The man clicked on an advertisement that brought him to a website that prompted him to enter his credit card information. — Photo: Lianhe Zaobao/The Straits Times/ANN
SINGAPORE: A man was duped into an online payment of US$39.99 (RM179 or S$53) on Sunday after he used a third-party app to scan a legitimate QR code while trying to recycle his clothes at a recycling machine.
Lianhe Zaobao reported on Friday that a resident in Ang Mo Kio Avenue 10, who gave his name only as Liu, brought his old clothes to the SG Recycle machine near his home on Sunday morning.
He used a third-party app to scan the QR code displayed on the machine with the intention of downloading the SG Recycle app. Instead, he clicked on an advertisement that brought him to a website that prompted him to enter his credit card information.
The 57-year-old said he entered his personal information as he believed the rewards for recycling old clothes would be credited to his card account.
He had only realised he had been duped when the website showed that US$39.99 was charged to his credit card for a premium membership. It is not known what the membership is for.
Liu then called his bank to deactivate his credit card and made a police report.
In response to queries from The Straits Times, SG Recycle’s marketing manager Sim Wei Liang said that the company is aware of this incident and another similar incident in April.
“We checked our website, our app and the physical machine QR codes, and found them to be secure,” said Sim.
“It is purely a third-party app issue that affects Android users who downloaded apps that contain advertisements. The QR codes on our machines are not compromised and direct users to the correct app download on Google Play or Apple App stores.”
The company operates a network of robotic waste collection machines across Singapore that allows users to recycle paper, textile and electronic waste in exchange for points that can be redeemed for cash rewards.
Sim said that customers do not need to pay any fees to use the SG Recycle app, and that users will only need to provide their phone number when signing up for an account.
The company also reminded users to be cautious of third-party apps that contain advertisements, to use trusted apps such as Google Lens or the iPhone QR scanner, and to report errant apps to Google to help prevent other users from falling for such scams in the future.
While phone cameras these days are capable of scanning QR codes, scanner apps are still in use and scammers are creating fake scanning apps that install malware on users devices when downloaded, said Steven Scheurmann, Asean regional vice-president of cybersecurity company Palo Alto Networks.
“Once the fake app is downloaded, threat actors can obtain users’ sensitive information and credentials, gain access to their accounts, or potentially move laterally within the network to infect other devices,” said Scheurmann.
Some telltale signs of a fake QR code scanning app include little to no reviews on it, the lack of or a poorly written app description, and if the app asks for extensive permission such as viewing and controlling the users’ screen, said Scheurmann.
An app that requires an update as soon as it is downloaded could indicate malware being installed, he added.
On Sunday, it was reported that a woman lost over S$20,000 (RM67,137) after she scanned a QR code pasted on the glass door of a bubble tea shop, which promised customers a free cup of milk tea after they complete an online survey.
She was prompted to download a third-party app onto her Android phone, which allowed scammers to take over her device and move the money from her bank account.
ST has contacted the police for comment. – The Straits Times (Singapore)/Asia News Network
