QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are everywhere in Singapore — on hawker stalls, parking meters, EV chargers, shopfronts, MRT posters, restaurant menus, and even on letters that look like they came from a bank or a government agency. That convenience is exactly what scammers are exploiting. If you want a single, practical way to stay ahead of QR code scams in Singapore in 2026, install Lunyb and let its Scam Checker and on-device threat blocking do the heavy lifting before you ever tap a suspicious link.

This guide breaks down how QR code scams work locally, the exact patterns the Singapore Police Force and ScamShield have been warning about, and how Lunyb makes safe scanning something you actually do every time — not just when you remember.

What Are QR Code Scams (Quishing)?

QR code scams, often called quishing (QR phishing), are attacks where criminals use a QR code to send you to a malicious website, trigger a payment, or trick you into entering banking credentials, Singpass details, or card information. The QR code itself is just a shortcut — the danger lives in the URL it hides.

Because a QR code is unreadable to the human eye, you have no idea where you are actually going until your phone has already loaded the page. By then, a convincing fake DBS, OCBC, UOB, Singpass, LTA, IRAS, or SingPost page may already be asking for your login.

Why Singapore Is a Prime Target

High QR adoption: PayNow, SGQR, NETS QR, and merchant-generated codes are part of daily life.
Trusted institutions: Scammers impersonate banks, government agencies, and delivery firms that Singaporeans are used to interacting with via QR.
Mobile-first habits: Most people scan codes on the same device that holds their banking app, making one tap enough to cause real financial loss.

The Most Common QR Code Scams in Singapore Right Now

The Singapore Police Force and ScamShield continue to warn about QR-based scams across food, retail, parking, and investment contexts. Here are the patterns to recognize in 2026.

1. The Fake Survey or Free Drink Sticker

You see a sticker on a bubble tea shop, cafe, or restaurant offering a free drink, voucher, or lucky draw if you scan and complete a short survey. The QR code leads to a cloned page that asks you to install a third-party app (often an APK outside Google Play) or to log in with your bank credentials to "claim your reward." Once installed, that app can read your SMS OTPs and drain your account.

2. Tampered Hawker and Merchant QR Codes

Scammers physically paste a fake QR sticker over the real PayNow or SGQR code at a stall, carpark, or shop counter. You scan to pay, the money goes to the attacker's account, and the merchant never sees it. Always confirm the recipient name shown in your banking app matches the business before you hit send.

3. Fake Parking, Traffic, or LTA Notices

A "notice" appears on your windscreen or in your letterbox with an urgent fine, a reminder, or a redelivery request and a QR code to "settle" or "verify." The page looks like LTA, URA, or SingPost but is designed to harvest card details.

4. Phishing Emails and Letters With QR Codes

Instead of a clickable link (which email filters catch), the scammer embeds a QR code image. You scan it with your phone — which has none of the protections your work laptop has — and land on a fake Microsoft 365, Singpass, or bank login page. This is now one of the fastest-growing attack types globally.

5. Investment and Crypto QR Codes

Shared in Telegram groups, WhatsApp chats, or social media ads, these QR codes lead to fake trading platforms or wallet addresses. Once you deposit, the money is gone.

6. Fake Delivery and Package QR Codes

SMS or a slip claiming a parcel is waiting, with a QR code to "reschedule." The page asks for a small redelivery fee and your card details — which are then charged repeatedly.

Why Manual Checking Is Not Enough Anymore

Common advice says: "preview the URL before you open it." Good advice — but it falls apart fast in real life:

Scam URLs now use lookalike domains (dbs-sg-secure.com, singpass-verify.net) that look legitimate in a one-second glance.
Attackers use legitimate URL shorteners to hide the final destination, so the preview tells you nothing.
Many scanner apps open the link automatically before you can react.
You are usually scanning while standing at a counter, in a carpark, or holding a bag — not in the calm, careful mindset the advice assumes.

The realistic fix is not more willpower. It is a tool that checks every link for you, blocks known bad destinations at the network level on your device, and warns you before the page loads. That is what Lunyb is built to do.

How Lunyb Protects You From QR Code Scams in Singapore

Lunyb is a phone privacy and scam-protection app, plus a secure link and QR platform. For QR code scams specifically, several Lunyb features work together so you do not have to be a security expert to stay safe.

Scam Checker: Paste or Scan Before You Trust

Lunyb's Scam Checker lets you check a suspicious message, link, or QR destination before you act on it. If a sticker at a hawker centre, a letter in your mailbox, or a WhatsApp forward wants you to scan and "verify," you can run the URL through Scam Checker first and get a clear read on whether the destination looks safe, suspicious, or known-bad.

On-Device Threat Blocking (Local DNS Shield)

Lunyb includes an on-device, network-level shield that blocks known malicious domains and trackers right on your phone — no routing your traffic through a third-party tunnel. If you accidentally scan a QR code that points to a flagged phishing or malware domain, Lunyb can stop the connection before the fake bank page even loads. That is the single biggest safety net for everyday scanning.

Privacy Check and Security Score

Many QR scams only succeed because another app on your phone has excessive permissions — SMS access, accessibility services, or overlay rights that allow an attacker to steal OTPs or mask real screens. Lunyb's Privacy Check reviews app permissions and flags risky ones, and your Security Score gives you a running view of how exposed your device actually is.

