Fake letters with a genuine logo
The Vereinte Volksbank is warning companies, tradespeople and associations in Bottrop and Dorsten about fake letters containing a QR code. German outlets WAZ and Dorsten-Online reported on this on 19 and 20 October 2026. The letters carry the bank's name, address and logo, which makes them look deceptively genuine.
The subject line reads "Confirmation of your business registration required". The letter is signed in the name of Marija Kolak, president of the national association of Volksbanken and Raiffeisenbanken. Her signature is forged. According to the association, such letters were sent to customers of Volksbanken and Raiffeisenbanken across Germany.
The QR code leads to a fake login page
Anyone who scans the printed QR code is taken to a fake website with a convincing login page, according to the bank. There, recipients are asked to enter personal data and online banking credentials. The criminals can then take over accounts and redirect payments. The method is called quishing, a form of phishing in which the malicious link is hidden inside a QR code.
The principle is familiar from other cases. Printed bank letters with a QR code look official, and the code does not reveal to the recipient where it leads. The phishing page only appears after the scan. The same method recently hit bank customers in Görlitz and the Prignitz region (report).
Ralf Bröker, head of corporate communications at the Vereinte Volksbank, is clear: "The letter does not come from us, even though it is well forged." His advice: "Tear up the letter and throw it away." A bank never asks customers to enter authentication data outside of online banking.
What recipients should look out for
- • Do not scan the QR code from an unexpected letter and do not follow its instructions.
- • Never enter login or payment data on a page you reached via a QR code from a letter.
- • Scrutinise the sender, especially when artificial time pressure is applied.
- • When in doubt, contact your bank directly; the Vereinte Volksbank can be reached on 02362 2040.
- • If you have already scanned the code and entered data, inform your bank and have your access and cards blocked.
Check a QR code before opening it
QRTrust displays a QR code's full destination address and checks it against multiple phishing databases and AI models before it opens, revealing where a QR code from a letter really leads.
Check a QR code →Sources
About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.