QR Code Scams in Singapore: How to Stay Safe in 2026

Singapore has become one of the most digitally connected societies in the world, and with that convenience comes a sharp rise in a new type of fraud: QR code scams. From hawker centre payment stickers to parking signs along HDB carparks, QR codes are everywhere, and scammers have learned to exploit the trust Singaporeans place in them. The Singapore Police Force and the Monetary Authority of Singapore (MAS) have both issued multiple advisories warning that QR code phishing, often called "quishing", is one of the fastest-growing scam vectors in the country.

This guide explains exactly how QR code scams in Singapore work, highlights real local cases, and gives you a practical checklist to stay safe whether you are paying for bubble tea, topping up an EZ-Link card, or receiving a parcel notification.

What Are QR Code Scams?

A QR code scam is a form of phishing where criminals use a Quick Response (QR) code to redirect victims to a malicious website, trigger an unauthorised payment, or install malware on a smartphone. Because QR codes are machine-readable and visually indistinguishable from one another, a human cannot tell a legitimate code from a fraudulent one just by looking.

Scammers typically achieve this in one of three ways:

1. Overlay attacks: A sticker with a malicious QR code is pasted directly on top of a genuine one at a merchant, parking meter, or public notice board.
2. Distribution attacks: Fake flyers, emails, letters, or SMS messages are sent out containing a scam QR code disguised as a legitimate offer, survey, or delivery notification.
3. Social engineering: A scammer messages you directly (often on Carousell, Facebook Marketplace, or WhatsApp) asking you to scan a code to "verify" a payment or claim a refund.

Why QR Code Scams Are Exploding in Singapore

Singapore has an unusually high exposure to QR fraud for several reasons:

• PayNow and SGQR adoption is near universal. Almost every hawker stall, taxi, and small business accepts QR payments, so scanning a code feels completely routine.
• Trust in authority is high. Scammers impersonate HDB, LTA, IRAS, Singapore Post, and the police because residents are conditioned to respond to official notices quickly.
• Tourist traffic. Visitors unfamiliar with local brands are easier to deceive with fake survey or Wi-Fi codes at Changi Airport, Orchard Road, and Marina Bay.
• Device integration. iPhones and Android phones automatically open URLs from QR codes, often without a visible preview of the full destination.

According to figures published by the Singapore Police Force, phishing-related scams, including those initiated by QR codes, caused losses exceeding S$150 million in a recent reporting year, with victims ranging from retirees to tech-savvy professionals.

Real QR Code Scam Cases in Singapore

The Bubble Tea Survey Scam

One of the most widely reported local cases involved a 60-year-old woman who scanned a QR code on a bubble tea shop sticker promising a free cup in exchange for completing a survey. The code installed a malicious Android app that gave scammers remote access to her phone. Overnight, they transferred more than S$20,000 from her bank account using her own banking app.

Fake Parking Fine Notices

Residents in several estates have reported finding what look like official parking summons tucked under their windscreen wipers, complete with LTA-style branding and a QR code to "pay the fine immediately to avoid additional charges". The code leads to a convincing clone of a payment page that harvests credit card details.

SingPost and Delivery Scams

SMS and email messages pretending to be from SingPost, Ninja Van, or J&T Express ask recipients to scan a QR code to reschedule a missed delivery. The link requests a small "redelivery fee" of a few dollars, but the real goal is to capture full card details including CVV and OTP.

Hawker Centre Overlay Scams

At several hawker centres, scammers have pasted stickers over genuine SGQR codes at drinks stalls. Customers who scan end up paying into a scammer's account instead of the stall owner's, often without realising until the hawker chases them for payment.

How to Recognise a QR Code Scam

Red Flags Before You Scan

• The QR code is on a sticker that looks freshly applied, peeling, or placed over another code.
• The code arrived unsolicited via SMS, WhatsApp, email, or a letter you were not expecting.
• There is urgency: "pay within 24 hours", "account will be suspended", "last chance to claim".
• The code promises something free: lucky draw, voucher, government rebate, or survey reward.
• The surrounding text has spelling errors, odd grammar, or inconsistent branding.

Red Flags After You Scan

• The URL preview shows a domain that does not match the organisation (e.g. sing-post-sg.com instead of singpost.com).
• You are asked to download an APK file or sideload an app outside the Google Play Store or Apple App Store.
• The page requests your full NRIC, Singpass credentials, OTP, or complete card details including CVV.
• The site asks for "accessibility permissions" or "screen overlay" permissions after install.
• The payment amount shown does not match what you expected to pay the merchant.

How to Stay Safe: A Practical Checklist

1. Always Preview the URL

Modern iPhones and most Android phones display the destination URL at the top of the screen when a QR code is scanned. Pause and read it before tapping. If the domain looks unfamiliar, misspelt, or uses a strange top-level domain like .xyz, .top, or .cn for something claiming to be a Singapore government service, close it immediately.

