Scammers now using QR codes to fool victims

Scammers are now using QR codes to dupe victims, with the police warning the public of two new scams involving this method.

The police said on Tuesday that a Singpass QR code scam had surfaced in which victims are asked to fill out surveys in exchange for a monetary reward.

The scammers would send victims a Singpass QR code claiming that the victims had to verify their identity to get the reward, but the QR code is in fact a screenshot from a legitimate online service seeking authentication.

Many websites - including those of government agencies, telecoms companies, insurance firms and banks - authenticate their services using Singpass.

By scanning the QR code and authorising the transaction, victims would be tricked into giving the scammers access to these online services.

Separately, Sengkang Neighbourhood Police Centre yesterday warned of a scam involving a printed flier of a Grab food voucher giveaway and a QR code.

The QR code leads to a request for personal details.

Grab clarified that it did not produce the flier and does not have promotions which require users to scan a QR code to redeem vouchers, said the police centre.

Observers told The Straits Times that while QR code scanning is safe when transactions on websites and cashier counters are initiated by the user, they urged the public to exercise caution and never scan a QR code sent by an unknown person on a messaging platform.

Singapore Polytechnic's School of Business assistant director Amos Tan said: "Scammers tend to move from one form of payment or method of collecting personal data to others once the method has been widely reported on and people know to look out for them."

He added that businesses could offer customers who are fearful of paying online the option of transacting in person.

"I don't believe sales will be affected but the method of transactions might be, in terms of where they take place," he said.

Businesses could also alert clients to phishing scams and send out messages to remind them that the company would not ask for personal details over the phone, he added.

Payment platforms which ST contacted urged users of the QR code function to check the beneficiary or merchant details and the transacted amount before authorising payment.

Mr Keith Chen, general manager of payment app Fave, said it was a shame that scammers are using a convenient tool to trick consumers.

He advised Fave users to scan QR codes using only the Fave app at physical stores with cashiers or on the websites of Fave's merchants.

"We highly recommend that customers do not engage with QR codes that are shared via chat platforms from unauthorised or unknown contacts," added Mr Chen.

A spokesman for Grab similarly said that the company will never send users QR codes via SMS or messaging platforms.

The spokesman urged users to look for signs of a potential phishing scam, such as an urgent call to action, the promise of attractive rewards and suspicious links or attachments, including QR codes from unexpected senders.

Grab users can call the company's fraud helpline on 6902-1036 if they are unsure about a message they have received.