QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stall payment terminals, EZ-Link top-up posters, parking signs at HDB carparks, condo visitor sign-in boards, restaurant menus, and even stickers on the back of taxis. That convenience is exactly why scammers love them. In 2026, QR code scams (also called quishing) are one of the fastest-moving threats the Singapore Police Force and the Cyber Security Agency of Singapore (CSA) continue to warn residents about.

At Lunyb, we built our Scam Checker and Scam Shield specifically for moments like this: you scan a code, a link pops up, and you have seconds to decide whether to tap it. This guide walks you through how QR scams work in Singapore today, how to spot them, and how Lunyb makes staying safe a one-tap habit rather than a guessing game.

What Are QR Code Scams?

A QR code scam is any attack where a malicious QR code is used to send you to a fake website, trigger a payment, install a harmful app, or trick you into handing over your bank login, Singpass credentials, or card details. The code itself looks identical to a legitimate one — the danger is in where it points.

Because QR codes hide the destination URL inside a pattern of squares, you cannot "read" a QR with your eyes the way you would read a link in an email. That is the weakness scammers exploit.

Why Singapore Is a Prime Target

High QR adoption. PayNow, NETS QR, SGQR, GrabPay, and ShopeePay have trained everyone to scan without hesitation.
Dense public spaces. Hawker centres, MRT stations, and bus stops are full of printed codes that are easy to overlay with a sticker.
Mixed-language audiences. Scam pages in English, Mandarin, Malay, or Tamil can target different residents convincingly.
Trusted gov-style branding. Fakes often imitate IRAS, LTA, HDB, URA parking, or Singpass — all organisations Singaporeans rightly expect to interact with digitally.

The Most Common QR Code Scams in Singapore in 2026

The tactics keep evolving, but almost every case we have seen reported falls into one of the patterns below.

1. Sticker-Over-Sticker Payment Fraud

A scammer prints a fake PayNow or SGQR code and sticks it on top of the real one at a hawker stall, drinks kiosk, or small F&B outlet. You scan, pay, and the money goes to the fraudster's account instead of the merchant's.

2. Fake Parking & Summons Notices

A "parking fine" or "LTA summons" slip appears on your windscreen with a QR code. Scanning it opens a page that mimics an official government site and asks for your card details or Singpass login.

3. Quishing Emails and SMS

Instead of a clickable link (which email filters catch), scammers send a PDF or image with a QR code — supposedly from DBS, OCBC, UOB, IRAS, or SingPost — claiming you need to "verify" or "reactivate" something. The QR leads to a phishing login page.

4. Fake Food, Delivery, and Survey QR Codes

Flyers in letterboxes or posters near lifts promise free bubble tea, NTUC vouchers, or a "5-minute survey" with a cash reward. The QR installs a malicious app (especially on Android via sideloaded APKs) or harvests personal data.

5. Condo and Visitor Sign-In Spoofs

At some condos and offices, visitors sign in via QR. Scammers have been known to replace or add a QR near the guardhouse, capturing NRIC numbers, phone numbers, and vehicle plates — valuable data for follow-up scams.

6. "Verify Your Account" QR on Crypto and Investment Sites

Fake investment opportunities circulated on Telegram and WhatsApp direct users to scan a QR to "verify their wallet" or claim a bonus. The destination drains the connected wallet or steals seed phrases.

How to Spot a Dangerous QR Code

You do not need to be a security expert. A handful of checks handles most cases.

Inspect the sticker. Peel-up corners, a code pasted over another, or a mismatched colour are red flags at hawker stalls and petrol stations.
Preview the URL before opening. Modern phones show the destination link after you scan. Read it before tapping.
Check the domain carefully. singpass.gov.sg is real; singpass-verify.com or sing-pass.sg-login.xyz is not. Scammers love hyphens and extra words.
Be suspicious of urgency. "Pay within 2 hours or face a fine" is a pressure tactic, not official government behaviour.
Never install an app from a QR code. Legitimate banks, IRAS, and LTA will not ask you to sideload an APK.
Use a scam checker. If you are unsure, paste the URL into a tool that checks reputation before you load the page.

Red Flags Checklist

Code is on a sticker, not printed into the signage
URL does not end in .gov.sg when it claims to be government
Page asks for Singpass, OTP, or full card details immediately
Request to download an app outside the App Store or Play Store
Poorly written copy, weird fonts, or mismatched logos
Promises of money, vouchers, or refunds you did not expect

How Lunyb Protects You From QR Code Scams

Manual checks work — if you remember to do them, every single time, under pressure, while queueing for kopi. Lunyb is built so you do not have to rely on willpower. Our app turns the right checks into defaults.

Scam Checker: Verify Any Link in Seconds

Before you tap a link that came from a QR code, paste it into Lunyb's Scam Checker. We analyse the URL for known phishing patterns, suspicious domain tricks, and reputation signals and tell you clearly whether it looks safe. It works for links from SMS, WhatsApp, Telegram, email, and QR scans — the exact channels Singapore scammers use.

Scam Shield & Caller Protection

QR scams rarely stop at the scan. Victims often get a follow-up call from a "bank officer" or "LTA investigator" to finish the job. Lunyb's Scam Shield helps flag suspicious callers so you can hang up with confidence instead of second-guessing a Singapore number you do not recognise.

On-Device Threat Blocking

Even if you scan a bad code by mistake, Lunyb's on-device tracker and threat blocking (an encrypted DNS shield built into the app) helps stop connections to known malicious domains at the network level, right on your phone. No complicated setup — it runs quietly in the background.

