A posted letter with your personal details and a QR code claims your crypto account needs a security update
Scammers post physical letters containing your real personal details and a QR code, claiming your crypto account needs an urgent security update. Scanning the QR leads to a credential-harvesting site that steals your wallet seed phrase or login. $1.47M was lost in Queensland alone over five days in July 2026.
Also known as: crypto QR code letter scam Australia, physical letter crypto phishing, quishing crypto wallet scam, postal letter QR code cryptocurrency fraud, crypto account security update letter scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Do not scan the QR code — go to your exchange or wallet directly by typing the official URL in your browser
- 2 Never share your seed phrase or private key with anyone or enter them on any website — no legitimate service ever asks for them
- 3 If you scanned the QR code and entered any credentials, immediately move your crypto to a new wallet with a freshly generated seed phrase and change all exchange passwords
- 4 Enable two-factor authentication using an authenticator app (not SMS) on all your crypto exchange accounts
- 5 Report the letter to Queensland Police or to the AFP's ReportCyber at https://www.cyber.gov.au/report
- 6 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.
Red flags
- ⚠ A physical letter arrives claiming to be from a crypto exchange or digital asset platform, referencing your real name and address
- ⚠ The letter says your account requires an urgent security update and instructs you to scan a QR code to complete it
- ⚠ Scanning the QR code takes you to a site that requests your login credentials, seed phrase, or private key
- ⚠ The letter is unsolicited — you never signed up for paper correspondence from this service
- ⚠ Legitimate crypto exchanges and wallets never contact you by physical mail to request credentials or wallet security actions
- ⚠ The fact that the letter contains your real details is not proof it is genuine — personal data is widely available from data breaches