QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stalls, PayNow receipts, condo noticeboards, parking meters, event posters, even takeaway bags. That convenience is exactly why scammers have moved in. At Lunyb, we built our Scam Checker, link tools, and on-device protections for moments like this: when a quick scan could cost you your bank balance, your SingPass, or your identity.

This guide explains how QR code scams (also called quishing) work in Singapore in 2026, the red flags to look for before you tap, and the exact steps to take if you have already scanned something suspicious. We will also show where Lunyb fits as the easiest way to stay ahead of these scams without becoming paranoid about every poster you see.

Why QR code scams are surging in Singapore

A QR code scam is a fraud where a criminal tricks you into scanning a malicious code that opens a fake website, downloads a dodgy app, or triggers a payment to the wrong account. Because Singapore adopted QR payments (PayNow, SGQR, NETS QR) faster than almost anywhere in the region, attackers know the average person here scans codes without a second thought.

The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) have repeatedly warned the public about quishing in advisories across 2024 and 2025 — covering fake F&B survey stickers, counterfeit parking.sg notices, and fraudulent charity drives. The pattern is always the same: a trusted-looking QR code that routes you somewhere it should not.

The three ingredients every quishing scam needs

A believable context. A hawker table, a bubble tea cup sticker, a parking warden's notice, a SingPost-style delivery card.
A short, unreadable URL. QR codes hide the destination, so even a careful person cannot tell a safe link from a hostile one at a glance.
A time pressure. "Claim your free drink in 10 minutes", "Pay your fine before midnight", "Verify your parcel today or it will be returned."

The most common QR code scams in Singapore right now

Scams evolve fast, but the playbook is consistent. Here are the variations our team is seeing reported most often in Singapore in 2026.

1. Fake hawker and F&B survey stickers

Scammers stick a "Scan for free bubble tea / lucky draw / feedback reward" sticker on a table at a coffee shop or hawker centre. The code opens a fake Google Form or a copycat site that asks for your name, NRIC, phone, and bank or card details. In some reported cases, the victim is then asked to download a third-party APK to "complete" the reward — which is actually malware that reads SMS OTPs.

2. Counterfeit parking and summons notices

A fake "parking fine" slip is slipped under a windscreen wiper. The QR code claims to go to parking.sg or LTA, but routes to a lookalike domain that captures SingPass logins or card payments. Real government fines in Singapore are not paid via a QR on a paper slip left on your car.

3. Lookalike PayNow / SGQR stickers at stalls

A criminal pastes their own QR sticker over a stall's genuine PayNow code. You scan, pay what you think is the stallholder, and the money lands in the scammer's account. The stall only realises at closing time.

4. Phishing via WhatsApp and Telegram

You receive a QR code image in a group chat — "scan this to join the condo residents' chat", "scan to RSVP for the D&D", "scan to claim CDC vouchers". The code leads to a credential-harvesting page or a fake login for Singpass, banks, or CDC voucher portals.

5. Delivery and SingPost impersonation

A card is left at your door saying a parcel could not be delivered — scan to reschedule. The QR opens a fake courier page asking for a small "redelivery fee" with your card details, or pushes an app install.

6. Charity and donation drives

During festive periods (Hari Raya, Deepavali, Christmas, Chinese New Year), scammers pose as volunteers with donation tins and QR codes. Real registered charities in Singapore are listed on the Charity Portal — a legitimate volunteer will not pressure you to scan on the spot.

How to spot a dangerous QR code before you scan

Quishing works because QR codes bypass the one safety habit most people already have: looking at a URL before clicking it. These are the checks we recommend making a habit.

Look at the physical sticker. Is it pasted over another sticker? Is the printing quality different from the surrounding menu or signage? Are the edges peeling? These are the strongest signals of a swapped QR.
Preview the URL, do not auto-open. Both iOS Camera and Google Lens show the link before launching. Read it. If it does not match the brand (for example, a "parking fine" link that is not on gov.sg), stop.
Check the domain carefully. Scammers use lookalikes: singpass-verify.co, paynow-sg.app, lta-fines.net. Real Singapore government services end in .gov.sg.
Be suspicious of any QR that asks for SingPass, NRIC, OTP, or full card details. Legitimate payment QRs do not ask you to log into SingPass.
Never install an APK from a QR code. Real apps come from the App Store or Google Play, not from a scan at a stall.
Confirm with the merchant. At a stall, ask the owner to point to their real PayNow code or show the amount on their own device.

How Lunyb protects you from QR code scams in Singapore

Manual checks work — if you remember to do them every time. The reality is you will scan dozens of codes a month, often while queuing, driving, or multitasking. That is where Lunyb's tools do the heavy lifting so you do not have to be on high alert at every hawker centre.

Scam Checker: paste the link, get a verdict

If a QR opens a URL and something feels off, you can paste it into Lunyb's Scam Checker before entering any details. It analyses the link for known scam patterns, suspicious domains, and the hallmarks of phishing pages — so you get a clear "this looks risky" signal instead of guessing. Same flow for suspicious SMS, WhatsApp, and Telegram messages that include a QR image or shortened link.

Scam Shield and on-device threat blocking

Lunyb's Scam Shield helps with scam calls and messages that typically come after a quishing attempt ("Hi, this is DBS fraud team, we saw an unusual transaction..."). Our on-device local DNS shield blocks connections to known malicious domains at the network level, so even if you accidentally tap a bad QR, many phishing pages simply will not load on your phone.

