QR Code Scams in Singapore: How to Stay Safe in 2026

Singapore has one of the highest smartphone penetration rates in the world, and QR codes are now part of daily life — from paying for kopi at a hawker centre to topping up EZ-Link cards and ordering at restaurants. Unfortunately, scammers have noticed. QR code scams, also known as "quishing" (QR phishing), have become one of the fastest-growing fraud categories tracked by the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA).

This guide explains how QR code scams work in the Singapore context, the most common local tactics, real cases reported in 2024–2025, and the exact steps you can take to protect yourself, your family, and your business.

What Are QR Code Scams?

A QR code scam is a type of phishing attack where criminals use a Quick Response (QR) code to redirect victims to a malicious website, trigger an unauthorised payment, or trick them into downloading harmful apps. Because the destination URL is hidden inside a pixelated square, victims cannot easily see where the code will take them before scanning.

In Singapore, these scams are particularly effective because QR codes are trusted — they appear on government notices, SingPost parcels, PayNow transfers, hawker stalls, and even parking signs. Scammers exploit this trust by placing fake codes in plausible-looking places.

Why Singapore Is a Prime Target

• High digital payment adoption: PayNow, SGQR, and GrabPay make scanning second nature.
• Cashless hawker culture: Thousands of small stalls display QR codes openly.
• Multilingual population: Scammers craft messages in English, Mandarin, Malay, and Tamil.
• Trust in authority: Singaporeans tend to comply with notices appearing to come from government agencies.

How QR Code Scams Work: The Attack Flow

Most QR code scams follow a predictable five-step pattern. Understanding this flow is the single best defence.

1. Bait placement: The scammer places a fake QR code on a flyer, sticker, email, SMS, or even over a legitimate code at a shop.
2. Scan trigger: You scan the code with your phone camera, expecting a menu, survey, payment prompt, or parcel update.
3. Redirect: The code opens a cloned website that looks like DBS, OCBC, UOB, Singpass, IRAS, or a delivery service.
4. Credential or payment capture: You enter your banking login, OTP, Singpass credentials, or approve a transaction.
5. Account takeover: Within minutes, funds are transferred out, often through multiple mule accounts across jurisdictions.

Common QR Code Scams Reported in Singapore

1. The Bubble Tea Survey Scam

One of the most publicised cases involved a 60-year-old woman who lost S$20,000 after scanning a QR code on a bubble tea shop sticker offering a free cup for completing a survey. The code installed a malicious Android app that gave scammers remote access to her phone and banking app.

2. Fake Hawker Stall PayNow Stickers

Scammers paste their own PayNow QR code on top of the stall's legitimate one. Customers unknowingly transfer payment to the criminal's account. Stalls at Chinatown Complex, Maxwell, and several heartland coffee shops have reported such incidents.

3. Parking Fine and LTA Notices

Fake notices placed on car windscreens include a QR code to "pay the fine online". The link leads to a cloned LTA or HDB page requesting card details and OTPs.

4. SingPost / Parcel Redelivery Scams

Victims receive an SMS or physical note claiming a missed delivery, with a QR code to "reschedule". The site asks for a small redelivery fee — and full card details.

5. Email Quishing Targeting Workers

Employees receive emails pretending to be from HR, Microsoft 365, or Singpass, with a QR code claiming they must re-verify their account. Because QR codes bypass many email security filters, these often reach the inbox.

6. Fake Charity and Donation Drives

Especially during festive periods like Chinese New Year, Hari Raya, and Deepavali, scammers set up fake donation QR codes mimicking legitimate charities registered with the Commissioner of Charities.

Red Flags: How to Spot a Malicious QR Code

Before you scan, pause and look for these warning signs.

Red Flag	What It Looks Like	Risk Level
Sticker over another sticker	Fresh QR code pasted on top of a faded one	Very High
Unsolicited email or SMS	Message you didn't expect, with urgency	Very High
Shortened or unfamiliar domain	URL preview doesn't match the brand	High
Request to install an APK	Prompts to "sideload" an app outside Play Store	Critical
Prize or free gift offer	Promises something for little effort	High
Spelling errors on landing page	Minor typos, wrong logos, odd fonts	High
Request for Singpass credentials	Any non-official site asking for Singpass	Critical

10 Practical Steps to Stay Safe

1. Preview the URL before opening. Modern iOS and Android cameras show the destination link before loading. Read it carefully.
2. Check the domain. Legitimate Singapore government sites end in .gov.sg. Banks use their official domains (e.g. dbs.com.sg, ocbc.com, uob.com.sg).
3. Never install apps via QR code. Download only from the Apple App Store or Google Play Store.
4. Enable Google Play Protect and iOS automatic updates to catch known malicious apps.
5. Turn on Money Lock with your bank (DBS digiVault, OCBC Money Lock, UOB LockAway) so a portion of your savings cannot be transferred digitally.
6. Use ScamShield — the official app by the National Crime Prevention Council and Open Government Products — to filter scam calls and SMS.
7. Verify payment QR codes by checking the merchant name shown in your banking app before confirming any transfer.
8. Report suspicious QR codes to the SPF via the ScamShield app, 1800-722-6688, or www.scamalert.sg.
9. Educate elderly family members. Seniors are disproportionately targeted; walk them through what a safe scan looks like.
10. Use a trusted link checker. When in doubt, paste the URL into a reputable URL inspection tool before visiting it.

