Fake apoBank letter with QR code points to compliance-service.cfd, Mimikama warns
German fact-checking site Mimikama published a warning on 23 October 2026 about a forged letter made to look like it comes from apoBank (Deutsche Apotheker- und Ärztebank). According to Mimikama, a reader submitted a…
- First reported
- Reports
- 1
Source: mimikama.org · published
What happened
German fact-checking site Mimikama published a warning on 23 October 2026 about a forged letter made to look like it comes from apoBank (Deutsche Apotheker- und Ärztebank). According to Mimikama, a reader submitted a letter dated 10 October 2026, with an envelope franked 12 October, bearing the apoBank logo and claiming that access details must be updated 'under §10 GwG' (German anti-money-laundering law). The letter says that without verification the apoBank app, online banking and apoTAN would be completely deactivated and that even transfers and direct debits would no longer work, and it asks the recipient to scan a printed QR code. Mimikama says the smartphone camera preview of the QR code showed the domain compliance-service.cfd, which is not the bank's official address apobank.de; Mimikama did not open the site or test any forms, and bases its finding on the visible address, the letter's content and apoBank's own fraud warning of 24 September 2026, which describes exactly this structure and states that the bank does not have digital access verified by letter via QR code. The reader said similar emails had arrived beforehand, but Mimikama did not have those emails. apoBank is the impersonated party; apobank.de is its genuine domain, not the scammers'. Advice in line with the bank's warning: do not scan QR codes in such letters and check any request through the bank's official channels.
How the scam works
This scheme is known as 'quishing': a QR code leads to a fake website that asks for confidential details such as online-banking logins, TAN codes or card data. Sending the request on paper makes it feel more official than an email, and the threat that the app, online banking and even transfers will be shut down is designed to push recipients to scan the code quickly. Mimikama notes that the reference to the anti-money-laundering law (§10 GwG) is part of the fake justification.
Mimikama says the envelope does not reveal who sent the letter or how they obtained the recipient's address. Austria's Federal Criminal Police Office and the Oesterreichische Nationalbank also warn about unexpected letters with QR codes and pressure to act quickly. apoBank is impersonated and is not involved.
Source
Mimikama, "apoBank: Gefälschter Brief verlangt QR-Verifizierung" (published 23 October 2026).
Red flags
- A bank letter asking you to scan a QR code to 'verify' your access.
- Threats that your banking app, online banking or transfers will be blocked.
- References to laws such as §10 GwG used as the reason for urgent action.
- A QR code that leads to a domain such as compliance-service.cfd instead of apobank.de.
- Similar emails arriving before or after the letter.
If you were targeted
- 1Don't scan the QR code or enter any login, TAN or card details.
- 2Contact apoBank using the phone number or website you already know, such as apobank.de typed in yourself.
- 3If you entered details, call your bank immediately and have your access blocked.
- 4Keep the letter and envelope and report them to the police.
- 5Check your account for transactions you don't recognise.