QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes have become part of everyday life in Singapore. You scan them to pay at hawker centres, order food at restaurants, access MRT services, verify SingPass logins, and even top up EZ-Link cards. But this convenience has a dark side: QR code scams, known as "quishing" (QR phishing), have exploded across the island, with victims losing millions of dollars in recent years.

This guide explains how QR code scams in Singapore work, highlights real cases reported by the Singapore Police Force (SPF) and local banks, and gives you clear steps to protect yourself, your family, and your business.

What Are QR Code Scams?

A QR code scam is a type of fraud where criminals use a malicious QR code to redirect victims to phishing websites, trigger unauthorised payments, or install malware on their devices. Because QR codes are machine-readable, you cannot tell by looking at the pattern whether it leads somewhere legitimate or dangerous.

In Singapore, scammers typically exploit the trust people place in familiar brands, government agencies, and food & beverage outlets. The Singapore Police Force reported that QR code-related scams caused losses exceeding S$20 million in a single year, with cases continuing to rise into 2025 and 2026.

Why QR Code Scams Work So Well in Singapore

• High digital adoption: Over 90% of Singaporean adults use PayNow, PayLah!, or similar e-wallets.
• QR culture: SGQR codes are ubiquitous at coffee shops, markets, and retail outlets.
• Trust in institutions: Scammers impersonate MAS-regulated banks, IRAS, Singpost, and government portals.
• Mobile-first behaviour: Most scans happen on phones, where URLs are harder to inspect.

Common QR Code Scams Targeting Singaporeans

1. Bubble Tea and F&B Survey Scams

One of the most publicised scams involved a 60-year-old woman who lost S$20,000 after scanning a QR code sticker on a bubble tea shop window offering a "free cup of milk tea" for completing a survey. The code installed a malicious Android app that gave scammers remote access to her phone and banking apps.

2. Fake Parking Fine Notices

Scammers have placed fake parking tickets on cars in HDB carparks and shopping mall lots. The ticket contains a QR code supposedly linking to a payment portal that mimics URA or HDB. Victims enter card details or Singpass credentials, which are then harvested.

3. Hawker Centre and Coffee Shop Sticker Swaps

Fraudsters paste their own PayNow or SGQR stickers over legitimate ones at stalls. Customers unknowingly transfer payment to the scammer's account instead of the hawker. This often goes undetected for days until stall owners reconcile their accounts.

4. Phishing Emails and Letters from "Banks"

Victims receive emails or physical letters appearing to come from DBS, OCBC, UOB, or Standard Chartered, asking them to scan a QR code to "verify their account" or "reactivate internet banking." The code leads to a cloned login page that captures credentials and OTPs in real time.

5. Fake Government Agency Notices

Scammers impersonate IRAS (tax refunds), ICA (immigration appointments), MOH (health notices), and SingPost (parcel delivery). A QR code in the letter or SMS redirects to a fake Singpass or payment page.

6. Investment and Cryptocurrency Scams

On social media, scammers share QR codes that supposedly lead to "exclusive" investment platforms or crypto exchanges. Once installed, these apps either steal funds directly or lock victims into fake trading accounts.

How Quishing Attacks Actually Work

Understanding the attack chain helps you spot red flags. A typical QR code scam in Singapore follows these steps:

1. Bait placement: The scammer places a QR code in a trusted location (sticker, email, letter, poster, social media ad).
2. Scan trigger: The victim scans using their phone camera, expecting a legitimate action.
3. Redirect: The code opens a shortened or obfuscated URL that redirects to a phishing site or an APK download link.
4. Credential or app capture: The victim either enters sensitive details or installs a malicious Android app (sideloaded outside the Play Store).
5. Account takeover: Scammers use remote access tools or stolen credentials to drain bank accounts, often while the victim sleeps.

Red Flags: How to Spot a Suspicious QR Code

Physical Red Flags

• The QR code is on a sticker that looks freshly applied over another sticker.
• Edges are peeling, misaligned, or printed on different paper quality than surrounding signage.
• The code appears in an unusual location (toilet door, lift wall, bus stop) with vague promises like "free gift" or "win prizes".
• No business name, logo, or contact information accompanies the code.

Digital Red Flags

• The URL preview after scanning looks unfamiliar, misspelled (e.g., "dbs-sg-login.com" instead of "dbs.com.sg"), or uses an unusual top-level domain.
• You are prompted to download an APK file or enable "Install from Unknown Sources" on Android.
• The landing page immediately asks for Singpass credentials, OTPs, or full card details.
• The site uses urgency tactics ("Your account will be frozen in 24 hours").

How to Stay Safe: Practical Steps for Singapore Users

Before You Scan

1. Verify the source. Ask the hawker, cashier, or staff member if the QR code is theirs, especially if it looks newly placed.
2. Be sceptical of unsolicited codes. Government agencies in Singapore rarely ask you to scan a QR code from a letter or email to make payments. Visit the official website directly instead.
3. Use your phone's built-in camera. Avoid third-party QR scanner apps that may hide the destination URL or inject ads.

