QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stalls, bus stops, parking meters, restaurant tables, and even utility bills. That convenience has a cost. Scammers now print fake QR stickers, send fake PayNow requests, and hide malicious links inside what looks like a harmless square. At Lunyb, we built our Scam Checker, link scanner, and on-device protections precisely because this threat has moved from rare to routine. If you want a straight answer on how to stay safe from QR code scams in Singapore in 2026, this guide gives you the tactics — and shows you the easiest way to automate the hard parts.

Why QR Code Scams Are Exploding in Singapore

A QR code scam — often called quishing (QR + phishing) — is any scam that uses a QR code to send a victim to a fraudulent website, trigger a fake payment, or install a malicious app. Because QR codes look identical to the human eye, scammers can hide almost anything behind them.

Singapore is a particularly attractive target because digital payments like PayNow, SGQR, and NETS QR are part of daily life. The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) have repeatedly warned the public about QR-based scams, from fake parking fines to bubble tea "surveys" that drain bank accounts. The pattern is always the same: a real-looking sticker, a convincing landing page, and a request that feels urgent.

The Core QR Scam Playbook

1. A scammer prints a sticker with their own QR code.
2. They place it over a legitimate code — on a payment terminal, menu, EV charger, or poster.
3. The victim scans, lands on a spoofed site, and is asked to log in, pay, or install an app.
4. Credentials or OTPs are harvested, and money moves out in minutes.

The defense is not to stop using QR codes — that is impractical in Singapore. The defense is to scan with suspicion and use tools that check the destination before you tap.

The Most Common QR Code Scams in Singapore Right Now

These are the scenarios Singaporean consumers, workers, and small business owners are most likely to encounter in 2026. Recognizing the shape of each one is the first line of defense.

1. Fake F&B Survey Stickers

You finish a meal at a cafe or bubble tea shop. On the table, there is a cheerful sticker: "Scan to review and get a free drink." The code leads to a page that asks you to download an app or enter banking details. In several cases publicized by local media, victims lost five-figure sums after malware gained remote access to their phones.

2. Fake PayNow / SGQR Overlays

Scammers print a sticker with their own PayNow QR and paste it over a hawker stall's real code. You pay — the money goes to the scammer, not the stall. Sometimes the stall only realizes at the end of the day.

3. Parking and Traffic "Fines"

A flyer under your windscreen or a sticker on a parking meter claims you have an unpaid fine and shows a QR code to pay. The page mimics HDB, URA, or LTA branding. Real agencies in Singapore do not demand payment this way.

4. EV Charger and Vending Machine Tampering

As Singapore expands EV infrastructure, scammers have begun targeting charging stations with overlay QR codes that lead to fake "activation" sites asking for card details.

5. Delivery Redelivery Scams

A "missed delivery" card arrives claiming to be from SingPost or a courier. Scan the QR to "reschedule" — and you land on a credential-harvesting page or are asked to pay a small "redelivery fee" that unlocks a much larger unauthorized charge later.

6. Phishing Emails With QR Codes

Corporate email filters scan links, but they often ignore images. Attackers now embed QR codes in emails that look like they come from DBS, Singpass, or your HR department. You scan with your phone — bypassing your company's protections entirely.

How to Spot a Malicious QR Code Before You Tap

You cannot see what is inside a QR code with your eyes. But you can learn the warning signs around it, and you can check the link after scanning but before entering any data.

Physical Warning Signs

• Stickers over stickers. If you can see an edge or a bubble under the QR code, assume it is an overlay.
• Unusual placement. Loose flyers under windscreens, random posters near ATMs, or stickers on lampposts offering "grants" or "rebates."
• Urgency language. "Pay within 24 hours," "account suspended," "claim before midnight."
• Blurry or low-quality printing next to otherwise professional signage.

Digital Warning Signs After Scanning

• The preview URL uses a strange top-level domain (.xyz, .top, .click) or a shortener you do not recognize.
• The domain is almost right: dbs-sg.com, singpass-login.net, paynow-verify.co.
• The page immediately asks for Singpass credentials, OTPs, or banking logins.
• You are prompted to install an APK file or sideload an app outside the App Store or Google Play.
• The site asks for "accessibility permissions" — a classic Android malware red flag.

How Lunyb Protects You From QR Code Scams

Manual checks work when you are calm, unhurried, and skeptical. Real life is not like that — you are hungry, you are late for a meeting, you just want to pay for parking. This is exactly where Lunyb earns its place on your phone. We built Lunyb to catch what tired humans miss.

Scam Checker for Links and Messages

Paste any URL — including the one revealed by a QR scan — into Lunyb's Scam Checker. It analyses the link, flags lookalike domains, newly registered sites, and known phishing patterns, and tells you in plain English whether it is safe to continue. If a friend forwards you a suspicious SMS, WhatsApp message, or Telegram link, you can check it the same way before tapping.

On-Device Threat and Tracker Blocking

Lunyb includes an on-device, network-level shield that blocks known malicious domains at the DNS layer. If you do scan a bad QR code and your browser tries to load a known scam destination, the connection can be stopped before the page renders. This runs locally on your device — not a "virtual private network" product — and keeps protection on even as you move between Wi-Fi and mobile data.

