Scam alert: Police warn of fake surveys asking participants to scan Singpass QR codes

SINGAPORE — The police warned that people are creating fake surveys to deceive victims into scanning Singpass QR verification codes and unknowingly granting the scammers access to digital services.

With that access, the scammers would then register businesses, subscribe for new mobile phone lines or open new bank accounts under the victim’s name.

Singpass is the national identity authentication system that allows users to verify their identity when they log in or sign up for digital services by the Government or private sector organisations.

In their advisory issued on Tuesday (Feb 22), the police said: “Singpass will never send QR codes through SMS, messaging apps like WhatsApp and other non-official messaging platforms.”

In reports of this new form of scam, the culprits would get people to take part in their fake survey through online forums or e-commerce sites.

They would say that the surveys are being conducted on behalf of reputable companies or organisations in Singapore.

They would typically communicate with victims through messaging platform WhatsApp and promise monetary rewards to people who do the survey.

When victims have completed the surveys, the scammers would send them a screenshot of a Singpass QR code, telling them that they have to scan it to verify their identity in order to receive the rewards.

These QR codes would have been taken off legitimate websites. So, when the victim scans them and unintentionally authorises the transaction without checking, the scammers would gain access to certain online services.

The police said that the victims would realise that something was amiss when they received notifications in the inbox of the Singpass app, notifying them that their personal details had been retrieved.

The police urged members of the public to stay vigilant against similar online scams.

They may protect themselves by: 

• Never scanning any Singpass QR code sent to them by someone else. Only scan the Singpass QR code on the official website of the e-service that they want to access, or tap on the Singpass QR codes on the official apps of these e-services
• Always verifying with official sources on whether the information they have received is sent by the organisation and whether the transaction involves authentication using the Singpass app
• Always checking the consent screen on their Singpass app to verify the legitimacy of the digital service they are accessing after scanning a Singpass QR code. Ensure that the domain URL or online address displayed on their Singpass app matches that in the website address bar of the browser. Otherwise, do not tap on the "Log In" button on the consent screen