QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker centre tables, bubble tea menus, MRT posters, parking meters, bank letters, and delivery slips. They are fast, convenient, and now one of the easiest ways for scammers to reach into your phone. If you want a simple, modern defence, Lunyb gives you a built-in Scam Checker, link previews, and on-device threat blocking so a bad QR code does not turn into a drained bank account.

This guide explains how QR code scams (also called “quishing”) work in Singapore in 2026, the red flags to watch for, and the exact steps to take before you tap Open. We will also show where Lunyb fits in, so you stop relying on luck every time you point your camera at a square.

What Are QR Code Scams?

A QR code scam is any attack that uses a QR code to send a victim to a malicious website, trigger a fake payment, install a harmful app, or harvest login details. Because a QR code hides the destination until you scan it, criminals use the code as a disguise for a link you would never click if you saw it written out.

The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) have repeatedly warned the public about QR code and phishing-based scams, especially those that impersonate banks, government agencies, delivery companies, and local F&B brands. The playbook is simple: get the QR code in front of you, create urgency, and push you to act before you think.

Why QR Code Scams Work So Well in Singapore

• QR payments are normal here. PayNow, SGQR, and app-based payments trained everyone to scan without hesitation.
• Codes look official. A printed sticker on a parking meter or a letter with a bank logo feels trustworthy.
• Phones auto-open links. Many camera apps launch the URL instantly, giving you no time to inspect it.
• Mobile screens hide the full URL. A long domain like dbs-secure-login.verify-sg.co looks almost right on a small screen.

The Most Common QR Code Scams in Singapore Right Now

Scams evolve quickly, but the patterns in 2026 keep repeating. Here are the ones Singapore residents are most likely to run into.

1. Fake Hawker and F&B Payment Codes

Scammers paste a sticker with their own QR code over the stall’s real PayNow code. You scan, pay, and the money goes to the fraudster instead of the stall owner. Sometimes the fake code leads to a cloned bank login page that steals your credentials in addition to the payment.

2. Parking and Transport QR Scams

Fraudulent stickers on parking meters, EV chargers, and even bicycle racks direct drivers to fake “pay here” pages. These pages mimic the real parking apps and request card details or OTPs.

3. Delivery “Missed Parcel” QR Notes

A slip is left at your door claiming a failed delivery, with a QR code to “reschedule.” The link opens a fake courier page asking for a small redelivery fee — and your full card information.

4. Bank and Government Letter Impersonation

Victims receive printed letters that look like they come from DBS, OCBC, UOB, IRAS, or CPF, with a QR code to “verify your account” or “claim a rebate.” The destination is a phishing site that collects Singpass or banking logins.

5. Quishing Emails and WhatsApp Messages

Instead of a clickable link, the message contains an image with a QR code. This bypasses many email security filters because the URL is embedded in the image, not in the text. You open it on your phone, scan, and you’re on a phishing page.

6. Fake Lucky Draws and Vouchers

Posters at bus stops or shopping centres offer “scan to win” prizes from well-known brands. The code leads to a survey that requests personal data, bank details, or an app download that is actually malware.

7. Malicious App Installs via QR

Some QR codes trigger downloads of sideloaded Android APKs that impersonate banking or government apps. Once installed, they can read SMS OTPs, capture keystrokes, and take over accounts.

How to Spot a Malicious QR Code Before You Tap

Spotting a bad QR code is really about spotting the context around it. The code itself is just a square of pixels — the warning signs live in the sticker, the sender, and the destination URL.

1. Check for a sticker over a sticker. At hawker stalls and shops, look closely. A QR code pasted on top of another one is the single biggest red flag.
2. Confirm with the merchant. If you’re paying, glance at the stall owner’s own device or ask them to confirm the payee name before you send.
3. Read the preview URL. Most modern phones show the link before opening. Look for misspellings, extra words, or unusual domains (.xyz, .top, random country codes).
4. Beware of urgency. “Verify in 24 hours or your account will be locked” is a scam pattern, not a bank policy.
5. Never enter Singpass, OTPs, or card details after scanning a public QR. Legitimate payment flows do not need your full banking login.
6. Don’t install apps from QR codes. Only install from the App Store or Google Play, searched manually.
7. If in doubt, scan the link with a scam checker. This is where Lunyb does the heavy lifting.

How Lunyb Protects You From QR Code Scams

Manual checking helps, but nobody wants to squint at a URL every time they order kaya toast. Lunyb is designed exactly for this: a phone-first privacy and scam-protection app that catches the stuff you would otherwise miss.

Scam Checker for Links and Messages

Paste any suspicious URL — including the one revealed after scanning a QR — into Lunyb’s Scam Checker. It analyses the link and the surrounding message for known scam patterns, impersonation signals, and risky redirects. If a “DBS verification” page is actually hosted on a throwaway domain registered last week, you will know before you type a single character.

On-Device Threat Blocking

Lunyb includes a local DNS shield that blocks connections to known malicious domains and trackers at the network level, on your device. If you accidentally open a phishing link from a QR code, there is a strong chance Lunyb stops the page from loading in the first place.

