Fake letter in the name of Apobank
A doctor from Dornburg-Camburg in the Saale-Holzland district of Thuringia lost about 100,000 euros to a quishing scam, public broadcaster MDR reported in its programme "Kripo live" on 20 September 2026. The physician has run a practice in Dornburg-Camburg for 25 years. He went public with his case to warn others.
According to MDR, the fraud began about two months ago with a letter that appeared to come from Deutsche Apotheker- und Ärztebank (Apobank), a German bank for health professionals. The letter asked the doctor to verify his details so that his account would continue to run smoothly. A QR code in the letter was supposed to lead directly to the banking website. The doctor scanned the code and entered his bank details. The site was a fake designed solely to capture login credentials.
The doctor told MDR the letter seemed credible because it arrived by conventional post and looked deceptively genuine. He said he had previously been asked several times by email to verify his details.
Call from a supposed bank employee
In the evening after a working day, a supposed bank employee called, MDR reported. He said suspiciously large transfers to third-party accounts had been detected and asked whether the doctor might have fallen victim to phishing. The doctor thought of the QR code he had scanned and accepted the offer of help.
The caller claimed the transfer limit was set at 500,000 euros per day and offered to lower it to 100,000 euros. The doctor agreed and confirmed a TAN, a one-time transaction code. He later found that his daily limit had previously been 25,000 euros, he said. With the TAN, he had not lowered the limit but quadrupled it.
Sina Poser of Jena police told "Kripo live" the approach showed how professionally and psychologically skilfully the perpetrators operate. It was not spontaneous behaviour but targeted manipulation, she said.
39 transfers approved instead of cancelled
In the next step, the caller said 39 transfers had been executed, according to MDR. The doctor could still stop them by cancelling the orders, he was told. In fact, he was approving the perpetrators' transfers. He noticed the fraud shortly after the call when he checked his account again.
Jena police said the money was sent to twelve different accounts and quickly withdrawn in cash from several machines in North Rhine-Westphalia. For the victim, the money is gone, Sina Poser of Jena police told MDR.
| Step | Sequence according to MDR and police |
|---|---|
| Letter | Fake letter in the name of Apobank asks the recipient to verify account details via a QR code |
| Phishing site | The code leads to a cloned banking site, where the doctor enters his login details |
| Phone call | A supposed bank employee reports suspicious transfers and offers help |
| Limit | Using a TAN, the doctor confirms a supposed reduction of the daily limit; in fact it rises from 25,000 to 100,000 euros |
| 39 transfers | Instead of cancelling 39 transfers, he approves them; the money goes to twelve accounts |
| Cash | According to police, the money is withdrawn from cash machines in North Rhine-Westphalia |
Scam targets medical practices
The scam specifically targets doctors, MDR reported. Apobank and police have warned about it. The Association of Statutory Health Insurance Physicians in Hesse (KV Hessen) said in September 2026 that practices were again receiving more fake letters in the name of Apobank. Quishing has been observed more frequently since summer 2024, it said.
Fake bank letters with QR codes have also been reported in other regions. In March 2026, Heilbronn police warned of letters in the name of several banks, including Apobank, after a case in Tauberbischofsheim (report). The Dornburg-Camburg case shows perpetrators combining access obtained by letter with a follow-up phone call.
Police advice
- • Stay calm if you receive a supposed call from your bank about a transfer.
- • Check your account balance yourself first, then contact your bank using the number you know.
- • According to police, your bank will never call to have you confirm a transfer by phone.
- • Before approving any TAN, read which order you are actually confirming.
- • Open online banking via the app or an address you type yourself, not via a QR code from a letter.
Quishing map: 37 documented incidents
The QRTrust quishing map lists incidents in Germany, the Netherlands and Belgium with location, date, method and source. The Dornburg-Camburg case has been added as the third documented case of fake bank letters.
QRTrust checks a QR code's destination address against multiple phishing databases and AI models before it opens.
View the quishing map →Sources
About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.