Kiwi mobile phone users are being warned to be vigilant when scanning QR codes as mobile devices rapidly emerge as a new entry point for scams.

New data from Eset, a European cybersecurity company, shows almost 200,000 cyber threats were detected across its New Zealand user base in the year to March 2026, or roughly one every three minutes.

Phishing remains the most common threat, but attacks are increasingly being delivered across multiple formats, including emails, documents, PDFs and QR codes, making them harder to detect, a media release on behalf of Eset said.

QR code-based scams, known as “quishing”, have only emerged at scale locally in the past six months but already account for about one in every 10 cyber attacks over the company’s base of over 250,000 New Zealand users – more than doubling in frequency since March.

Cybersecurity experts said the trend reflected a more sophisticated threat landscape, with attackers testing different approaches and scaling those that were most effective, and that the data was indicative of wider cyberattack patterns occurring across New Zealand.

The surge coincides with changes to low-value imports that came into effect on April 1. A new customs levy of $2.21 per parcel, plus GST (around $2.54), now applies to goods valued under $1000 and may see some consumers contacted to pay charges before delivery.

Experts said the shift was creating a new layer of risk, as consumers who were not accustomed to post-purchase courier fees may be more likely to engage with unexpected messages or payment requests.

Scott Leman, New Zealand country manager for Eset at Chillisoft, said these scams were engineered to align with normal user behaviour, making them far more difficult to detect and increasing the likelihood of compromise.

Scott Leman, New Zealand country manager for Eset at Chillisoft. Photo / Supplied

He said the timing was significant, with scammers quick to exploit changes in consumer behaviour.

“We’re now seeing a situation where people are receiving legitimate requests for courier payments they may not have expected, and that creates confusion. Attackers can leverage that uncertainty to insert fraudulent messages that look almost identical.

“When someone thinks a payment might be legitimate, they’re far more likely to click a link or scan a QR code without stopping to verify it.

“This is now being reported across New Zealand, from fake NZ Post payment requests to unsolicited parcels containing QR codes designed to prompt interaction, as well as fraudulent codes placed in public settings such as parking meters or shopfronts offering free Wi-Fi.

“These attacks are effective because they mirror routine actions people trust. When a QR code appears in a familiar context, whether it’s paying for parking or tracking a delivery, people are far less likely to question it, which increases the likelihood of compromise.”

Leman said hackers were no longer relying on a single method to breach systems, instead combining multiple approaches to improve their chances of success.

“One of the biggest changes we’re seeing is the shift toward mobile and multi-format attacks, moving away from single-format phishing toward more complex approaches that span email, documents, web and mobile interactions, with QR code scams emerging as a significant new threat.”

He said cybercriminals were now combining different formats to circumvent security controls and reach users more effectively.

Leman said that might involve an email with a PDF attachment prompting a QR code scan using a mobile device, which then directs users to a fake website.

“Attacks were also increasingly being launched in co-ordinated waves targeting specific countries, with hackers focusing on one market at a time and sending large volumes of emails, texts or QR code scams in short bursts.

“The inherent risk with this new form of attack is that QR codes are not commonly perceived as a threat, so people tend to scan them without hesitation, often on mobile devices where it is harder to verify links before opening them.”

The research shows April detections were down 25% year-on-year, but Leman said the decline risks creating a false sense of security and masks a shift in how cybercriminals were operating.

Leman said because the malicious link was embedded within the QR code, it could bypass traditional security filters.

“People should avoid scanning QR codes from unknown sources, be cautious of unexpected messages, and consider using security tools that can scan and block malicious links before they are opened, and avoid entering sensitive information unless they are certain a website is legitimate.”