QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stall menus, EZ-Link top-up posters, parking meters, bubble tea loyalty cards, and even stickers slapped on lamp posts. They are fast, convenient, and now one of the easiest ways for scammers to drain your bank account. If you want a simple way to stay safe without becoming a part-time cybersecurity analyst, Lunyb is built for exactly this moment. Our Scam Checker lets you paste or scan any suspicious QR link and get a verdict before you tap "proceed."

This guide explains how QR code scams (also called "quishing") work in Singapore in 2026, the local variants the Singapore Police Force and ScamShield have been warning the public about, and the exact steps — plus the Lunyb tools — that stop you from becoming the next victim.

What is a QR code scam?

A QR code scam is any attack where a criminal uses a QR code to send you to a fake website, trigger a malicious payment, or trick you into installing a dangerous app. Because QR codes are just machine-readable shortcuts to a URL, you cannot "read" one with your eyes — you have to trust whatever your camera decodes. That trust gap is what scammers exploit.

In Singapore, QR scams typically end in one of three outcomes:

You land on a fake Singpass, DBS, OCBC, UOB, or GovTech login page and hand over credentials.
You authorise a PayNow or bank transfer that goes to a mule account, not the merchant.
You sideload an Android APK that gives attackers remote access to your phone, SMS OTPs included.

Why QR scams are exploding in Singapore

Singapore is one of the most QR-dependent economies in the world. SGQR unified PayNow, NETS, GrabPay, and card wallets into a single sticker, which trained an entire population to scan first and ask questions never. Scammers noticed. The Singapore Police Force and the National Crime Prevention Council have repeatedly flagged QR-based phishing as a fast-growing category, with losses often running into tens of thousands of dollars per victim.

Three local factors make it worse:

High trust in physical stickers. A QR on a stall counter feels official. Scammers paste their sticker right on top of the real one.
Singpass as a single key. One phished Singpass login can unlock CPF, IRAS, HDB, and bank onboarding.
Cross-border messaging. WhatsApp and Telegram deliver QR images from "sellers," "delivery agents," and "officers" that bypass SMS filters entirely.

The most common QR code scams in Singapore right now

1. The hawker stall and bubble tea sticker swap

A scammer physically covers the merchant's SGQR with a lookalike sticker. You scan to pay $4.50 for kopi; the money goes to a mule. The merchant doesn't see the payment, you argue, and by the time anyone checks, the sticker is gone. Always confirm the merchant name shown in your banking app matches the stall before you hit send.

2. Fake "survey for a free gift" at malls and MRT stations

Someone in a lanyard asks you to scan a QR to claim a bubble tea, mooncake, or $10 NTUC voucher. The link opens a convincing form asking for NRIC, phone, and bank login "to verify eligibility." There is no gift. There is a drained account.

3. Parking and summons QR scams

Fake parking notices or "LTA fine" letters arrive with a QR to pay immediately. The page mimics the real HDB, URA, or LTA portal. Real government payments in Singapore go through gov.sg domains and Singpass — not random short links.

4. Carousell and Facebook Marketplace "delivery QR"

A "buyer" says they'll pay via PayNow but needs you to scan their QR to "confirm receipt." The QR actually initiates a transfer from your account, or opens a fake DBS/OCBC login. Legitimate PayNow never asks the seller to scan anything.

5. Quishing emails pretending to be Singpass, IRAS, or your bank

Instead of a clickable link (which email filters catch), scammers embed a QR image. You scan with your phone — which has none of your laptop's security tools — and land on a phishing page. This is now one of the top delivery methods globally.

6. Malicious APK installs

Especially aimed at Android users: the QR leads to a page offering a "banking app update," "CDC voucher app," or "food delivery app." The APK, once installed, reads your SMS, captures OTPs, and enables silent transfers. iOS users are not immune — scammers push configuration profiles instead.

How to spot a dangerous QR code before you tap

Your phone shows a preview URL after scanning. Pause there — that preview is your last line of defence. Use this checklist:

Does the domain match the brand? dbs.com.sg is real; dbs-sg-login.com is not. singpass.gov.sg is real; singpass-verify.co is not.
Is it a shortener you don't recognise? Scammers hide destinations behind generic short links. If you can't see the final URL, don't open it.
Does it force an app install? Legitimate Singapore services live on the App Store and Google Play. If you're told to "enable unknown sources," stop.
Was the QR delivered unexpectedly? A QR on a sticker over another sticker, in an unsolicited email, or from a stranger in a lanyard is a red flag by default.
Does the page ask for NRIC + password + OTP in one go? No real Singapore service bundles these on a single screen reached from a QR.

How Lunyb protects you from QR code scams

Checking every QR by hand is realistic for about three days, then everyone gets lazy. That's why we built Lunyb — a single app that does the suspicious work for you.

Scam Checker: paste the link, get the verdict

After you scan a QR, your phone shows a preview URL. Copy it into Lunyb's Scam Checker before you open it. We analyse the destination for phishing signals, impersonation of Singapore banks and government services, risky redirects, and known scam infrastructure — and tell you whether it's safe to proceed. It takes about three seconds and saves careers.

