QR Code Scams in Singapore: How to Stay Safe in 2026

QR codes are now woven into everyday life in Singapore — from PayNow transfers at hawker centres to SafeEntry-style check-ins, parking payments, restaurant menus and even charity donations. Unfortunately, scammers know this too. The Singapore Police Force (SPF) and Monetary Authority of Singapore (MAS) have repeatedly warned that QR code scams (also called "quishing") are one of the fastest-growing fraud categories targeting Singaporeans.

This guide explains exactly how QR code scams work in a Singapore context, highlights real cases reported locally, and gives you a practical checklist to stay safe — whether you're paying for bubble tea at a kopitiam or scanning a parking coupon at an HDB carpark.

What Are QR Code Scams?

A QR code scam is a type of phishing attack where fraudsters use a malicious QR code to redirect victims to a fake website, trigger an unauthorised payment, or trick them into downloading malware. Because the destination URL is hidden inside a pixel pattern, victims cannot easily tell where the code leads until it's too late.

In Singapore, the most common variants involve fake PayNow QR codes, fake parking.sg stickers, fake "lucky draw" codes on flyers, and QR codes sent via WhatsApp or SMS impersonating banks like DBS, OCBC and UOB.

Why Singapore Is a Prime Target

High smartphone penetration: Over 90% of adults use mobile payments daily.
QR-first payment culture: SGQR, PayNow and PayLah! have normalised scanning without thinking.
Trust in official-looking materials: Scammers exploit familiar branding from HDB, LTA, SingPost and local banks.
Cross-border fraud networks: Many scams are operated overseas, making recovery difficult.

How QR Code Scams Work in Singapore

Quishing follows a predictable pattern. Understanding each step helps you spot red flags early.

Placement: The scammer places a malicious QR code where victims expect to see a legitimate one — stuck over a real parking sign, printed on a fake flyer, or sent through messaging apps.
Trigger: A sense of urgency or reward is created ("Scan to claim your $50 NTUC voucher", "Pay your fine now to avoid court").
Redirect: Scanning opens a convincing fake site — often mimicking Singpass, DBS digibank, or the SPF website.
Harvest: Victims are asked to enter banking credentials, OTPs, or install an APK file that gives scammers remote control of the phone.
Drain: Within minutes, funds are transferred out, usually to overseas mule accounts.

Real QR Code Scam Cases Reported in Singapore

1. The Bubble Tea Survey Scam

In 2023, a 60-year-old woman lost over S$20,000 after scanning a QR code on a bubble tea shop flyer offering a free cup for completing a survey. The code led her to download a third-party app that intercepted her banking OTPs.

2. Fake Parking.sg Stickers

Scammers have been caught pasting fake QR stickers over genuine parking signs in HDB carparks and public lots, directing drivers to copycat payment pages that steal card details.

3. "Police Investigation" Quishing

Victims receive a WhatsApp message with a QR code claiming to be from SPF or CPIB. Scanning leads to a fake Singpass login, harvesting credentials that are later used to take over real accounts.

4. Hawker Stall PayNow Swaps

At some hawker centres, scammers have physically replaced the stall's PayNow QR with their own, pocketing payments for hours before the stallholder notices.

Common Types of QR Code Scams to Watch For

Scam Type	Where You See It	What Scammers Want
Fake PayNow / SGQR	Hawker stalls, markets, pop-up events	Redirect your payment
Fake Parking QR	HDB and URA carparks	Credit card details
Phishing SMS / WhatsApp	Messages impersonating banks, SPF, IRAS	Singpass or banking logins
Survey & Free Gift	Flyers, stickers on tables, shop windows	Install malicious APK
Fake Donation QR	Charity collectors, disaster appeals	Divert donations
Delivery / Parcel QR	Fake SingPost or Ninja Van notices	Card details, OTPs

10 Ways to Stay Safe from QR Code Scams

1. Always Preview the URL Before Opening

Most modern smartphones (iOS and Android) show a preview of the link after scanning. Pause and read it. Look for subtle misspellings like dbs-sg.com, singpass-login.net, or paynowsg.xyz — none of these are legitimate.

2. Check the Domain, Not Just the Brand Name

Real Singaporean government and bank domains end in .gov.sg or the bank's official .com.sg. Anything else should be treated with suspicion.

3. Never Install Apps via QR Code Links

Legitimate apps are always downloaded from the Apple App Store or Google Play Store. If a QR code prompts you to install an APK or "update" an app directly, it is almost certainly malware.

4. Inspect Physical QR Codes for Tampering

Before scanning at a hawker stall, carpark, or shop, check whether the QR sticker looks pasted over another one. Peeling edges, mismatched printing, or codes that don't match the surrounding branding are red flags.

