QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes have quietly become part of everyday life in Singapore. From paying at hawker centres with PayNow to checking restaurant menus, scanning parking charges, or topping up EZ-Link cards, the little black-and-white squares are everywhere. Unfortunately, scammers know this too — and they are increasingly using fake QR codes to steal money, hijack bank accounts, and plant malware on phones.

The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) have issued repeated advisories about "quishing" (QR code phishing) attacks. Victims have lost tens of thousands of dollars after scanning what looked like a harmless code on a bubble tea shop poster or a parking notice. This guide breaks down how QR code scams in Singapore work, the most common tactics in 2026, and exactly what you can do to stay safe.

What Are QR Code Scams?

A QR code scam is a type of fraud in which criminals use a malicious Quick Response (QR) code to redirect victims to a fake website, trigger a payment, or install harmful software. Because the destination of a QR code is not human-readable, users have no easy way to know where a scan will take them until the page has already loaded.

In Singapore, these scams typically fall into three categories:

1. Phishing scams — the code leads to a fake bank, SingPass, or e-commerce login page designed to steal credentials.
2. Payment scams — the code triggers a PayNow or PayLah! transfer to the scammer's account instead of the merchant.
3. Malware scams — the code prompts the download of a malicious Android APK that gives attackers remote control of the device.

Why Singapore Is a Prime Target

Singapore's high smartphone penetration, widespread adoption of SGQR for payments, and a tech-savvy population make it fertile ground for QR-based fraud. Several factors amplify the risk:

• Trust in QR codes: Singaporeans scan dozens of codes a week without a second thought.
• Instant payments: PayNow and PayLah! transfers are near-instant and difficult to reverse.
• Cross-border scam syndicates: Many scams are orchestrated from overseas, making recovery and prosecution complex.
• Multilingual lures: Scammers tailor messages in English, Mandarin, Malay, and Tamil to maximise reach.

According to the Singapore Police Force's annual scam statistics, phishing-related scams — many involving QR codes — remain among the top five scam types by both case volume and total losses.

Common QR Code Scams in Singapore

1. The Bubble Tea Survey Scam

One of the most publicised cases involved a victim who scanned a QR code sticker on the glass door of a bubble tea shop in exchange for a "free cup of milk tea". The code led to a third-party app download that eventually drained more than S$20,000 from her bank account. The malicious app granted scammers remote access to her phone, allowing them to intercept SMS OTPs and transfer funds while she slept.

2. Fake Parking Fine Notices

Scammers stick counterfeit notices on windscreens in HDB carparks and private estates, claiming the driver has an outstanding parking fee. The QR code leads to a spoofed HDB or URA payment page that captures credit card details or triggers a PayNow transfer to a mule account.

3. Hawker Centre and Coffee Shop Overlays

Fraudsters paste their own QR stickers directly over the legitimate SGQR codes at hawker stalls. Customers pay — but the money goes to the scammer rather than the hawker. Stallholders often only realise at the end of the day when takings do not match orders.

4. Delivery and Package Scams

You receive a "missed delivery" card in your letterbox or an SMS claiming a SingPost or Ninja Van parcel is held up. The QR code leads to a page requesting a small "redelivery fee" of a few dollars — but the real goal is to harvest card details for larger unauthorised transactions later.

5. Fake Charity and Donation Drives

Especially around festive periods such as Chinese New Year, Hari Raya, or Deepavali, scammers set up fake donation posters in public spaces. The QR code looks like it supports a real cause but routes money to a personal account.

6. Investment and Crypto Lures

QR codes shared on Telegram, WhatsApp, and TikTok promise access to exclusive investment groups or crypto airdrops. Victims are led to fake trading platforms or asked to connect their crypto wallets, which are then drained.

How to Spot a Malicious QR Code

Because the destination is hidden until you scan, prevention relies on inspecting the context around the code and the URL that appears after scanning. Here is a practical checklist:

Before Scanning

• Check for stickers over stickers. At hawker stalls, cafes, or petrol stations, feel the edge of the QR sticker. If it is peeling, raised, or clearly placed over another code, do not scan.
• Be suspicious of unsolicited codes. Flyers in your letterbox, random posters on lamp posts, or stickers on ATMs are common attack vectors.
• Verify official channels. HDB, LTA, IRAS, and banks will never require you to scan a random QR code to pay a fine or verify an account.
• Avoid codes sent by strangers on WhatsApp, Telegram, Carousell, or dating apps.

After Scanning (But Before Tapping)

• Preview the full URL. Most modern phones show the link before opening it. Read it carefully.
• Watch for look-alike domains. dbs-sg.com, singpass-login.net, or paynow-verify.app are red flags. Official sites typically end in .gov.sg, .com.sg, or the brand's primary domain.
• Beware of URL shorteners used by strangers. Shortened links can hide the final destination. Reputable services like Lunyb let you preview links and view click analytics, but when a shortened link arrives from an unknown source, treat it with caution and expand it using a link-preview tool before visiting.
• Never download APK files prompted by a QR code. Legitimate apps are always available on the Google Play Store or Apple App Store.
• Check for HTTPS and spelling. Misspelt brand names, odd characters, or missing padlocks are classic phishing signs.

Red Flags on the Destination Page

Even if a URL looks acceptable, the page itself may give the scam away. Walk away immediately if you see any of the following:

• Requests for your SingPass, bank login, or full card number including CVV.
• Prompts to grant "Accessibility" permissions to a newly installed app.
• Pressure tactics like countdown timers or threats of legal action.
• Requests to disable Google Play Protect or install apps from "unknown sources".
• Pages that ask you to approve a PayNow transfer to a personal mobile number rather than a registered UEN.