2. Verify SGQR and PayNow Payments

Legitimate SGQR codes display the merchant's registered name inside your banking app before you confirm payment. If the name shown does not match the shop, cancel the transaction. For PayNow transfers, always check the recipient name against the business you are paying.

3. Never Download Apps From a QR Code

No legitimate Singapore bank, government agency, or delivery company will ever ask you to install an app via a QR code or sideloaded APK. Download apps only from the official Apple App Store or Google Play Store, and verify the publisher name.

4. Enable Banking App Security Features

Turn on Money Lock with your bank (DBS digiVault, OCBC Money Lock, UOB LockAway) to ring-fence savings that cannot be transferred out digitally. Enable transaction notifications and set low daily transfer limits that you raise only when needed.

5. Use Link-Checking Tools for Suspicious URLs

If you want to inspect a link before visiting, use a URL expander or scanner. Trusted link management platforms like Lunyb let you preview where shortened links actually lead, which is useful when you receive a suspicious shortened URL from a QR code or message. For a broader look at reputable link tools, see our 2026 buyer's guide to URL shorteners.

6. Keep Your Phone Updated

Install iOS and Android security patches as soon as they are available. Many quishing attacks rely on older browser or OS vulnerabilities to install spyware silently.

7. Report and Verify

If you suspect a scam, call the ScamShield helpline at 1799, forward suspicious SMS messages to 7726, or report via the ScamShield app. For urgent cases involving money already transferred, call the police hotline at 1800-255-0000 and your bank's 24-hour fraud line immediately.

Comparison: Legitimate vs Scam QR Code Scenarios

What To Do If You Have Already Been Scammed

1. Disconnect immediately. Turn on aeroplane mode to cut the scammer's access to your device if you installed something.
2. Call your bank's fraud hotline. DBS: 1800-339-6963, OCBC: 1800-363-3333, UOB: 1800-222-2121. Freeze your accounts and cards.
3. Lodge a police report online at eservices.police.gov.sg or at any Neighbourhood Police Centre.
4. Factory reset your phone if you installed a suspicious APK, then restore from a clean backup made before the incident.
5. Change all passwords for banking, email, Singpass, and social media from a different, trusted device.
6. Report the scam to ScamShield so others can be warned.

How Businesses in Singapore Can Protect Customers

Merchants and organisations have a responsibility too. If you run a business that uses QR codes:

• Laminate or frame QR codes rather than using easily-replaced stickers.
• Check your codes daily for tampering, especially in high-traffic locations.
• Use branded short links from a trusted provider so customers can recognise your domain. Platforms like Rebrandly and Lunyb let you create custom-domain short URLs that build trust and are easier to verify.
• Educate staff and customers about what your official payment flow looks like.
• Monitor click analytics for unexpected spikes or geographic anomalies that might indicate code abuse.

Frequently Asked Questions

Can a QR code hack my phone just by scanning it?

Simply scanning a QR code does not directly install malware. The danger comes from what happens next: visiting a malicious website, downloading an app, or entering credentials. Modern phones preview the URL first, so always read it before tapping.

Are SGQR and PayNow codes safe?

Yes, the SGQR and PayNow systems themselves are secure and regulated by MAS. The risk comes from physical tampering (someone pasting a fake sticker over a real code) or scammers tricking you into paying the wrong recipient. Always verify the merchant name shown in your banking app before confirming.

How do I report a QR code scam in Singapore?

Call the anti-scam helpline at 1799, use the ScamShield app, forward scam SMS to 7726, or file a report at eservices.police.gov.sg. If money has already been transferred, call your bank's 24-hour fraud hotline immediately and then the police at 1800-255-0000.

Will my bank refund me if I was scammed via a QR code?

Under the Shared Responsibility Framework introduced by MAS and IMDA, banks and telcos may bear part of the loss if they failed in specific anti-scam duties. However, if you willingly entered your OTP or approved the transaction, you may bear most of the loss. Report quickly, cooperate fully with investigations, and document everything.

Is it safer to type a URL manually than to scan a QR code?

For sensitive actions like logging into Singpass, banking, or paying taxes, yes. Typing the official URL yourself (or using a bookmark you created) eliminates the risk of being redirected to a lookalike site. Reserve QR scanning for low-risk situations like menus and verified in-person payments.

Final Thoughts

QR codes are not going away in Singapore. They are too convenient, too embedded in daily life, and too useful for small businesses to abandon. The right response is not to stop scanning but to scan with awareness. Preview every URL, verify every payee name, never install apps from a code, and treat urgency as the number one warning sign.

Scammers rely on speed and trust. The moment you slow down and verify, their entire playbook collapses. Share this guide with family members, especially elderly relatives who are frequent targets, and make "pause before you scan" a household habit. In a city as digital as Singapore, that one second of hesitation might save you thousands of dollars.