After You Scan

1. Preview the URL before tapping. Both iOS and Android show the destination link. Read it carefully.
2. Check for HTTPS and the correct domain. Legitimate Singapore bank domains end in .com.sg or .sg. Watch for lookalikes using hyphens or extra words.
3. Never install APKs from links. Only install banking and government apps from the Google Play Store or Apple App Store.
4. Confirm payment details. When paying via PayNow, verify the recipient name matches the business before confirming the transfer.

Protect Your Phone and Accounts

• Enable the Money Lock feature on DBS, OCBC, UOB, and other participating banks to ring-fence a portion of your savings from digital transfers.
• Turn on biometric login and transaction notifications for all banking apps.
• Keep Google Play Protect enabled on Android, and avoid sideloading apps.
• Use the ScamShield app from the Singapore government to block known scam numbers and messages.
• Set low daily transfer limits on PayNow and FAST; raise them temporarily only when needed.

Safely Sharing Links and QR Codes Yourself

If you are a business owner, educator, or community leader creating QR codes for customers, you have a responsibility to keep them safe. A reputable link management tool helps you generate trackable, branded short links that you can regenerate if compromised.

Platforms like Lunyb let you create short links with built-in analytics, custom domains, and the ability to update destinations without reprinting QR codes. If you are still comparing options, read our 2026 buyer's guide to the best URL shorteners or our honest review of Lunyb before deciding.

Best Practices for Businesses Issuing QR Codes

• Laminate or tamper-seal QR codes at your storefront and inspect them daily.
• Display your business name and UEN near every payment QR.
• Train staff to spot sticker swaps and encourage customers to verify recipient names.
• Use branded short links so customers recognise your domain when they scan.

What to Do If You've Been Scammed

Acting within minutes dramatically improves your chances of recovering funds. Follow these steps immediately:

1. Call your bank's 24/7 anti-fraud hotline. DBS: 1800-339-6963, OCBC: 1800-363-3333, UOB: 1800-222-2121. Request an immediate freeze on your accounts.
2. Disconnect the device. Turn on aeroplane mode or power off the phone to stop remote access.
3. File a police report. Visit any Neighbourhood Police Centre or report online via the SPF e-Services portal.
4. Report to ScamShield. Call 1799 or use the ScamShield app to help prevent others from falling victim.
5. Factory reset your phone. If malware was installed, a full reset is the safest option. Back up only photos and documents, not apps.
6. Change passwords for Singpass, email, banking, and e-wallets from a separate, trusted device.

The Role of Government and Industry

Singapore has one of the most proactive anti-scam ecosystems in the world. The Anti-Scam Command (ASCom), the Monetary Authority of Singapore (MAS), the Infocomm Media Development Authority (IMDA), and local banks have introduced several safeguards:

• Shared Responsibility Framework (SRF): Banks and telcos may bear part of the loss if they fail to meet anti-scam duties.
• Money Lock: Lets consumers lock funds that cannot be transferred digitally.
• Kill switches: Instantly freeze all accounts via one tap in banking apps.
• Default SMS Sender ID registry: Only registered organisations can send SMS using alphanumeric sender IDs.
• ScamShield: National app and 1799 helpline for scam checks and reporting.

However, even the best safeguards cannot replace user vigilance. QR code scams succeed because they exploit trust, not technology.

Frequently Asked Questions

Can I get scammed just by scanning a QR code?

Simply scanning a QR code with your phone's camera will not harm your device. The risk arises when you tap the link that appears, visit a phishing site, enter credentials, or download an app. Always preview the URL and never install apps from links.

Are SGQR codes at hawker centres safe?

Official SGQR codes issued by MAS-regulated payment providers are safe, but scammers sometimes paste fake stickers over genuine ones. Always confirm the recipient name shown in your banking or PayLah! app matches the stall before completing payment.

Will my bank refund me if I fall for a QR code scam?

Under Singapore's Shared Responsibility Framework, banks may compensate victims if they are found to have breached anti-scam duties. However, if you willingly transferred funds or entered OTPs, recovery is not guaranteed. Report the scam within minutes to maximise your chances.

How do I check if a QR code link is safe before clicking?

Look at the URL preview that appears after scanning. Verify the domain matches the official site (e.g., dbs.com.sg, not dbs-login-sg.com). You can also paste suspicious links into URL-checking tools such as Google Safe Browsing or VirusTotal before opening them.

What is the fastest way to report a scam in Singapore?

Call the anti-scam hotline at 1799, use the ScamShield app, or call your bank's 24/7 fraud hotline immediately. For police reports, visit any Neighbourhood Police Centre or file online via the Singapore Police Force e-Services portal.

Final Thoughts

QR code scams in Singapore are becoming more creative, from fake bubble tea surveys to sophisticated SGQR sticker swaps at hawker centres. The good news is that most attacks fail against informed users who pause, verify URLs, and avoid installing unknown apps. Combine that awareness with practical safeguards like Money Lock, low transfer limits, and ScamShield, and you dramatically reduce your risk.

Stay sceptical, stay slow, and when in doubt, don't scan. Your few seconds of caution are worth more than any "free gift" a sticker promises.