Comparison: Safe vs. Suspicious QR Code Scenarios

Scenario	Safe Indicator	Suspicious Indicator
Paying at a hawker stall	SGQR code is laminated, placed by the stallholder, UEN matches the stall name	Sticker is peeling, placed over another code, pays a personal mobile number
Receiving a parcel notice	Official tracking number on SingPost/Ninja Van app	Random QR code in letterbox asking for a "small fee"
Bank verification	You initiated the login via the official app	SMS or email with a QR code claiming your account is "frozen"
Promotional offer	Printed in a reputable newspaper or official brand channel	Sticker on a lamp post offering free vouchers for scanning
Charity donation	Registered charity listed on charities.gov.sg	QR code on a handwritten poster, no charity registration number

How to Protect Yourself: A Step-by-Step Guide

1. Enable Money Lock on your bank account. DBS, OCBC, UOB, and most local banks now offer a Money Lock feature that ring-fences a portion of your savings from any digital transfer. Even if scammers get in, locked funds are safe.
2. Turn on Google Play Protect and keep it on. Never disable it to install a sideloaded app.
3. Keep your phone's OS updated. Security patches close known exploits that malicious apps use.
4. Use the ScamShield app from the Singapore Police Force and NCPC to filter known scam SMS and calls.
5. Set low daily transaction limits on PayNow, PayLah!, and credit cards. Only raise them temporarily when needed.
6. Enable biometric or hardware token authentication for all banking apps instead of SMS OTP where possible.
7. Never approve push notifications for transactions you did not initiate — tap "Reject" immediately and call your bank.
8. Educate elderly family members. Many QR scam victims in Singapore are seniors who trust printed posters and official-looking notices.

What to Do If You Have Been Scammed

Time is critical. If you suspect you have fallen for a QR code scam, act within minutes rather than hours.

1. Call your bank's 24/7 anti-scam hotline immediately to freeze your account and reverse recent transfers if possible.
2. Enable the "Kill Switch" in your mobile banking app to lock all transactions.
3. Change your SingPass, iBanking, and email passwords from a separate, clean device.
4. Report the scam to the police at police.gov.sg/iwitness or call the Anti-Scam Hotline at 1800-722-6688.
5. Factory reset your phone if you installed a suspicious APK, after backing up only photos and contacts (not apps).
6. Alert your contacts — scammers often use compromised phones to send malicious links to friends and family.

Business Owners: Protect Your Customers and Your Reputation

If you run a hawker stall, F&B outlet, retail shop, or any business accepting QR payments in Singapore, you are also a target. Scammers who paste fake QR codes over yours effectively steal from you by diverting customer payments and damaging trust.

Best Practices for Merchants

• Laminate and secure your SGQR code behind glass or acrylic rather than using a loose sticker.
• Check daily whether the code has been tampered with or covered.
• Display your UEN clearly next to the QR so customers can verify the recipient name before paying.
• Use branded short links for menus, loyalty programmes, and promotions. A trusted shortener such as Lunyb lets you create recognisable links with analytics, and you can read our honest Lunyb review or the 2026 buyer's guide to URL shorteners to compare options.
• Train staff to spot overlay stickers and to confirm payment notifications in real time.

The Role of URL Shorteners in QR Safety

QR codes often encode shortened URLs because long links produce dense, hard-to-scan codes. Shorteners are not inherently dangerous — the issue is when scammers use anonymous or disposable services to hide malicious destinations.

Reputable URL shorteners mitigate this risk by:

• Scanning destination URLs against phishing and malware databases.
• Allowing link owners to disable compromised links.
• Providing analytics so unusual spikes can be investigated.
• Offering branded domains that customers can trust at a glance.

When building QR campaigns, choose a shortener with these controls. For a side-by-side comparison of leading providers and their safety features, see our best URL shorteners of 2026 guide.

Frequently Asked Questions

Can simply scanning a QR code hack my phone?

Simply scanning a QR code will not, by itself, install malware. The danger comes from what happens next — visiting a phishing page, approving an app installation, or granting permissions. Always preview the URL before tapping it, and never install apps from outside the official Play Store or App Store.

Are QR payments at hawker centres in Singapore safe?

SGQR is a secure national standard, and the vast majority of hawker centre payments are perfectly safe. The main risk is physical tampering — scammers pasting their own stickers over the real code. Always check that the recipient name shown in your banking app matches the stall before confirming payment.

What should I do if I scanned a suspicious QR code but did not enter anything?

Close the browser tab immediately, do not install any prompted app, and clear your browser cache. Run a security scan with your phone's built-in protection. If you are unsure, restart the device and monitor your bank accounts for the next few days. If anything looks unusual, call your bank's anti-scam hotline.

How can I report a fake QR code I spotted in public?

Report it to the Singapore Police Force via the i-Witness portal at police.gov.sg/iwitness, or call the Anti-Scam Hotline on 1800-722-6688. If the fake code is on a merchant's premises (such as a hawker stall), inform the stallholder and the premises manager so they can remove it immediately.

Does the ScamShield app protect against QR code scams?

ScamShield primarily blocks known scam SMS and calls, but it also maintains a database of scam-related URLs. If a QR code redirects you to a known phishing site, ScamShield's browser integration can warn you. It is a useful layer, but not a substitute for vigilance — always inspect URLs manually.

Final Thoughts

QR codes are convenient, but convenience always carries a trade-off. In Singapore's fast-paced, cashless environment, the five seconds you spend inspecting a QR sticker, previewing a URL, or verifying a recipient name could save you thousands of dollars and months of recovery stress.

Stay sceptical of unsolicited codes, keep your banking apps locked down, and share this knowledge with family members who may be less familiar with the latest scam tactics. A small habit of pausing before you scan is the single most effective defence against QR code fraud in 2026.