QR Code Scams: How to Scan Safely

Did you know? A QR code on a printed poster may look perfectly ordinary, yet send you to the wrong website. That does not mean the squares themselves are malicious. It means someone may have chosen a dangerous destination—or replaced a legitimate code with their own sticker. The safest defence begins with understanding what a scan actually does.

Quick answer: a QR code is a way of carrying information, often a web address. Your camera decodes that address, and your phone may offer to open it. QR-code scams work when criminals use that convenience to lure people to imitation websites, fake payment screens or harmful downloads. Check the source, preview the destination and verify requests for money or credentials through official channels.

The 30-second QR code safety check

Look at the code: does it belong there, or is a suspicious sticker covering the original?
Look at the preview: what exact domain is the phone about to open?
Look at the request: is the page suddenly asking for a password, one-time code, bank details or app installation?
Verify independently: open the official app or type a trusted website yourself rather than following an unexpected prompt.
Stop if uncertain: there is no need to complete a scan just because a poster says it is urgent.

What happens between scanning and getting into trouble?

It helps to separate three actions. First, the camera reads the code. Second, your phone may open a destination, such as a website. Third, you may interact with that destination by signing in, downloading something or making a payment. These are not the same event.

A normal QR code does not secretly acquire your bank password simply because you pointed your camera at it. Many scams depend on tricking people into taking an additional step. A fake login page might ask for credentials; a fake payment page might ask for card details; a bogus warning might pressure someone into installing an untrusted app. Keeping your device updated also matters because malicious content can exploit software weaknesses.

That is why the best security habit is to insert a decision between reading the code and trusting the destination. The camera is a reader, not an investigator.

Scam example 1: the sticker placed over a real code

Imagine a payment QR code at a parking machine or café counter. The original code is legitimate. Someone places another printed sticker directly over it. The replacement code might point to a convincing imitation of the payment service or redirect the transaction elsewhere.

The lesson is visual: inspect the physical sign before using it. Look for peeling edges, mismatched printing, crooked stickers or codes that appear newly pasted over older ones. If the sign looks altered, ask staff or use the business’s official payment channel. A neat-looking sticker is not proof of legitimacy either; context and independent verification matter.

Scam example 2: ‘Your parcel cannot be delivered’

A message arrives unexpectedly: ‘Delivery failed. Scan this code now to update your address.’ It includes a QR image and a deadline. The design uses a familiar courier colour scheme. The trick is urgency: the sender wants you to act before checking whether the request is real.

Instead of scanning the message, open the delivery firm’s official app or type its established website into your browser. Find the shipment there using information you already have. This avoids treating an unsolicited QR code as an authority.

Scam example 3: a fake school or event form

A student might encounter a QR code for class registration, excursion permission or event attendance. Most are ordinary and helpful. But if a page unexpectedly demands a personal banking login or requests a one-time password, the form is behaving unlike its stated purpose.

Ask a teacher or organiser to confirm the exact official address through a known channel. The same rule applies to parents paying for school activities: verify the payee, purpose and amount inside the actual payment app before approving anything.

How to read a web address correctly

Scammers often rely on the fact that people recognise logos more quickly than URLs. A page can display a bank logo and a familiar-looking layout while living on an unrelated website. Before opening the link, read the address preview. Watch for spelling changes, extra words, odd domains and unexpected short links.

For example, school.example.org is not the same address as school.example.org.fake-site.test. The important registered domain is different. The prefix can be designed to look reassuring, so do not judge only the first few characters.

A padlock or https can indicate an encrypted connection to the displayed site, but it does not establish that the organisation behind the site is honest. Scam sites can use HTTPS too. If you cannot recognise the address, reach the service through a known official website or app instead.

QR-code payments: add one more check

In Singapore, scanning a QR code may start a PayNow or other wallet-payment flow. The familiar process can make us rush: scan, tap, done. But the final confirmation screen deserves attention.

Use your bank or payment provider’s official app rather than software promoted by an unexpected QR code.
Inspect the recipient or merchant details displayed by the app.
Confirm the payment amount and purpose before approving.
Do not disclose banking passwords, security codes or one-time passwords to a page that appeared unexpectedly.
If the merchant’s displayed details seem wrong, cancel and confirm with staff using a trusted method.

For Singapore-specific examples of QR payments and their normal workflow, see eduKateSG’s How Singapore Connects | PayNow, QR Codes and Everyday Payments. Understanding the legitimate path makes unusual steps easier to notice.

Why even a once-safe QR code can become risky

Some printed codes lead to a short link managed by a service. The service may redirect to a new destination later without changing the paper. This is useful for information updates, but it means the destination can change after the sign was printed. A code that worked yesterday does not guarantee that the site is equally trustworthy forever.

The most robust habit is therefore not ‘I scanned this before, so it is safe.’ It is ‘What does this code point to now, and does the request make sense?’

What should you do after a suspicious scan?

If you scanned the code but did not open anything

Close the preview and avoid the link. You can report or confirm the suspicious sign with the organisation concerned. Reading a code alone is not the same as submitting personal information.

If you opened a website but entered no details

Close the page, do not approve unexpected prompts or downloads and keep the device’s operating system and apps updated. If something unusual happened, such as an installation request or unexpected permissions, seek technical support from a trusted source.

If you typed a password or one-time code

Act promptly. Go directly to the legitimate service through its official website or app, change the affected password, review account security and enable strong multi-factor protection where available. If the same password was reused, change it on other affected accounts too.

If you entered payment details or sent money

Contact your bank or payment provider immediately using its official contact channel. Review transactions, secure your account and report the suspected scam to the relevant authorities. In Singapore, you can use ScamShield and the 24/7 ScamShield helpline 1799 for scam-checking guidance. For urgent unauthorised transactions, contact the bank directly first.

A five-minute family or classroom practice

Take two sample web addresses, one clearly familiar and another deliberately different in spelling. Without visiting either, ask the learner to identify the real domain and the parts designed to mislead. Next, show a picture of a normal printed QR code and one with a visibly overlaid sticker. Discuss what you would check before scanning.

The aim is not to make everyone afraid of technology. It is to teach a small, repeatable pause between a convenient action and an important decision. Students can explain their reasoning aloud: ‘I know what this code is supposed to do. I know who provided it. I can see where it leads. The request matches the purpose.’

Questions people often ask

Is every unknown QR code dangerous?

No. Most are simple ways to share information. But unfamiliar or unexpected codes should not be trusted automatically, especially when money or account access is involved.

Can scanning a code install malware?

The QR pattern typically contains data such as a link. The risk arises from what a device or user does with that data, including visiting harmful content or approving untrusted downloads. Up-to-date devices and cautious behaviour reduce exposure.

Does a verified-looking logo make a code safe?

No. Logos can be copied. Confirm the actual website and request through an independent official source.

How can I check a suspicious QR code in Singapore?

Use official advice and checking tools from ScamShield, or call 1799 when uncertain. Do not send passwords or other sensitive information to strangers claiming to verify a code.

The idea to remember

Scan the squares, then check the destination. Convenience is useful; unexamined trust is the vulnerability. A few seconds of verification can prevent a much longer problem.

Complete the series with How a Square Stores Words, Links and Numbers, Why a Damaged Code Can Still Scan and Static vs Dynamic QR Codes Explained.

Sources and further reading

Explore the How QR Codes Work series

Each guide explains a different part of the same everyday technology. Choose what you would like to understand next.

How QR Codes Work | Scan Safely and Spot QR Code Scams