Data Breach Alerts for Email and Phone

If your email or Singapore mobile number appears in a known data breach, scammers can target you with far more convincing quishing attempts (they already know your name, bank, or recent purchase). Lunyb's Data Breach Alerts tell you when your details leak so you can change passwords and raise your guard before the scam arrives.

Encrypted Password and Photo Vault

If a QR scam tricks you into a fake login page, strong unique passwords stored in Lunyb's encrypted vault mean one compromised credential will not unlock everything else. Your photos — including NRIC shots, passport scans, and bank screenshots that many Singaporeans store casually — stay in the encrypted Photo Vault instead of your camera roll.

Secure Link Shortener and QR Codes

Lunyb also lets you create short links and QR codes on a privacy-first platform. If you run a business, a church group, an F&B outlet, or a community event in Singapore, generating your QR codes through Lunyb keeps your audience on a trustworthy foundation and gives you clean analytics. If you want more context on the shortener side, see our honest review of the Lunyb URL shortener and our Rebrandly vs. Lunyb comparison.

Lunyb vs. Doing It All Manually

What you need	Manual approach	With Lunyb
Check a QR destination before opening	Preview URL, squint, guess	Scam Checker gives a clear read
Block known phishing domains	Hope the browser catches it	On-device DNS shield blocks at network level
Know if your details leaked	Check breach sites one by one	Automatic breach alerts for email & phone
Keep OTPs and logins safe	Reuse passwords, remember them	Encrypted vault with unique passwords
Review risky app permissions	Dig through settings on every app	Privacy Check surfaces them for you
Generate trustworthy QR codes	Random free generator, unknown owner	Lunyb secure QR + link platform

How to Safely Scan a QR Code in Singapore: A 6-Step Routine

Inspect the sticker. At a hawker stall, carpark, or shop, check if a QR code is pasted over another one, peeling, or looks freshly stuck on. If in doubt, ask the staff for the official code.
Preview the URL before opening. Your phone's camera app usually shows the destination before launching the browser.
Run it through Lunyb Scam Checker if anything feels off — urgent wording, a reward, a fine, a login request, or an unfamiliar domain.
Never install APKs or sideloaded apps a QR code pushes you to. Real Singapore banks and agencies will never ask you to install an app from outside the App Store or Google Play.
Verify payees in your banking app. Before confirming a PayNow or NETS QR payment, read the recipient name out loud and match it to the business.
Report suspected scams to ScamShield and the Singapore Police Force anti-scam channels, and warn the merchant if the code was tampered with in person.

Red Flags That Should Stop You Immediately

The QR code is on a sticker that looks newer than the sign around it.
The destination asks for Singpass, bank login, OTP, or full card details after a scan.
You are urged to act within minutes to "avoid a fine" or "claim a prize."
The domain is almost right but not quite (extra words, dashes, wrong top-level domain).
You are asked to download an app from outside the official stores.
A payment QR shows a personal name instead of the business you are paying.

What to Do If You Already Scanned a Scam QR Code

Disconnect: Turn on airplane mode to stop any live session.
Do not enter anything on the page. Close the browser tab.
Check for new apps installed without your knowledge and remove them.
Change passwords for your bank, email, and Singpass from a different, trusted device. Use Lunyb's encrypted vault to generate strong unique ones.
Call your bank's anti-scam hotline immediately if you entered any credentials or OTPs.
Report to ScamShield and lodge a police report at the Singapore Police Force anti-scam channels.
Run a Lunyb Privacy Check and review the breach alerts so you know what else may have been exposed.

Try Lunyb Today

QR code scams in Singapore are not slowing down — they are getting more polished, more local, and more personal. You do not need to become a cybersecurity analyst to stay safe. You need a tool that checks links for you, blocks bad destinations on your device, warns you when your data leaks, and keeps your passwords and photos locked up.

That is exactly what Lunyb does. Plans start from about S$ equivalent US$19.99/month, renew until you cancel, and you can cancel anytime online — no games, no retention mazes.

Get started in two minutes:

Take the free privacy quiz on lunyb.com to see where you are exposed.
Download the Lunyb app from the App Store or Google Play.
Turn on Scam Checker and the on-device threat shield before you scan your next QR code.

Frequently Asked Questions

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force and ScamShield continue to warn about QR-based scams across food outlets, carparks, delivery notices, and phishing letters. The combination of high QR adoption and trusted institutions makes Singapore an attractive target.

Can my phone get hacked just by scanning a QR code?

Scanning alone usually just loads a URL — the real damage happens after you interact with the page, install an app it pushes, or enter credentials. That is why blocking the destination with a tool like Lunyb before the page loads is so effective.

Is Lunyb a VPN?

No. Lunyb uses an on-device, network-level shield (local DNS protection) to block known malicious domains and trackers directly on your phone. Your traffic is not routed through a third-party tunnel.

How do I check if a PayNow or SGQR code is real?

Preview the URL before opening, confirm the recipient name in your banking app matches the business, and look for signs the sticker was tampered with. For anything suspicious, run the link through Lunyb Scam Checker before you pay or log in.

How much does Lunyb cost and can I cancel?

Lunyb plans start from about US$19.99/month and renew until cancelled. You can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan.