QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes have become part of everyday life in Singapore — from paying for kopi at a hawker centre to topping up EZ-Link, scanning SafeEntry-era menus, or logging into banking apps. Unfortunately, scammers have noticed. Over the last two years, the Singapore Police Force (SPF) and the Monetary Authority of Singapore (MAS) have repeatedly warned residents about a new breed of fraud known as quishing — phishing attacks delivered through malicious QR codes.

This guide explains how QR code scams in Singapore actually work, walks through real local cases, and gives you a practical checklist to stay safe — whether you're a bubble tea lover, an SME owner, or a senior being targeted by increasingly sophisticated fraud.

What Are QR Code Scams?

A QR code scam is a type of fraud where criminals trick victims into scanning a malicious QR code that leads to a fake website, downloads malware, or authorises an unwanted payment. Because the destination URL is hidden inside a square of black-and-white pixels, users cannot visually tell a safe code from a dangerous one before scanning.

In Singapore, these scams have exploded alongside the country's cashless payment adoption. PayNow, PayLah!, SGQR and bank apps all rely on QR codes, which has normalised the behaviour of pointing your phone at a sticker and trusting whatever appears next.

Why Singapore Is a Prime Target

• High smartphone penetration: Over 90% of adults own a smartphone with a built-in QR scanner.
• SGQR everywhere: From hawker stalls to taxis, scanning codes is second nature.
• Trust in banks: Scammers impersonate DBS, OCBC, UOB and Standard Chartered because locals trust these brands.
• Multilingual population: Scammers tailor messages in English, Mandarin, Malay and Tamil.

How QR Code Scams Work in Singapore

Most quishing attacks follow a predictable four-step pattern. Understanding the flow is the single best defence.

1. Bait: A scammer places a malicious QR code in a believable context — a flyer offering free bubble tea, a sticker over the real payment code at a stall, or a WhatsApp message claiming to be from SingPost or IRAS.
2. Scan: The victim scans the code and is taken to a convincing fake website — often a near-perfect clone of a bank login page or a food-survey site.
3. Harvest: The victim is asked to "verify" credentials, install a third-party APK (Android app file), or grant accessibility permissions.
4. Drain: Once the scammer has login details, SMS OTPs, or remote control of the device, they empty bank accounts — sometimes within minutes.

Real Singapore Case Studies

These are not hypothetical. SPF advisories have documented:

• The bubble tea survey scam (2023–2024): A 60-year-old woman lost S$20,000 after scanning a QR code on a sticker outside a Tampines bubble tea shop promising a free cup for completing a survey.
• Fake PayNow hawker stickers: Scammers pasted their own PayNow QR over the real stall owner's code at coffeeshops in Hougang and Jurong, diverting payments.
• IRAS "tax refund" letters: Physical mail with a QR code claiming unpaid GST, leading to a cloned Singpass login page.
• Parking fine flyers: Fake notices left on windscreens in HDB carparks directing drivers to a fake LTA payment portal.

The Most Common Types of QR Code Scams

1. Sticker Overlay Scams

The simplest and most common attack. A scammer prints their own QR code sticker and pastes it directly on top of a legitimate one at a merchant, parking meter, or EV charger. Customers believe they are paying the business but are actually transferring money to a mule account.

2. Quishing Emails and SMS

Instead of a clickable link (which email filters now catch), scammers embed a QR code image inside an email or send one via WhatsApp. Common pretexts include:

• "Your DBS account will be suspended — scan to verify"
• "SingPost parcel delivery failed — scan to reschedule"
• "Your Singpass requires re-authentication"

3. Malicious App Downloads

Scanning the QR code redirects to a page offering an Android APK — disguised as a food delivery app, a government service, or even a cleaning service booking tool. Once installed, the app requests accessibility permissions and can read SMS OTPs, screen content, and banking credentials.

4. Fake Charity and Donation Codes

During festive periods like Chinese New Year, Hari Raya, Deepavali and Christmas, scammers distribute flyers with QR codes impersonating real Singapore charities such as the Community Chest or NKF.

5. Investment and Crypto Scams

Social media ads featuring local celebrities (often deepfakes of personalities like PM Lawrence Wong or businessman Peter Lim) direct users to scan a QR code to join an exclusive investment group on Telegram or WhatsApp.

Comparison: Legitimate vs Malicious QR Codes

Feature	Legitimate QR Code	Malicious QR Code
Destination URL	Official domain (e.g. dbs.com.sg, singpass.gov.sg)	Lookalike domain (dbs-sg-verify.com, singpass-login.net)
Placement	Printed directly on signage or menu	Sticker pasted over another code, loose flyer, unsolicited mail
Action Requested	Payment via your bank app showing merchant name	Login, OTP entry, APK download, or permissions grant
Urgency	None	"Act now", "Account suspended", "Limited time offer"
Merchant Name on Payment Screen	Matches the physical stall/business	Unknown individual or unrelated entity

How to Stay Safe: A Practical Checklist

Before You Scan

1. Inspect the code physically. Is it a sticker on top of another sticker? Peel back a corner — scammers frequently layer their code over the real one.
2. Ask the merchant. At a hawker stall, confirm the stall name with the auntie or uncle before paying.
3. Be suspicious of unsolicited codes. Anything received via WhatsApp, SMS, email, or physical mail should be treated as untrusted by default.
4. Avoid codes in high-pressure contexts. "Free gift", "last chance", "account locked" are all red flags.