Scam Shield and on-device threat blocking

Lunyb's on-device protections use an encrypted DNS shield to block connections to known malicious domains at the network level. Even if you accidentally tap a quishing link, the dangerous destination can be stopped before the page loads or an APK downloads. No traffic is routed to a third-party server — the blocking happens locally on your phone.

Privacy Check and Security Score

Most QR scam victims in Singapore are compromised because an app on their phone already had too many permissions, or an old breach exposed their email and phone to scammers in the first place. Lunyb's Privacy Check audits app permissions, and Data Breach Alerts tell you when your email or Singapore mobile number appears in a known leak so you can rotate passwords before criminals use them.

Password and Photo Vault

If you reuse the same password across DBS, Shopee, and Lazada, one phished login breaks everything. Lunyb's encrypted Password Vault generates and stores unique logins, and the Photo Vault keeps sensitive images (NRIC scans, bank statements) out of your camera roll where screenshots and cloud backups can leak them.

Safe link shortening and QR generation for merchants

If you run a Singapore business, the way you create your own QR codes matters too. Lunyb's URL shortener and secure QR platform lets you generate trackable, editable QR codes with a clean branded short link — so your customers learn to trust your domain instead of random redirects. Read more in our honest review of Lunyb's privacy-first URL shortener or compare the alternatives in our Rebrandly 2026 review.

Lunyb vs. doing it all manually

Protection step	Manual approach	With Lunyb
Check if a QR link is a phishing site	Inspect the URL yourself, Google the domain, hope you're right	Paste into Scam Checker, get a verdict in seconds
Block connection to known scam domains	Nothing on your phone by default	On-device encrypted DNS shield blocks them automatically
Know if your email or number is in a leak	Check breach sites one by one, manually	Automatic Data Breach Alerts
Audit app permissions	Dig through Settings on every app	Privacy Check surfaces risky permissions in one view
Create trusted QR codes for your business	Free generators with no editability or branding	Editable, trackable QR + branded short links

What to do if you already scanned a scam QR in Singapore

If you think you've been caught, act within the first hour — that's when mule transfers are still reversible.

Lock your bank account. DBS, OCBC, and UOB all have a "kill switch" or safety lock in their apps. Use it immediately.
Call your bank's anti-scam hotline and request transaction recall.
Report to the Singapore Police Force via the ScamShield app or by calling the Anti-Scam Helpline at 1800-722-6688.
File a report at police.gov.sg with the QR image, URL, time, and location.
Change your passwords for Singpass, email, and any banking app — starting with the ones that share credentials.
Run Lunyb's Privacy Check and Security Score to identify what else on your phone may be compromised, and enable breach alerts so you're warned when your data surfaces for sale.
If you installed an APK or profile, factory reset the phone. Remote-access malware cannot always be uninstalled cleanly.

A simple safety routine for 2026

You don't need to memorise every scam variant. Build these five habits and you'll avoid the vast majority of QR attacks in Singapore:

Never scan a QR that is a sticker over another sticker. Ask the merchant to show you their app's own QR.
Always read the preview URL before tapping "open."
Pay via your banking app's merchant search, not a scanned code, whenever you have doubt.
Treat any QR from email, WhatsApp, or Telegram as untrusted until a scam checker confirms it.
Install Lunyb and turn on Scam Shield, Data Breach Alerts, and Privacy Check — one app, one setup.

Get protected in under five minutes

QR scams in Singapore are going to keep getting slicker. The fix is not paranoia — it's a layer of automatic protection that catches the stuff your eyes can't. Lunyb gives you that layer: Scam Checker for suspicious links, on-device blocking for known threats, breach alerts for the data that's already out there, and an encrypted vault for the credentials that matter.

Start at lunyb.com — take our free privacy quiz to see where you're exposed, then download the Lunyb app from the App Store or Google Play. Plans start from about $19.99/month, you can cancel anytime online, and the Scam Checker alone usually pays for itself the first time it catches a fake Singpass or DBS link.

FAQ

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force and ScamShield have repeatedly warned about QR-based phishing, especially targeting banking apps, Singpass, and e-commerce platforms. Because Singapore uses SGQR for almost every payment, scammers get high success rates from a single fake sticker or email image.

How can I check if a QR code is safe before I open the link?

After scanning, your phone shows a preview URL — don't tap it yet. Copy the link into Lunyb's Scam Checker, which analyses the destination for phishing, impersonation of Singapore banks or government services, and known malicious infrastructure, and tells you whether it's safe.

What should I do if I already scanned a scam QR and entered my details?

Lock your bank account using your banking app's safety switch, call your bank's anti-scam hotline, report to the police at 1800-722-6688 or via ScamShield, change your Singpass and banking passwords, and run a full privacy check on your phone. If you installed any app from the link, factory reset the device.

Does Lunyb work in Singapore?

Yes. Lunyb is available in Singapore on both iOS and Android, and the Scam Checker, Data Breach Alerts, Privacy Check, and on-device threat blocking all work on local networks and with Singapore phone numbers and email addresses.

How is Lunyb different from just using ScamShield?

ScamShield is excellent for filtering scam calls and SMS. Lunyb is complementary: it focuses on the link, QR, and data-exposure side — checking suspicious URLs, blocking known scam domains at the network level on your phone, alerting you to data breaches, auditing app permissions, and storing passwords in an encrypted vault. Most Singapore users benefit from running both.