SINGAPORE — Scammers have branched out to include the use of QR codes to trick victims, with police warning of two new scams involving the barcode.
Sengkang District Police Center (NPC) on Wednesday (February 23rd) warned of a scam involving a printed leaflet of a Grab food voucher and a QR code. The QR code leads to a request for personal data.
Grab clarified that he did not create the flyer and does not have promotions that require users to scan a QR code to redeem vouchers, the NPC said.
It comes after police said on Tuesday that a Singpass QR code scam has surfaced in which victims are asked to complete surveys in exchange for a monetary reward.
The scammers would send victims a Singpass QR code claiming that the victims had to verify their identity and accept the rewards, but the QR code is, in fact, a screenshot of a legitimate online service seeking authentication.
Many websites, including those of government agencies, telecommunications companies, insurance companies, and banks, authenticate their services using Singpass.
By scanning the QR code and authorizing the transaction, victims would be tricked into giving scammers access to these online services.
Straits Times observers said QR code scanning alone is safe when transactions on websites and checkout counters are user-initiated, but they urged the public to exercise caution and do not scan a QR code sent by an unknown person on a messaging platform.
Mr. Amos Tan, Deputy Principal of Singapore Polytechnic’s School of Business, told ST that customers might be afraid to transact online, but it shouldn’t affect merchants’ sales as they can switch to other other payment methods.
“Scammers tend to switch from one form of payment or method of collecting personal data to others once the method has been widely reported and people know to watch out for them… I don’t think sales will be affected, but the method of transactions could be, depending on where they take place,” he said.
Mr. Tan added that businesses could offer customers who are wary of paying online the option to transact in person.
They could also alert customers to phishing scams and send messages to remind them that the company would not ask for personal details over the phone, he said.
Payment platforms contacted by ST urged users of the QR code feature to verify beneficiary or merchant details and the transaction amount before authorizing payment.
Mr. Keith Chen, managing director of payment app Fave, said it was a shame that scammers are using a handy tool to deceive consumers.
He advised Fave users to scan QR codes using only the Fave app in physical stores with cashiers or on Fave merchants’ online websites.
“We strongly recommend customers not to interact with QR codes that are shared via chat platforms from unauthorized or unknown contacts,” Chen said.
Similarly, a spokesperson for Grab said the company would never send QR codes to users via SMS or messaging platforms.
The spokesperson urged users to look for signs of a potential phishing scam, such as an urgent call to action, the promise of enticing rewards, and suspicious links or attachments, including QR codes from from unexpected or first-time senders.
Grab uses artificial intelligence, machine learning and experts to analyze and detect fraudulent or fraudulent content to remove fake posts or illegal content, the spokesperson added.
Grab users can call the company’s Fraud Hotline at 6902-1036 if they’re unsure about a message they’ve received.
How to avoid falling prey to a Singpass QR code scam
- Never scan a Singpass QR code sent by someone else, police say. Scan the Singpass QR code only on the official website of the e-service you want to access, or tap the Singpass QR codes on the official apps of these e-services.
- Always check with official sources if the information you have received is sent by the organization and if authentication using the Singpass app is required.
- After scanning a Singpass QR code, always check the consent screen on the Singpass app to verify the digital service. Make sure that the domain URL displayed on the Singpass app matches that in the browser’s address bar.
- Never give out your Singpass ID, password and two-factor authentication (2FA) information to third parties.
Suspicious activity can be reported to the Singpass Helpline by calling 6335-3533.
Those with information relating to such crimes can call the police hotline at 1800-255-0000, or visit the police office. I-Witness website.
If urgent police assistance is required, call 999.
This article was first published in The time of the straits. Permission required for reproduction.