Beware of new Singpass QR code scam

SINGAPORE - People have been duped into scanning Singpass QR codes that grant scammers login access to various digital services in a recent bout of online survey scams.

Victims were often lured with the promise of monetary rewards for taking part in a survey purportedly conducted on behalf of reputable companies or organisations.

They were recruited through online forums and e-commerce sites, and contacted by the scammers via WhatsApp, the police said on Tuesday (Feb 22).

Upon completing bogus surveys that had been created by the scammers, victims would be asked to scan a Singpass QR code with their Singpass app as part of the "verification process".

They were told that this would retrieve their survey results so the reward could be paid out.

However, the Singpass QR code was a screenshot taken from a legitimate website, and by scanning the QR code and authorising the transactions without further checks, victims could give scammers access to online services.

Scammers exploited the access by registering businesses, subscribing for new mobile lines or opening new bank accounts in the victims' names.

Victims would realise something was amiss only when they were notified of these transactions by their telecommunications service provider or bank, or when they received notifications in their Singpass inbox that their personal details had been retrieved.

[[nid:205559]]

The police warned against scanning Singpass QR codes sent by someone else, adding that Singpass will never send QR codes through non-official messaging platforms such as WhatsApp or SMS.

Information received should also be verified with official sources, and people should also check with the relevant organisations if the transaction involves authentication using the Singpass app, said the police.

Also, after scanning a Singpass QR code, people should always check the consent screen on the app to verify the legitimacy of the digital service that is being accessed. This means that the domain URL displayed in the app should match that in the browser address bar.

The police also reminded people to never disclose their Singpass ID, password and two-factor authentication details to others.

Any suspicious activities should be reported to the Singpass helpdesk on 6335-3533 immediately.

Those who wish to provide any information related to such scams are also advised to call the police hotline on 1800-255-0000, or submit it online at this website.

For scam-related advice, they may also call the anti-scam helpline on 1800-722-6688 or go to this website.

This article was first published in The Straits Times. Permission required for reproduction.