QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stalls, parking meters, taxi receipts, MRT posters, and PayNow decals at your neighbourhood kopitiam. That same convenience is exactly why scammers love them. A sticker costs cents to print, and one tap on a malicious code can drain a bank account, install spyware, or steal your Singpass login.

At Lunyb, we built our Scam Checker and on-device threat protection specifically for moments like these — the split second between scanning a QR and tapping "continue." This guide walks you through how QR code scams work in Singapore in 2026, the red flags to watch for, and how Lunyb gives you a safety net that manual checks alone can't match.

What Are QR Code Scams (Quishing)?

QR code scams, often called quishing (QR + phishing), are attacks where a criminal hides a malicious link inside a QR code. When you scan it, your phone opens a fake website, a spoofed payment page, or a page that silently downloads malware.

Because humans cannot read a QR code visually, you are trusting whatever the code claims to be. A sticker that says "Scan to pay for parking" could point anywhere. In Singapore, the Singapore Police Force and the Cyber Security Agency (CSA) have repeatedly warned the public about quishing campaigns targeting PayNow users, food delivery customers, and even grocery shoppers.

Why Singapore Is a Prime Target

• QR-first payments. SGQR, PayNow, and PayLah! make QR scanning a daily reflex.
• High smartphone penetration. Nearly every adult uses mobile banking, which raises the payoff for attackers.
• Dense physical touchpoints. Hawker centres, carparks, and MRT stations give scammers hundreds of places to slap on a fake sticker.
• Trust in official-looking design. Scammers mimic Singpass, IRAS, LTA, and bank branding convincingly.

The Most Common QR Code Scams in Singapore Right Now

Based on alerts tracked by the Singapore Police Force, ScamShield, and CSA advisories, these are the quishing patterns Singaporeans are seeing in 2026.

1. Fake Hawker and F&B Survey Stickers

A sticker on the table offers a free drink or bubble tea voucher if you "scan and complete a short survey." The form asks for your name, NRIC, bank login, and a credit card for "verification." This is the scam that made headlines when victims lost five- and six-figure sums from their bank accounts.

2. Overlaid Parking and EV Charging QR Codes

Scammers print their own QR sticker and paste it over the legitimate one on parking meters or EV chargers. You "pay" into a wallet you don't control, and the attacker captures your card details for later use.

3. Spoofed PayNow and SGQR Decals

Small merchants sometimes display printed PayNow QR codes near the till. A scammer swaps the decal with one tied to their own account. You pay, the merchant never receives the money, and by the time anyone notices, the attacker has withdrawn everything.

4. "Delivery Failed" and Package Pickup QRs

A notice stuck on your door or lift lobby claims a parcel couldn't be delivered. Scan the QR to "rearrange delivery." The link leads to a cloned SingPost, Ninja Van, or J&T page asking for payment of a small redelivery fee — and harvesting your card.

5. Fake Singpass or Government QR Codes

Phishing emails or SMS pretend to be from IRAS, MOM, or Singpass, with a QR code to "verify your identity." The code opens a near-perfect clone of the Singpass login. Credentials go straight to the attacker, who then applies for loans or hijacks CPF-linked services.

6. Dating App and Investment Quishing

In romance and investment scams, the "friend" or "mentor" sends a QR code to join a trading group or deposit funds. The QR leads to a fake exchange that shows fake profits until you try to withdraw.

How to Spot a Malicious QR Code

You can't read a QR with your eyes, but you can read the context around it and the URL it reveals. Here is a quick checklist to run through every single time.

1. Check the physical sticker. Is it pasted over another sticker? Peeling at the edges? Printed on cheap paper when the rest of the shop is branded? Walk away.
2. Preview the URL before tapping. Most iPhone and Android cameras show the destination link above the "Open" button. Read it carefully.
3. Look at the domain, not the words. singpass-verify.com is not Singpass. The real domain ends in .gov.sg or the official brand's root domain.
4. Watch for URL shorteners with no context. A bit.ly or tinyurl behind a "government" or "bank" QR is a huge red flag. Legitimate Singapore agencies use .gov.sg.
5. Never enter NRIC, Singpass, OTP, or banking credentials on a page you reached via a scanned QR. Open the official app directly instead.
6. Confirm with the merchant. At a hawker stall, ask the uncle or auntie to confirm the PayNow handle before you send.
7. Be suspicious of urgency. "Pay within 10 minutes or face a fine" is social engineering.

How Lunyb Protects You From QR Code Scams

Manual checks work — until you are tired, rushing to catch the MRT, or the fake page looks indistinguishable from the real one. That's the gap Lunyb was built to close. Our app layers multiple defences around every link you touch, including the ones hidden inside QR codes.

Scam Checker: Paste the Link, Get an Instant Verdict

When your camera reveals the URL behind a QR code, long-press and copy it into Lunyb's Scam Checker before opening it. We analyse the domain, redirects, reputation history, and known phishing patterns and give you a clear verdict in seconds. If the link leads to a cloned Singpass page or a flagged wallet, you know before you tap.

