QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes have become part of everyday life in Singapore, from ordering bubble tea at a hawker stall to paying for parking via the Parking.sg app. Unfortunately, the same convenience that makes QR codes so useful has also made them a favourite tool for scammers. The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) have repeatedly warned the public about a sharp rise in QR code scams, with victims losing anywhere from a few hundred dollars to over S$20,000 in a single incident.

This guide explains how QR code scams in Singapore work, highlights real cases reported locally, and gives you a practical checklist to stay safe whether you're a consumer, a hawker, or a small business owner.

What Are QR Code Scams?

A QR code scam, often called "quishing" (QR phishing), is a type of fraud where attackers trick victims into scanning a malicious QR code. The code typically leads to a fake website, a phishing form, or a prompt to download a harmful app. Once the victim enters credentials, approves a payment, or installs the file, scammers can drain bank accounts, hijack digital tokens, or steal personal data.

QR codes are especially dangerous because the destination URL is hidden inside a pattern of black and white squares. Unlike a suspicious link in an email, you cannot easily tell at a glance whether a QR code is safe or malicious.

Why Singapore Is a Prime Target

Singapore has one of the highest rates of digital payment adoption in Asia. PayNow, SGQR, NETS QR, and bank-issued QR payments are everywhere. This high trust in QR-based transactions is exactly what scammers exploit. According to figures published by the Singapore Police Force, scam-related losses in Singapore crossed S$1 billion in a recent year, with phishing and e-commerce scams, including QR-based variants, among the fastest-growing categories.

How QR Code Scams in Singapore Typically Work

Most QR code scams in Singapore follow one of a few predictable patterns. Understanding these patterns is the first step to spotting them before you tap "confirm."

1. The Bubble Tea / Free Drink Survey Scam

This is one of the most publicised cases. A victim is approached outside a mall or receives a flyer with a QR code offering a free drink in exchange for completing a short survey. Scanning the code leads to a request to download a third-party Android APK file. Once installed, the app contains malware that:

Requests accessibility permissions.
Monitors keystrokes and screen activity.
Captures banking credentials and SMS OTPs.
Allows scammers to remotely log in and transfer funds, sometimes in the middle of the night.

In one widely reported case, a victim lost over S$20,000 after scanning a QR code for a "free bubble tea" offer.

2. Fake Hawker Stall and F&B QR Codes

Scammers physically paste fake PayNow or SGQR stickers over the real ones at hawker stalls, coffee shops, or small restaurants. Customers scan the code, pay, and the money goes straight to the scammer's account. The stall owner never receives payment and the customer may not realise until the stall owner asks for payment confirmation.

3. Parking Coupon and Carpark Fine Scams

Fake notices resembling LTA or HDB carpark fines are left on windscreens with a QR code to "pay the fine instantly." The code leads to a phishing site that mimics a government payment portal.

4. Fake Delivery and Package Notices

With the volume of e-commerce in Singapore, scammers leave fake "missed delivery" notices in letterboxes or at HDB doors, complete with a QR code to "reschedule delivery." The link harvests login details for SingPass, bank accounts, or courier accounts.

5. Phishing Emails With Embedded QR Codes

Instead of a clickable link, phishing emails now include a QR code image. This bypasses many corporate email security filters that scan URLs. Employees scan the code with their personal phone, which is often less protected than their work laptop, and end up on a credential-harvesting page impersonating Microsoft 365, DBS, or OCBC.

6. Investment and "Add Me on Telegram" Scams

QR codes on social media ads lead to Telegram or WhatsApp groups promoting "guaranteed returns" crypto or stock schemes. Victims are coaxed into transferring money or scanning further QR codes to top up fake trading platforms.

Real Red Flags to Watch For

Scammers rely on urgency, curiosity, and trust in familiar brands. Here are the warning signs you should treat as instant red flags:

A QR code sticker that looks freshly pasted over another sticker.
Offers that sound too good to be true: free drinks, cashback, lucky draws.
Being asked to download an APK file or sideload an app from outside the Google Play Store or Apple App Store.
Requests for accessibility permissions, SMS access, or "Install unknown apps."
URLs that look slightly off: dbs-sg-login.com, singpass-verify.net, payn0w.sg.
Pressure to act immediately: "fine must be paid within 2 hours" or "offer expires today."
QR codes received via unsolicited emails, SMS, or WhatsApp messages.
Payment pages that ask for your full card number, CVV, and OTP in one single form.

Comparison: Safe vs. Suspicious QR Code Scenarios

Scenario	Likely Safe	Likely a Scam
Payment at hawker stall	QR printed inside laminated menu, stall owner confirms transfer	Loose sticker pasted over another QR, no acknowledgment from staff
Carpark fine	Official LTA/HDB letter mailed to your registered address	Flyer on windscreen with QR for instant payment
Bank notification	Message inside your official banking app	SMS or email with QR asking to "re-verify" your account
Package delivery	Notification in SingPost, Ninja Van, or Shopee app	Printed slip in letterbox with QR to "pay customs fee"
Promotion / lucky draw	Posted on verified brand's official social media	Stranger on the street offering free gifts for a scan

How to Stay Safe: A Practical Checklist

You don't need to stop using QR codes. You just need a few consistent habits. Follow these steps every time you scan.

1. Preview the URL Before Opening

Modern iPhones and most Android phones show the destination URL at the top of the screen before you tap it. Always read it. If it doesn't match the brand or looks garbled, close it immediately.

2. Never Install Apps From QR Codes

Legitimate businesses in Singapore will never ask you to install an APK file via a QR code. If you want their app, search for it directly in the Google Play Store or Apple App Store.