Data Breach Alerts

If a QR scam ever does catch you — or if your email and phone number leak from somewhere else — Lunyb’s Data Breach Alerts monitor your email and phone across known breach datasets so you can change passwords and lock down accounts quickly.

Encrypted Password and Photo Vault

Reused passwords are what turn a single phishing hit into a full-blown account takeover. Lunyb’s encrypted Password Vault lets you store strong, unique passwords, and the Photo Vault keeps sensitive images (like NRIC or bank statements) off your main camera roll.

Privacy Check and Security Score

Lunyb reviews which apps have access to your contacts, SMS, location, and camera, and gives you a clear Security Score. If a shady app sneaked in via a QR code install last year, this is how you find and remove it.

Scam Shield and Caller Protection

Many QR scams are followed up by a phone call from a “bank officer” or “police officer.” Lunyb’s Scam Shield helps identify and warn you about suspicious callers so the second half of the scam doesn’t land either.

Lunyb vs Doing It All Manually

You can fight QR scams with free tools and good habits. But here is what that actually looks like compared to using Lunyb.

Lunyb plans start from about S$-equivalent US$19.99/month and renew until cancelled. You can cancel anytime online, and optional Leak Protection is billed separately and can be paused without cancelling your main plan. No lock-in, no games.

What to Do If You Already Scanned a Scam QR Code

If you suspect you’ve just fallen for a quishing attack in Singapore, act fast. The first hour matters most.

1. Disconnect. Turn off Wi-Fi and mobile data on the device to stop any ongoing data transfer.
2. Call your bank immediately. Use the official hotline on the back of your card. Freeze cards and dispute any unauthorised transactions.
3. Report to the authorities. Use the ScamShield helpline (1799) and file a police report via the SPF e-services if money or credentials were lost.
4. Change key passwords. Start with banking, Singpass, email, and any account that shares a password with the compromised one.
5. Enable 2FA everywhere. Use an authenticator app rather than SMS where possible.
6. Run a Lunyb Privacy Check. Review app permissions, scan for suspicious apps installed around the time of the incident, and check your Security Score.
7. Turn on Data Breach Alerts. So you know the moment your details appear in a new breach dump.
8. Warn others. If the scam was tied to a specific location (a stall, a parking lot, a building), tell the operator so they can remove the fake sticker.

Safer Habits for Scanning QR Codes in Singapore

Scams won’t stop, but your exposure can drop dramatically with a few habits:

• Prefer scanning from inside your bank or payment app rather than from the generic camera.
• Always confirm the payee name on the payment screen before you confirm the amount.
• Don’t scan QR codes from unsolicited emails, SMS, or WhatsApp — type the URL manually instead.
• Treat physical QR codes in public with the same suspicion as unknown USB sticks.
• Keep iOS and Android fully updated. Many quishing attacks rely on outdated browsers.
• Use a tool like Lunyb so your default is “checked,” not “hoped for the best.”

For Businesses: Protect Your Customers and Your Brand

If you run a cafe, retail shop, or any business that uses QR codes in Singapore, you’re also a target — scammers hijack your trust to attack your customers.

• Laminate or seal payment QR codes so stickers can’t be placed over them cleanly.
• Check your codes daily. A quick scan from a staff phone confirms they still point to your account.
• Use branded, trackable links for marketing campaigns so customers can confirm the destination. Lunyb’s link shortener and secure QR platform lets you generate QR codes with clean, consistent URLs you control, so customers learn to recognise and trust your links.
• Educate staff to look out for “sticker on sticker” tampering.

If you’re weighing options for your branded links and QR codes, our comparison Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)? and Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026) are good next reads.

Start Protecting Yourself Today

QR code scams in Singapore aren’t going away in 2026 — they’re getting more polished. The good news is that you don’t need to become a cyber-security expert. You just need the right tool in your pocket.

Head to lunyb.com, take the free privacy quiz to see where you’re most exposed, and download the Lunyb app from the App Store or Google Play. In a few minutes you’ll have a Scam Checker, on-device threat blocking, breach alerts, and an encrypted vault working for you every time you pick up your phone — whether you’re paying for chicken rice or verifying a bank letter.

Frequently Asked Questions

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force and CSA have repeatedly warned the public about phishing and QR-based scams targeting bank customers, parking users, and delivery recipients. Because QR payments are part of daily life here, scammers see Singapore as a high-value target.

Can a QR code install a virus just by being scanned?

Scanning alone usually only opens a URL. The danger comes from what happens next: a phishing page that captures your login, a sideloaded APK you’re tricked into installing, or a payment page that redirects your money. Lunyb’s Scam Checker and on-device threat blocking are designed to catch these next-step attacks.

Is it safe to scan QR codes at hawker centres and restaurants?Generally yes, but check for stickers placed over the original code, and always confirm the payee name on your payment app before confirming. If anything looks tampered with, pay cash or use a different method.

How does Lunyb help if I’ve already been scammed?

Lunyb helps you contain the damage: Data Breach Alerts tell you when your credentials show up in known leaks, the Password Vault helps you reset to strong unique passwords, Privacy Check highlights risky app permissions, and Scam Shield warns about follow-up scam callers.

How much does Lunyb cost and can I cancel?

Lunyb plans start from about US$19.99/month and renew until you cancel. You can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan.