DKB Scam by Mail: Fake Bank Letter with QR Code in Circulation
A Reddit user warns about a deceptively authentic scam letter in the name of DKB bank. The letter contains a QR code leading to a fake login page. The scam also targets other banks like Deutsche Bank, Commerzbank, and ING.
What Happened?
A user on Reddit (r/Finanzen) shared a deceptively authentic-looking letter allegedly from DKB (Deutsche Kreditbank). The letter arrived by post – complete with postage stamp, address, logo, and signature. But it's a sophisticated fraud attempt.
The fake DKB letter as shared on Reddit. Source: Reddit r/Finanzen
The letter's heading reads: 'The New Payment System of DKB – Important Information for You.' It claims that a new feature for checking or savings accounts related to real-time transfers has been activated. To 'verify' this, recipients are asked to scan a QR code.
The insidious part: At first glance, the letter looks absolutely legitimate. Only upon closer inspection do inconsistencies become apparent.
How the Scam Works
- You receive a professionally designed letter in the name of your bank with an official logo and signature
- The letter asks you to scan a QR code – supposedly to verify a new account feature
- The QR code leads to a deceptively authentic copy of the DKB login page
- On the fake page, your login credentials, TANs, and personal information are intercepted
- With the stolen data, fraudsters can empty your account or commit identity theft
How to Spot the Fake
Timeline Inconsistency
The letter states the new feature was activated in October 2025 – but the letter only arrived months later.
Missing Legal Block
The typical fine print block with imprint, board of directors, supervisory board, and legally required disclosures is missing.
QR Code Pressure
The entire letter focuses suspiciously on a single action: scanning the QR code.
Suspicious URLs
The QR code leads to domains with suspicious extensions (e.g., .ru) or shortened URLs that hide the real destination.
Not Just DKB – These Banks Are Affected
Police and BSI warn: The same scam is being carried out in the name of various banks:
- • DKB (Deutsche Kreditbank)
- • Deutsche Bank
- • Commerzbank
- • Targo-Bank
- • ING
The fraudsters send mass letters hoping that among the recipients are actual customers of the respective bank.
What to Do If You Receive Such a Letter?
- • Never scan QR codes from letters you didn't expect
- • Call your bank using the official phone number on your card to verify the letter
- • Forward suspicious letters to phishingverdacht@dkb.de (for DKB letters)
- • File a police report – bring the original letter
- • If you've already entered data: Contact your bank immediately and have your account blocked (Emergency hotline: 116 116)
Real-World Test: Would QRTrust Have Detected the Phishing URL?
We ran the actual phishing URL from the DKB scam letter through our API. The result is clear:
Particularly noteworthy: The traditional security databases (Google Safe Browsing, PhishTank) did not detect the URL – likely because the site was too new or already offline. However, our own AI systems immediately flagged it:
QRTrust LLM: Phishing detected – 100% Confidence
ML Detection (Gradient Boosting): Phishing pattern detected – 99.99% Confidence
Google Safe Browsing: Not detected
PhishTank + OpenPhish: Not detected
The ML analysis shows why the URL is suspicious: The domain 'dkb.app-verwaltung.app' imitates the DKB name as a subdomain, has a domain reputation of only 40/100, is not listed in the top 1 million trusted domains, and has no SSL certificate history.
This proves: Even when traditional databases don't yet know a phishing URL, QRTrust detects the threat through AI-powered pattern recognition in real-time.
How QRTrust Protects You from This Scam
QRTrust was designed for exactly these cases. Scan suspicious QR codes with QRTrust before opening them with your regular camera. Our scanner detects in real-time whether a QR code leads to a known phishing site – and warns you before any damage occurs.
QRTrust checks against over 1 million known phishing URLs and uses AI-powered pattern recognition to identify even new threats.
Scan QR Codes Securely Now →