5. Verify PayNow Recipient Names Carefully

After scanning a PayNow QR, the recipient's registered name appears before you confirm payment. If you're paying "Ah Hock Chicken Rice" but the name shows an unrelated individual or company, stop immediately.

6. Use a Safe Link Checker

When in doubt, copy the URL (don't open it) and paste it into a safe link checker. Services like Google Safe Browsing, VirusTotal, or the link-preview tools offered by trusted shorteners can flag known phishing domains before you visit.

7. Use a Trusted URL Shortener for Your Own QR Codes

If you're a business or event organiser creating QR codes, use a reputable shortener so customers can trust the destination. Platforms like Lunyb offer privacy-first short links with click analytics and the option to disable tracking — making your QR codes both safer and more transparent. See our honest review of Lunyb for details.

8. Enable Transaction Alerts and Lower Transfer Limits

Set your DBS, OCBC, UOB or PayLah! app to send instant alerts for every transaction. Reduce your daily PayNow and FAST transfer limits to a level that matches your real usage — scammers can't drain what they can't transfer.

9. Turn On the Money Lock / Safety Switch

Singapore banks now offer features like DBS digiVault, OCBC Money Lock and UOB LockAway Account. These "lock" a portion of your savings so even stolen credentials can't move the funds digitally.

10. Report Suspicious QR Codes Immediately

If you encounter a suspicious QR code in public, report it to the venue operator and to the SPF via the ScamShield app or 1800-722-6688. If you've already scanned and shared details, call your bank's 24-hour anti-scam hotline right away.

What to Do If You've Already Been Scammed

Call your bank immediately — DBS (1800-339-6963), OCBC (1800-363-3333), UOB (1800-222-2121). Every minute counts.
Freeze affected accounts and request a chargeback for card transactions.
Change your Singpass password and revoke app authorisations at singpass.gov.sg.
File a police report online via the SPF e-services portal or at any Neighbourhood Police Centre.
Submit a report to ScamShield so the malicious URL and number can be blocked for others.
Scan your phone for malware and factory reset if you installed any suspicious app.

How Businesses in Singapore Can Protect Customers

If you run a café, retail shop, event, or any operation that uses QR codes, you share responsibility for customer safety.

Laminate and seal your QR codes so tampering is visible.
Check your QR displays daily — especially PayNow stickers and payment terminals.
Use a branded short link so customers recognise your domain. Tools reviewed in our Rebrandly vs Lunyb comparison explain the trade-offs.
Display your business UEN near the PayNow code so customers can verify before paying.
Train staff to spot replaced stickers and flag unusual customer screenshots.

The Future of QR Code Security in Singapore

MAS and the Association of Banks in Singapore (ABS) are rolling out additional safeguards, including the Shared Responsibility Framework for scam losses, mandatory kill switches across all retail banks, and tighter controls on app sideloading on Android. Google has already restricted the installation of apps from unknown sources that request sensitive permissions in Singapore — a direct response to quishing attacks.

Still, technology alone won't solve the problem. The weakest link remains human behaviour: a split-second decision to scan, trust and tap. Building the habit of pausing before every scan is the single most effective defence.

Frequently Asked Questions

Are QR code scams common in Singapore?

Yes. The Singapore Police Force has reported hundreds of millions of dollars in losses linked to phishing and malware scams, with QR-code-based attacks (quishing) forming a growing share. Cases have been recorded at hawker centres, carparks, and through impersonation messages on WhatsApp and SMS.

Is it safe to scan QR codes at hawker centres?

Generally yes, but always verify the recipient name shown in your PayNow or PayLah! app before confirming payment. If the name doesn't match the stall, cancel the transaction and pay cash or ask the stallholder to show you their official QR directly.

Can scanning a QR code alone hack my phone?

Simply scanning a QR code does not install malware on its own. The danger comes from what happens next — visiting a phishing site, entering credentials, or downloading an APK file. If you scan a code and immediately close the preview without tapping anything, you're safe.

How do I report a QR code scam in Singapore?

Report via the ScamShield app, call the Anti-Scam Hotline at 1800-722-6688, or file a police report through the SPF e-services portal. If money has been transferred, call your bank's 24-hour hotline first — the faster you act, the higher the chance of recovery.

Are branded short links safer than raw QR codes?

Branded short links from trusted providers add a recognisable domain (e.g. yourshop.ly) that customers can visually verify. They also let businesses update the destination without reprinting QR codes, and provide click analytics to detect suspicious scanning patterns. Just make sure the shortener itself is reputable and privacy-respecting.