Data Breach Alerts for Email and Phone

Many QR scams end with your credentials for sale on criminal forums. Lunyb's Data Breach Alerts monitor your email address and phone number and tell you when they appear in a known leak, so you can change passwords and lock down accounts before criminals move.

Privacy Check and Security Score

Scammers love over-permissioned phones. Lunyb's Privacy Check reviews which apps have access to your location, contacts, camera, and microphone, and helps you cut what you do not need. Your Security Score gives you a single number to improve over time — small habit changes that make the next scam attempt much less likely to succeed.

Encrypted Password and Photo Vault

If you have been reusing passwords across DBS, Shopee, Lazada, and Singpass-linked services, one phished login opens the door to everything. Lunyb's encrypted Password Vault lets you store strong, unique passwords, and the Photo Vault keeps sensitive images (IC scans, bank letters) off your camera roll.

Safer Links and QR Codes You Create

If you are a small business, event organizer, or freelancer in Singapore, you also produce QR codes — for menus, payments, and promotions. Lunyb's URL shortener and QR platform lets you generate clean, trackable links and QR codes on a reputable domain, so your customers are less likely to mistake you for a scam. If you have been comparing shorteners, you may find our Rebrandly vs Lunyb breakdown and our honest Lunyb review useful.

Lunyb vs Doing It All Manually

You can fight QR scams with free habits alone. Most people, honestly, will not keep it up for long. Here is what you get when Lunyb does the work for you.

Protection	Manual Approach	With Lunyb
Checking QR destination URLs	Read every link carefully, every time	Paste into Scam Checker — instant verdict
Blocking known scam domains	Hope your browser catches it	On-device DNS shield blocks at network level
Spotting leaked credentials	Manually check breach sites every month	Automatic Data Breach Alerts for email and phone
Password reuse	Remember dozens of unique passwords	Encrypted Password Vault
App permission hygiene	Audit every app in Settings	Privacy Check with one-tap guidance
Creating trustworthy QR codes	Generic generators with unknown domains	Lunyb's branded shortener + QR platform

What to Do If You Already Scanned a Scam QR Code

If you suspect you scanned a malicious QR code, move fast. The first hour matters most.

1. Disconnect. Turn on airplane mode to stop any active session or malware communication.
2. Do not enter anything else. Close the browser tab and any app that opened as a result.
3. Change critical passwords from a separate, trusted device — banking, Singpass-linked email, and any account that shares that password.
4. Call your bank immediately if you entered card or banking details. DBS, OCBC, UOB, and other local banks have 24/7 anti-scam lines.
5. Report to ScamShield and call the Anti-Scam Helpline at 1799. File a police report at the nearest neighborhood police centre or online.
6. Check for malicious apps. Uninstall anything you sideloaded. If in doubt, factor reset your phone after backing up photos.
7. Run Lunyb's Privacy Check and Security Score to spot lingering exposure — leaked credentials, over-permissioned apps, or accounts that need stronger protection.

A Simple Daily Habit for Scanning Safely in Singapore

You do not need to become paranoid. You need a small, repeatable routine. Here is the one we recommend to Lunyb users in Singapore:

1. Look before you scan. Inspect the physical sticker for overlays, tampering, or odd placement.
2. Preview the URL that your camera or scanner app shows. Do not tap through immediately.
3. If anything feels off, paste into Lunyb's Scam Checker. Three seconds, no guesswork.
4. Never enter Singpass, banking, or OTP details on a page reached from a QR code unless you typed the domain yourself.
5. Pay through your bank app directly for anything larger than a hawker meal.

Try Lunyb Today

QR code scams in Singapore are not going away in 2026 — they are getting better looking and harder to spot. You deserve a tool that catches the link before it catches you. Lunyb combines Scam Checker, Data Breach Alerts, on-device threat blocking, Privacy Check, an encrypted vault, and a trustworthy QR and link platform in one app.

Plans start from about S$19.99 / month equivalent (billed in USD), with cancel-anytime terms and clear pricing — no surprises. Start with the free privacy quiz at lunyb.com, or download the Lunyb app on the App Store or Google Play and run your first Scam Check in under a minute.

FAQ: QR Code Scams in Singapore

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force and the Cyber Security Agency of Singapore have issued repeated advisories about QR-based scams, from fake F&B surveys to overlay PayNow stickers. Because QR payments are mainstream here, the attack surface is unusually large compared to many other markets.

Can I tell if a QR code is safe just by looking at it?

No — the pattern itself tells you nothing. What you can check is the surrounding sticker (is it an overlay?), the preview URL after scanning, and the destination domain. Lunyb's Scam Checker makes that last step almost instant.

Is it safer to use my phone's built-in camera or a third-party QR app?

Your phone's built-in camera is generally safer than random QR apps from the store, which can be ad-heavy or malicious themselves. Whichever you use, always preview the URL before tapping, and run suspicious links through Lunyb before entering any personal data.

What should I do if I paid the wrong PayNow QR?

Call your bank's 24/7 anti-scam line immediately to try to recall the transfer, report to ScamShield and the Anti-Scam Helpline on 1799, and file a police report. Speed matters — funds are often moved within minutes.

Does Lunyb replace ScamShield?

No — they complement each other. ScamShield focuses on blocking scam calls and SMS at the local level. Lunyb adds link and QR destination checks, data breach monitoring, on-device threat blocking, app permission reviews, and encrypted storage for passwords and sensitive photos. Running both gives you broader coverage.