Taiwan's Criminal Investigation Bureau warned on November 7 that fraud rings are pairing fake e-commerce customer-service sites with malicious QR codes that can authorize small cross-border charges and, worse, hijack electronic payment accounts consumers thought were idle.
The pattern starts on social listings or messaging apps advertising discounted goods. When a buyer inquires, the seller claims a system error, duplicate charge, or membership problem and steers the victim to a spoofed help desk. The desk sends a QR code for "verification" or "refund cancellation." Scanning it can grant payment permissions on overseas-hosted pages or prompt the user to enter online-banking credentials, turning the phone into a conduit for laundering.
How e-payment binding shows up in case files
Investigators cited recent complaints in which victims discovered unfamiliar bindings on JKo Pay, icash Pay, and PXPay Plus after following refund scripts tied to fake logistics sites. One Taichung case involved a consumer who ordered household goods online, then obeyed instructions from a counterfeit courier page; within hours the account showed rapid inbound and outbound transfers investigators associated with mule activity.
Because one-time passwords function like electronic signatures, handing them to a fake agent can satisfy wallet providers that the accountholder approved linkage even when the accountholder believed they were canceling a subscription. Police emphasized that legitimate merchants do not require QR scans to fix billing mistakes.
Why timing overlaps the 91APP notices
Separate breach notifications from 91APP began hitting inboxes on November 2, giving criminals fresh order details to mimic. The bureau's alert is not limited to that incident — impersonated-brand statistics for the third quarter already listed online retailers such as 86 Shop and DEVILCASE — but investigators expect higher click-through rates while consumers are anxious about data leaks.
Official guidance repeats the triad: do not click unknown links, do not scan unfamiliar codes, do not disclose OTPs or passwords. Suspicious traffic should go to the 165 hotline before money moves, because recovering wired funds after wallet binding is slow even when victims quickly prove innocence.
Practical steps after a scan
Consumers who already scanned a suspect code should unlink third-party payment apps, change banking passwords on a clean device, and request transaction locks from issuers. Screenshots of the fake page help detectives, but they do not replace the need to freeze wallets immediately.
Platforms operating loyalty apps in Taiwan are also tightening merchant onboarding after law-enforcement sweeps of one-page ads in November. For households, the cheapest defense remains procedural: refund requests happen only inside the official app or site where the purchase originated — never through a QR on a chat thread.