3. Use Trusted Payment Apps for QR Payments

When paying with PayNow or SGQR, scan using your bank's official app (DBS PayLah!, OCBC Digital, UOB TMRW, etc.) rather than a generic camera scanner. Your bank app will display the recipient's name and UEN, giving you a chance to verify before confirming.

4. Verify the Recipient Name

Before confirming a payment, check that the recipient name matches the stall or business. If you're paying "Ah Hock Chicken Rice" but the recipient shows up as "XYZ Trading Pte Ltd" or an individual's name you don't recognise, stop.

5. Enable Money Lock and Transaction Limits

All major Singapore banks now offer "Money Lock" features that let you ring-fence part of your savings so it cannot be transferred out digitally. Combined with low daily transfer limits for PayNow and FAST, this dramatically reduces potential losses.

6. Keep Your Phone's OS and Security Patches Updated

Many malware strains exploit older Android versions. Keep automatic updates on, and avoid rooting or jailbreaking your device.

7. Use a Link Checker Before Visiting Unknown URLs

If you must open a link from a QR code, consider using a link preview or safety-checking tool first. Services such as Google Safe Browsing, VirusTotal, or trusted link management platforms like Lunyb allow you to inspect where a shortened URL actually leads before you commit to visiting it. If you work with links regularly, our guide to the best URL shorteners of 2026 covers which providers offer the strongest safety and analytics features.

8. Report Suspicious QR Codes

If you spot a tampered QR code at a stall, carpark, or in your letterbox, report it to:

ScamShield App (available on iOS and Android).
Singapore Police Force hotline: 1800-255-0000 or via police.gov.sg.
Your bank's 24/7 anti-scam hotline if money has already been transferred.
Anti-Scam Centre if you need to block mule accounts quickly.

Advice for Hawkers and Small Business Owners

If you accept QR payments, you're also a target. Scammers can hurt your reputation by replacing your QR code, and customers may blame you when they lose money.

Protect Your Storefront

Laminate and secure your QR code inside a frame or behind the counter, not on a loose sticker.
Inspect your QR code daily for tampering, especially after busy periods or when the stall is unattended.
Display your UEN and business name next to the QR so customers can verify the recipient on their banking app.
Train staff to always acknowledge payment only after seeing the "successful transfer" screen on the customer's phone.
Keep digital receipts so you can trace discrepancies quickly.

What to Do If You've Already Been Scammed

If you suspect you've scanned a malicious QR code or transferred money to a scammer, speed matters. Every minute increases the chance that funds leave Singapore's banking system.

Call your bank immediately to freeze your account and reverse pending transactions where possible.
Turn on airplane mode if you suspect malware was installed, then do a full factory reset.
File a police report at any Neighbourhood Police Centre or online via the SPF e-services portal.
Report to ScamShield so the number, URL, or app can be added to its block list.
Change all critical passwords (SingPass, email, bank apps) from a clean device.
Enable two-factor authentication everywhere, preferably using an authenticator app rather than SMS.

The Bigger Picture: Why QR Scams Will Keep Evolving

QR code scams in Singapore are evolving quickly because they combine three ingredients scammers love: trust in familiar payment rails, physical access to public spaces, and the ability to hide malicious URLs behind an image. As Singapore continues to roll out initiatives like Project Orchid and more cross-border QR interoperability with countries like Thailand, Malaysia, and Indonesia, the attack surface will only grow.

The good news is that regulators, banks, and platforms are also stepping up. Money Lock, kill switches, Singpass Face Verification for high-risk transactions, and the mandatory Shared Responsibility Framework between banks and telcos all help reduce losses when scams do succeed. But technology alone can't protect you if you scan without thinking. The single most powerful habit is simple: pause, preview, and verify before you confirm.

For businesses that rely on sharing links with customers, choose a reputable link management provider that supports branded domains, click analytics, and safety screening. You can compare options in our URL shortener buyer's guide, read our honest review of Lunyb, or see how enterprise tools stack up in our Rebrandly review.

Frequently Asked Questions

Is it safe to scan QR codes in Singapore?

Yes, as long as you take basic precautions. QR codes themselves are harmless; the risk comes from the website or app they open. Always preview the URL before tapping it, use your bank's official app for PayNow and SGQR payments, and never install an APK file from a QR code.

What should I do if I accidentally scanned a scam QR code?

If you only scanned the code but did not enter any details or install anything, simply close the browser tab. If you entered credentials or downloaded an app, immediately disconnect from the internet, factory reset the device, change your passwords from a clean device, and call your bank's anti-scam hotline. Then file a report with the Singapore Police Force and ScamShield.

How can hawkers protect themselves from QR code tampering?

Laminate QR codes and place them behind the counter or inside a locked frame. Check them daily for stickers pasted on top. Display your business name and UEN so customers can verify the recipient on their phone. Train staff to confirm payment only after seeing the official "successful" screen on the customer's banking app.

Can my iPhone or Android get a virus from scanning a QR code?

Just scanning a QR code will not install malware. The risk appears only if you then tap the link, download a file, or grant permissions. iPhones are generally safer because iOS blocks sideloaded apps by default. Android users should ensure "Install unknown apps" is disabled and only download apps from the Google Play Store.

Where can I report QR code scams in Singapore?

Report to the Singapore Police Force at 1800-255-0000 or via the official e-services portal, submit suspicious messages and URLs through the ScamShield app, and alert your bank's 24/7 anti-scam hotline if money has been transferred. For urgent cases involving active transfers, the Anti-Scam Centre can help freeze mule accounts quickly.