On-Device Threat Blocking

Lunyb's local DNS shield runs on your phone and blocks connections to known malicious domains at the network level — including many of the phishing pages used in Singapore quishing campaigns. Even if you do tap through, there's a layer catching the known-bad destinations before your browser loads them.

Data Breach Alerts for Your Phone and Email

If you've been caught by a scam in the past (or a service you used was breached), your details may already be circulating. Lunyb's Data Breach Alerts monitor your email and Singapore mobile number and tell you the moment they appear in a new leak, so you can change passwords and lock accounts before scammers chain the data into a bigger attack.

Encrypted Password and Photo Vault

Reusing passwords is how one phishing win becomes ten. Our encrypted vault stores banking, Singpass, and SingPass-linked service credentials locally, so you can use long unique passwords without remembering any of them. The Photo Vault keeps sensitive images — NRIC scans, bank statements — out of your camera roll.

Privacy Check and Security Score

Our Privacy Check reviews which apps on your phone can read SMS, notifications, or your clipboard — the exact permissions scam apps abuse. The Security Score gives you one number to improve, with prioritised fixes.

Safer Links and QR Codes for Your Own Business

If you run a stall, a clinic, or a small business in Singapore, you also need to generate QR codes customers can trust. Lunyb's link shortener and secure QR platform let you create branded short links and QR codes you control, with analytics and the ability to update destinations if something changes. Compare the options in our Rebrandly review or read our honest breakdown of Lunyb as a URL shortener.

Lunyb vs. Doing It All Manually

What to Do If You've Already Scanned a Scam QR

Act in this order. Speed matters more than perfection.

1. Disconnect. Turn on airplane mode to stop any in-progress data transfer or background install.
2. Call your bank. DBS, OCBC, UOB, Standard Chartered, and the digital banks all have 24/7 fraud lines. Freeze cards and reverse pending PayNow transactions if possible.
3. Lock Singpass. Use the Singpass app's lockout feature or call the helpdesk if you entered credentials on a suspicious page.
4. Report to the authorities. File a report with the Singapore Police Force via the ScamShield app or at police.gov.sg, and call the anti-scam hotline 1799.
5. Change passwords. Start with email, then banking, then anything that shares the compromised password.
6. Run Lunyb's Privacy Check and Scam Shield. Review app permissions, scan recent messages, and enable on-device threat blocking so the same link can't catch you twice.
7. Watch for follow-up scams. Victims often get a second call from a fake "bank investigator" or "police officer" offering to recover the money. That is also a scam.

Habits That Keep You Safe Long-Term

Technology helps, but routine wins. Build these into your week.

• Default to the official app. For payments, Singpass logins, and parcel tracking, open the app directly instead of scanning.
• Treat every unsolicited QR as suspect. Flyers, stickers on tables, posters in lift lobbies — verify before you scan.
• Turn on transaction notifications for every bank card and wallet so you spot unauthorised charges within minutes.
• Keep iOS and Android updated. Patches close the exact vulnerabilities quishing malware exploits.
• Talk to family. Elderly parents and younger children are prime targets. Lunyb's family location sharing and shared scam checks make group safety easier.
• Run a monthly privacy review inside Lunyb. The Security Score tells you what to fix next.

Start Protecting Yourself Today

QR code scams in Singapore aren't slowing down — they're getting better designed, better localised, and harder to spot with the naked eye. You don't need to become a cybersecurity expert. You need a layered safety net that catches the links your eyes miss.

Head to lunyb.com and take our free privacy quiz to see where you stand in under two minutes. Then download the Lunyb app from the App Store or Google Play to turn on Scam Checker, on-device threat blocking, and Data Breach Alerts. Plans start at about $19.99/month, you can cancel anytime online, and you'll scan your next QR code with a lot more confidence.

Frequently Asked Questions

Are QR code scams common in Singapore?

Yes. The Singapore Police Force and Cyber Security Agency have issued repeated advisories about quishing targeting PayNow users, food and beverage customers, parcel recipients, and Singpass holders. The low cost of printing a sticker and the high use of QR-based payments make Singapore a particularly attractive target.

Can my iPhone or Android detect a scam QR code automatically?

Your camera shows the URL before opening it, which is a basic safeguard, but it doesn't tell you whether the domain is malicious. That's why a dedicated tool like Lunyb's Scam Checker matters — it analyses the link's reputation and redirect chain so you don't have to guess whether singpass-login.help is real.

Is it safe to scan QR codes at hawker centres and coffee shops?Usually yes, but confirm the PayNow name on screen matches the stall's business name before you send, and be alert to stickers that look newly pasted or pasted over another code. If anything looks off, ask the stall owner directly.

What should I do if I entered my bank details on a page from a scanned QR?

Call your bank's 24/7 fraud line immediately, freeze your cards, change your banking password, and file a report via the ScamShield app or the police anti-scam hotline 1799. Then run a full privacy review in Lunyb and enable Data Breach Alerts so you're notified if the stolen data resurfaces.

Does Lunyb work in Singapore?

Yes. Lunyb works on iOS and Android in Singapore. Scam Checker, Data Breach Alerts for your Singapore mobile number and email, on-device threat blocking, the encrypted vault, and our link and QR tools all work out of the box. Start at lunyb.com.