windshield QR codes entirely and checking through an official app instead.

Why This Is Spreading Right Now

The numbers are accelerating, not slowing down. According to figures given to The Star by Bukit Aman Commercial Crime Investigation Department director Rusdi Mohd Isa, QR code scam cases in Malaysia rose from 223 in 2023, to 655 in 2024, to 5,907 in 2025, and losses jumped from RM4.59 million (2023) to RM6.76 million (2024) to RM40.85 million (2025).

Selangor, Johor, and Kuala Lumpur are the hotspots. Police attribute this to heavier use of online shopping and digital payments in these areas, the same states where mall parking, and therefore windshield-slip scams, are most common.

Real Summons Check vs. Scanning a Windshield QR Code

Expert tip: If a slip on your windshield asks you to scan a QR code, don't. Instead, open MyBayar (PDRM) or the Motorist App, manually key in your vehicle registration number, and check for real outstanding summonses yourself. A genuine summons will always show up through official channels, a scam slip never will.

Common mistake: Assuming a slip is safe because it "looks official." Several documented cases show scammers replicating real summons formatting closely enough,  right down to case numbers, that panicked drivers scan first and check later. The formatting is not proof of authenticity; the issuing channel is.

What to Do If You've Already Scanned It

If you scanned the code but didn't enter any banking details or OTP, no action is needed beyond deleting any app it may have prompted you to install. If you did enter banking information or an OTP, contact your bank's fraud hotline immediately to freeze the account, then lodge a report with PDRM or via the National Scam Response Centre. Do not wait to see if money actually disappears first, by then it's usually too late to reverse the transfer.

Fake QR code summons are cheap to print and easy to place, which is exactly why they've become one of Malaysia's fastest-growing scams, with losses now in the tens of millions of ringgit each year. The fix is simple: never scan a QR code you find on your car, and always verify a summons through an official source like the Motorist App. That one habit closes off the scam entirely.

Frequently Asked Questions

1. Is the QR code summons on my windshield real?

Almost certainly not. PDRM and JPJ do not issue summonses by leaving a printed slip with a QR code on your car — always verify through an official app instead of scanning it.

2. What happens if I scan a fake summons QR code?

It can redirect you to a phishing page that requests your banking login or OTP; entering these details can let scammers drain your linked bank account within minutes.

3. How do I check if I have a real summons in Malaysia?

Use MyBayar (PDRM) or MyJPJ, or check directly through the Motorist App by entering your vehicle registration number — no QR scan needed.

4. Can JPJ or PDRM legally leave a QR code on my car?

No standard PDRM or JPJ enforcement process involves leaving a QR-coded slip on a windshield; genuine summonses are recorded electronically and retrievable through official portals.

5. How much have Malaysians lost to QR code scams recently?

RM28.67 million across 5,134 cases in the first half of 2026 alone, and RM80.86 million cumulatively since January 2023, according to Bukit Aman's Commercial Crime Investigation Department.

6. Which states have the most QR code scam cases?

Selangor, followed by Johor and Kuala Lumpur, largely attributed to higher rates of online shopping and digital payment use.

7. I already entered my banking details after scanning — what should I do?

Call your bank's fraud hotline immediately to freeze the account, then file a police report and report it to the National Scam Response Centre without delay.

8. Are all windshield QR code notices scams?

Not always — some councils issue legitimate parking fine reminders with QR codes — but since there's no way to visually confirm authenticity on the spot, it's safest to verify every one through an official app rather than scanning it.

9. Does the Motorist App show my actual outstanding summonses?

Yes — it pulls directly from official JPJ/PDRM summons data through AutoConcierge, so you're checking verified records instead of an unverifiable printed slip.

10. Is it ever safe to pay a summons via a QR code?

Only if it's generated inside a verified official app or government portal — never one printed on a physical slip left on your car with no confirmed issuing source.

Don't scan it — check it. Download the Motorist App and let AutoConcierge verify your real summons status in under 60 seconds, no QR code required.

Read More: September 2026 Malaysia car discounts: Up to RM12k off

Download the Motorist App now. Designed by drivers for drivers, this all-in-one app lets you receive the latest traffic updates, gives you access to live traffic cameras, and helps you manage vehicle related matters.