Queensland police are warning cryptocurrency holders about a targeted phishing scam involving physical letters and QR codes, after victims reported more than $1.47 million in losses across the state between July 3 and 7.

The Financial and Cyber Crime Group said the letters contained recipients’ personal details and directed them to what appeared to be a legitimate cryptocurrency website featuring a purported security update. Police said cryptocurrency scams can also involve fake investment opportunities, employment offers, impersonation and romance scams.

Detective Superintendent Craig McGrath urged recipients to verify the authenticity of any correspondence before scanning QR codes or clicking links. He also warned cryptocurrency users never to disclose private keys, seed phrases, passwords or other authentication credentials without confirming that a request is legitimate.

Police advised Queenslanders to avoid unsolicited investment offers, independently check platforms and licensing details, use strong passwords and two-factor authentication, and securely store wallet information. Victims should immediately contact their bank or financial institution, change online banking passwords and report the incident through cyber.gov.au or Queensland police channels.