How Businesses in Singapore Can Protect Customers

If you run a hawker stall, F&B outlet, retail shop, or e-commerce business, you share responsibility for QR safety. A single tampered sticker can damage your reputation permanently.

Best Practices for Merchants

• Laminate or frame your SGQR / PayNow code so stickers cannot be pasted over it easily.
• Inspect codes daily — assign a staff member to check that nothing has been overlaid.
• Display your UEN and registered business name next to the code so customers can verify in their banking app.
• Use branded short links for marketing QR codes. Shortening services like Lunyb let you generate trackable, revocable links so if a campaign code is abused, you can disable it instantly without reprinting materials.
• Train staff to recognise and respond to customer complaints about failed or suspicious payments.

Why Dynamic Short Links Help

Static QR codes point to a single URL forever. If that URL is compromised or needs to change, every printed code becomes useless — or dangerous. A dynamic short link (where the QR encodes a short URL that you control) lets you redirect, pause, or update the destination at any time. This matters for restaurants with changing menus, event organisers, and marketing teams. For a deeper comparison of options, see our 2026 URL shorteners buyer's guide.

What to Do If You've Been Scammed

Act within minutes — not hours. Fraudulent transfers move through mule accounts very quickly.

1. Freeze your accounts immediately. Use the kill-switch feature in your banking app (available for DBS, OCBC, UOB, Standard Chartered, Citibank, Maybank, HSBC, and others).
2. Call your bank's 24-hour hotline to report unauthorised transactions.
3. Lodge a police report at www.police.gov.sg/iwitness or at any Neighbourhood Police Centre.
4. Report to ScamShield and the Anti-Scam Centre via 1800-722-6688.
5. Change passwords for Singpass, banking, email, and any accounts accessed on the compromised device.
6. Factory reset your phone if you installed any suspicious APK or granted accessibility permissions.
7. Notify CPF Board and IRAS if Singpass may have been compromised.

The Role of Shared Responsibility Framework (SRF)

Since late 2024, Singapore's Shared Responsibility Framework shifts some liability for phishing scam losses onto banks and telcos if they fail to meet specified anti-scam duties. However, QR code scams where victims willingly install malware or approve payments often fall outside the SRF. This makes personal vigilance more important than ever — recovery is not guaranteed.

Emerging QR Scam Trends to Watch in 2026

• AI-generated landing pages: Scam sites now mimic DBS, OCBC, and Singpass with near-perfect accuracy, including live chat.
• QR codes embedded in PDFs: Business email compromise attacks now use PDF invoices containing malicious QR codes to bypass filters.
• Deepfake voice follow-ups: After a scan, victims receive a call from a cloned "bank officer" voice urging them to approve a transaction.
• Fake EV charging stations: As EV adoption rises, scammers are placing fake QR codes at charging bays.
• Tourist-targeted codes at MRT stations, Changi Airport pickup zones, and attractions offering "free Wi-Fi" or "tourist discounts".

Quick Reference: Safe vs. Unsafe QR Behaviour

Behaviour	Safe ✅	Unsafe ❌
Scanning a menu at a known restaurant	Yes, after checking the code isn't tampered	Blindly scanning stickers at random locations
Paying via PayNow QR	Verify merchant name before confirming	Transferring without checking recipient
Government notice QR codes	Visit the agency's website directly instead	Scanning codes from unsolicited mail
Installing apps	Only from App Store or Play Store	Sideloading APKs from a scanned link
Entering Singpass	Only on singpass.gov.sg	Any site reached through a scanned code

Frequently Asked Questions

Are QR code scams illegal in Singapore?

Yes. QR code scams fall under the Computer Misuse Act, the Penal Code (cheating), and the Payment Services Act. Perpetrators face fines and imprisonment, though many operate from overseas, making prosecution difficult. This is why prevention matters more than recovery.

Can I get my money back after a QR code scam?

Recovery depends on how quickly you act and the circumstances. Under the Shared Responsibility Framework, banks may compensate victims if they failed anti-scam duties, but losses from malware-based scams where the victim installed an app often fall outside coverage. Report within 30 minutes for the best chance of fund recall.

Is it safe to scan QR codes at hawker centres?

Generally yes, but always verify the merchant name shown in your banking app before confirming payment. If the name doesn't match the stall, cancel immediately and alert the stall owner. Pasted-over stickers are a known tactic in Chinatown, Bedok, and several heartland coffee shops.

How can I check if a QR code link is safe before visiting?

Use your phone's camera preview to read the full URL first. If the link is shortened or looks suspicious, paste it into a URL inspection tool like VirusTotal or urlscan.io before opening. Never enter credentials on any site reached through an unsolicited QR code.

What's the single most important habit to prevent QR scams?

Pause and preview. Every modern smartphone shows the destination URL before opening it. Taking two seconds to read that link — and refusing to proceed if anything looks off — prevents the vast majority of quishing attacks. Combine this with Money Lock on your bank account and you've eliminated most of the risk.

Final Thoughts

QR codes are not going away — they are too convenient, and Singapore's digital economy depends on them. The good news is that staying safe doesn't require technical expertise. It requires one habit: look before you scan. Combine that with Money Lock, ScamShield, and healthy skepticism about anything unsolicited, and you'll stay well ahead of the scammers.

For businesses, invest in tamper-evident code displays and consider dynamic, revocable short links for marketing campaigns so a single compromised code never becomes a crisis.