After You Scan (Before You Act)

1. Preview the URL. Modern iPhone and Android cameras show the destination before opening. Read it carefully — check for misspellings like "dbsbank-sg.com" or unusual TLDs like .xyz, .top, .click.
2. Check the merchant name on PayNow/PayLah! If the recipient is a personal name instead of a registered business (UEN), stop immediately.
3. Never download apps from QR codes. Only install apps from the official Apple App Store or Google Play Store.
4. Never enter your Singpass, bank login, or OTP on a page you reached from a QR code. Open the official app manually instead.

Device and Account Hygiene

• Enable the Money Lock feature on your DBS, OCBC or UOB app — it ring-fences a portion of your savings so even compromised credentials cannot drain it.
• Turn on biometric login and disable SMS-only OTP where possible.
• Keep iOS and Android updated — most banking trojans exploit outdated devices.
• Install the ScamShield app from the National Crime Prevention Council.
• Use encrypted DNS (such as 1.1.1.1 or Quad9) on your home Wi-Fi to block known phishing domains at the network level.

How to Verify a Shortened or Suspicious URL

Many QR codes use URL shorteners to hide their final destination — this is normal for marketing but also abused by scammers. If a code reveals a shortened link, you can expand it safely before opening:

1. Copy the shortened URL from your camera's preview.
2. Paste it into a URL expander or preview tool before tapping it.
3. Check whether the expanded destination matches what you expected.

If you run a small business in Singapore and need to create your own trustworthy short links for marketing campaigns, menus, or event QR codes, platforms like Lunyb let you generate branded short URLs with click analytics and link previews — helping your customers trust that the link really came from you. You can read our honest Lunyb review or compare it against alternatives in our 2026 URL shortener buyer's guide.

What to Do If You've Been Scammed

Speed matters. The first 60 minutes after a scam are critical for recovering funds.

1. Lock your bank account immediately. Use the "Kill Switch" feature in your banking app (available on DBS, OCBC, UOB, Standard Chartered, Citibank).
2. Call your bank's 24/7 fraud hotline.
   • DBS/POSB: 1800-339-6963
   • OCBC: 1800-363-3333
   • UOB: 1800-222-2121
3. Report to the Singapore Police Force via the ScamShield app, the anti-scam hotline 1800-722-6688, or at police.gov.sg.
4. Factory reset your phone if you installed an unknown APK. Do not restore from a recent backup — it may reinstall the malware.
5. Change all passwords from a different, clean device — starting with Singpass, email, and banking.
6. Warn family and friends through your group chats. Scammers often target multiple victims from the same batch of stolen contacts.

Advice for SME Owners and Merchants

If you run a hawker stall, F&B outlet, or retail shop in Singapore, you have a duty to protect your customers from overlay scams.

• Laminate your SGQR code or place it behind acrylic so stickers cannot be pasted over it.
• Check your payment QR daily — especially at the start of each shift.
• Train staff to verify payment notifications on the stall phone before handing over goods.
• Display your UEN and registered business name next to the QR so customers can cross-check on PayNow.
• Use branded short links for digital menus and promotions so customers recognise your domain rather than random shortener strings.

The Role of MAS, SPF and Banks

Singapore has rolled out several industry-level defences:

• Shared Responsibility Framework (SRF): Launched by MAS and IMDA in late 2024, assigning liability between banks, telcos and consumers for phishing losses.
• Mandatory app shielding: All major banks now block logins if sideloaded apps with risky permissions are detected on Android.
• SMS Sender ID Registry: Legitimate organisations must register their sender IDs, so "DBS" or "IRAS" cannot be spoofed.
• 24-hour cooling period for new payees above certain thresholds on most retail banking apps.

These help — but the frontline defence is still you, the user.

Frequently Asked Questions

Are QR code scams really common in Singapore?

Yes. The Singapore Police Force has flagged quishing as one of the fastest-growing scam categories, with victims losing tens of thousands of dollars per incident. Hawker centres, carparks, and WhatsApp are the three most common delivery channels.

Is it safe to scan QR codes with my iPhone camera?

Scanning itself is safe — your camera simply reads the code and shows the URL. The danger comes from what you do next. Always read the preview URL carefully before tapping, and never enter credentials or download apps from a page you reached via QR.

How can I tell if a PayNow QR at a hawker stall is genuine?

After scanning, your bank app will display the recipient's name and UEN. It should match the stall's registered business name shown on their signboard or GST registration. If it shows an individual's personal name or a totally unrelated company, do not pay — alert the stall owner immediately.

What should I do if I already entered my Singpass or bank details on a fake site?

Act within minutes. Use your banking app's Kill Switch to freeze your accounts, call the bank's fraud hotline, reset your Singpass password at singpass.gov.sg, and file a police report via ScamShield or 1800-722-6688. The faster you move, the higher the chance of recovery under the Shared Responsibility Framework.

Do iPhones or Android phones protect against malicious QR codes?

Both iOS and Android show a URL preview before opening, which is your main line of defence. iPhones are generally safer against malicious app installs because Apple blocks sideloading. Android users should ensure "Install unknown apps" is disabled and that Google Play Protect is active.

Can a QR code hack my phone just by scanning it?

No — a QR code is just data, usually a URL. It cannot execute code on your phone by being scanned. The risk only materialises if you then visit the link, enter information, or install a file. Think of it like reading a billboard: looking at it is safe, acting on it may not be.

Final Thoughts

QR codes are not going away — they are too convenient, and Singapore's cashless infrastructure is built on them. The good news is that staying safe does not require technical expertise. It requires one simple habit: pause and verify before you tap. Read the URL preview, confirm the merchant name, never enter OTPs on pages you reached from a scan, and treat every unsolicited code as guilty until proven innocent.

Share this guide with your parents, grandparents, and colleagues — quishing victims in Singapore skew older, and a two-minute conversation over dinner could save a family member S$20,000.