Privacy Check and Data Breach Alerts

Many QR scams are the first step in a longer attack. Once your email or phone is captured, it gets resold. Lunyb's Data Breach Alerts watch your email and phone number so you know the moment they surface in a leak, and Privacy Check reviews which apps on your phone have permissions they do not need — a common weak point after malicious APK installs.

Encrypted Password and Photo Vault

If you already reuse passwords, one quishing page can unlock several accounts. Our encrypted Password Vault lets you store unique logins for SingPass, banks, email, and shopping accounts so a single phished credential does not cascade. The Photo Vault keeps sensitive images (IC photo, driving licence, insurance docs) off your camera roll, where many info-stealers look first.

Trust the QR codes you create, too

Lunyb is also a secure URL shortener and QR platform. If you run a stall, event, or small business in Singapore, generating your QR codes through Lunyb means you control the destination and can update it if anything changes — much safer than printing a raw bank link onto stickers that anyone could cover up. If you are weighing shortener options, our Rebrandly vs Lunyb comparison and our honest review of Lunyb walk through exactly what you get.

What to do if you have already scanned a scam QR code

If you suspect you have been quished, speed matters. Work through this checklist in order.

Do not enter anything else. Close the tab or app immediately.
If you entered bank or card details: call your bank's 24/7 fraud hotline now and freeze the card. All major Singapore banks (DBS, OCBC, UOB, Standard Chartered, Citibank, HSBC, Maybank) have a dedicated fraud line.
If you entered your SingPass: reset it immediately at singpass.gov.sg and enable the latest 2FA options.
If you installed an APK or profile: uninstall it, reboot, and run Lunyb's Privacy Check to spot anything with elevated permissions. For heavy infections, a factory reset is the safest option.
Report the scam. File a report with the Singapore Police Force at police.gov.sg/iwitness, and call the ScamShield Helpline at 1799. Forward phishing SMS to 7726 (SPAM).
Monitor your email and phone. Turn on Lunyb's Data Breach Alerts so you are notified the moment your details appear in a dump or resold list.
Change reused passwords. Start with your email account — if attackers have that, they can reset everything else.

Quick comparison: manual checks vs Lunyb

Protection	Manual only	With Lunyb
Check a QR's destination link	Preview in camera, read URL carefully every time	Paste into Scam Checker for a clear verdict
Block malicious domains	Hope the browser warns you	On-device DNS shield blocks known bad domains
Know if your email or phone leaked	Check breach sites manually, occasionally	Continuous Data Breach Alerts
Control app permissions	Dig through iOS and Android settings	Privacy Check surfaces risky permissions
Stop credential reuse damage	Remember unique passwords yourself	Encrypted Password Vault
Generate your own safe QR codes	Use random free generators	Lunyb secure QR platform with updatable links

Smart habits for QR safety in Singapore

Technology helps, but a few habits make quishing almost impossible to pull off on you.

Default to typing, not scanning, for payments you make often. For regular hawker stalls, save their PayNow number in your banking app.
Treat unsolicited QR codes like unsolicited links. If you did not ask for it and it arrived via SMS, WhatsApp, Telegram, email, or a sticker on a lamp post, assume it is suspicious until proven otherwise.
Use the official apps. For LTA fines, use the LTA app. For parking, use parking.sg. For CDC vouchers, go to go.gov.sg/vouchers directly in your browser.
Enable 2FA everywhere. SingPass, banks, email, Shopee, Lazada, Carousell — all of them.
Talk to family members, especially parents. Quishing scams target older residents hard. Share Lunyb's family location sharing and help them install Scam Checker on their phone.

Protect yourself with Lunyb today

You cannot avoid QR codes in Singapore — nor should you have to. The goal is simple: scan with confidence, know when something is off, and have a safety net the one time you miss a red flag. That is exactly what Lunyb is built for.

Head to lunyb.com to take our free privacy quiz and see where you are exposed, or download the Lunyb app from the App Store or Google Play to turn on Scam Checker, Scam Shield, Data Breach Alerts, and the on-device threat shield. Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online — no games, no lock-in.

Scan smart. Pay safe. Let Lunyb watch your back.

Frequently asked questions

Are QR code payments like PayNow and SGQR safe in Singapore?

Yes — the underlying PayNow and SGQR systems are safe and regulated. The risk is social: scammers paste their own QR stickers over real ones, or trick you into scanning codes that are not payment codes at all. Always confirm the recipient name and amount on your banking app before pressing send.

Can scanning a QR code install malware on my phone?

Just scanning a QR code does not install anything by itself. The danger is what comes next: the code opens a webpage that either phishes your details or asks you to install an app or profile outside the App Store or Google Play. Never install APK files or configuration profiles from a QR code.

What should I do if I paid the wrong person after scanning a fake PayNow QR?

Call your bank's fraud hotline immediately — the sooner you report it, the better the chance of recovering funds. File a report with the Singapore Police Force at police.gov.sg/iwitness and call the ScamShield Helpline at 1799. Keep screenshots of the QR, the payment, and any messages.

How does Lunyb actually help with QR code scams?

Lunyb's Scam Checker lets you verify suspicious links before entering any details, the on-device DNS shield blocks connections to known malicious domains, Data Breach Alerts tell you if your email or phone has leaked, and the Password Vault stops one phished login from compromising every account. It is a layered safety net, not a single magic button.

Is Lunyb worth it if I am already careful online?

Careful people still get caught — because quishing attacks target moments of distraction, not intelligence. Lunyb exists to cover those moments. You can see what you get and how we compare in our honest Lunyb review, and start with the free privacy quiz at lunyb.com.