Data Breach Alerts

If a QR scam ever does catch you off-guard and your email or phone number ends up in a leaked database, Lunyb's Data Breach Alerts tell you so you can change passwords and lock down accounts before the damage spreads.

Encrypted Password & Photo Vault

Reusing passwords is how one quishing incident becomes five compromised accounts. Lunyb's encrypted Password Vault lets you keep unique, strong passwords for DBS, OCBC, Singpass, Shopee, and everything else — and the Photo Vault keeps sensitive images (NRIC scans, bank letters) off your main camera roll.

Privacy Check & Security Score

Our Privacy Check reviews which apps on your phone can see your location, contacts, SMS, and camera — the same permissions a malicious app installed via a bad QR would try to abuse. Your Security Score gives you one number to improve, instead of a vague feeling that you "should do something about security."

A Safer Way to Share Your Own QR Codes

If you run a stall, event, or small business and need to share QR codes yourself, Lunyb's link shortening and secure QR platform lets you generate branded short links and QR codes you can manage, update, and monitor. That is very different from a random generator that disappears after it prints your code. You can read our honest take on the category in our Lunyb review and compare it against alternatives in our Rebrandly review.

Lunyb vs. Doing Everything Manually

Protection Need	Manual Approach	With Lunyb
Check if a scanned URL is safe	Read the link, guess, Google the domain	Paste into Scam Checker, get a clear verdict
Block malicious domains after a bad scan	Hope your browser catches it	On-device DNS shield blocks known threats
Know if your data leaked after a scam	Wait for news reports or bank alerts	Automatic Data Breach Alerts for your email/phone
Handle follow-up scam calls	Pick up and judge on the spot	Scam Shield flags suspicious callers
Manage passwords across many accounts	Reuse one password (risky) or juggle notes	Encrypted Password Vault
Review risky app permissions	Dig through Settings manually	Privacy Check surfaces them in one place

What to Do If You Have Already Scanned a Suspicious QR Code

If something feels wrong after a scan, act quickly. Speed matters more than perfection.

Close the page immediately. Do not enter any credentials, even to "test" it.
Disconnect from Wi-Fi or mobile data for a moment if you tapped a download link.
Run a check in Lunyb. Use the Scam Checker on the URL and Privacy Check on any newly installed app.
Change passwords for anything you may have typed — especially Singpass, internet banking, and email. Use the Lunyb Password Vault to generate strong, unique ones.
Call your bank directly using the number on the back of your card if you entered any banking info. For DBS, OCBC, UOB, Standard Chartered, Citibank, Maybank, and HSBC, there are 24/7 hotlines.
Report the scam. File a report with the Singapore Police Force via the ScamShield helpline (1799) or police.gov.sg/iwitness, and forward phishing to phishing@csa.gov.sg.
Turn on Data Breach Alerts so you know if your details surface on leaked lists in the following weeks.

Habits That Keep You Safe Long-Term

QR scams will keep evolving. The habits below, paired with Lunyb running quietly on your phone, keep you ahead.

Prefer typing over scanning for high-risk destinations like banking, Singpass, and IRAS.
Never scan QR codes in unsolicited emails or letters, even if they look official.
Verify through a second channel. If a "bank" sends a QR, call the bank using the number on your card.
Keep your phone's OS and apps updated. Patches close the exact bugs scam pages try to exploit.
Use biometric lock on banking apps and enable transaction notifications.
Teach older family members. Share the Lunyb app with parents and grandparents — the Scam Checker is simple enough for anyone.

Try Lunyb Today

You cannot avoid QR codes in Singapore — they are baked into how we pay, park, order, and sign in. What you can do is stop relying on luck every time you scan one. Lunyb gives you a Scam Checker that verifies suspicious links in seconds, Scam Shield for the follow-up calls, on-device threat blocking, Data Breach Alerts, and an encrypted vault for your passwords and sensitive photos — all in one app.

Head to lunyb.com to take the free privacy quiz and see where your biggest risks are, or download Lunyb from the App Store or Google Play and get set up in a few minutes. If you also want branded, trackable QR codes you control for your own business or event, our link and QR platform is built on the same privacy-first foundation — see our Lunyb honest review for the details.

Frequently Asked Questions

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force and CSA have repeatedly warned about quishing and QR-based payment fraud across hawker centres, parking areas, and phishing emails. Because QR codes hide the destination URL, they are a favourite tool for scammers targeting Singapore residents.

Can scanning a QR code hack my phone instantly?

Scanning alone usually just opens a link. The real risks come after: tapping the link, entering credentials, or installing an app from the page. Lunyb's Scam Checker and on-device threat blocking help stop the dangerous next step, not just the scan.

How can I tell if a PayNow or SGQR code at a hawker stall is real?

Look for signs of a sticker placed over another code, check that the merchant name shown after scanning matches the stall, and confirm the amount before confirming payment. If anything feels off, pay in cash or at a different stall and report the suspicious code to the operator.

What should I do if I entered my Singpass or bank details after scanning a bad QR?

Act within minutes. Call your bank's 24/7 hotline, change your Singpass and banking passwords, enable transaction alerts, and report the incident via ScamShield (1799) and the SPF. Turn on Lunyb's Data Breach Alerts to monitor whether your details appear on leaked lists afterwards.

Does Lunyb work in Singapore and support local banks and services?

Yes. Lunyb's Scam Checker, Scam Shield, Data Breach Alerts, Privacy Check, and encrypted Password & Photo Vault work for users in Singapore. Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online at lunyb.com.