PayNow and SGQR: how the unified QR works and where the risks are

SGQR is Singapore's unified payment QR code: a single label brings several payment schemes together, and PayNow is the most widely accepted of them. The risks documented by the authorities come from three directions: tampered QR codes, QR codes sent by scammers mid-deal and fake websites. The core defence is always the same: check the payee's name before confirming. In online commerce, the QR code shown at checkout plays the role of the label and needs the same protection.

How the unified QR code works

SGQR was launched on 17 September 2018 by the Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority (IMDA). The idea was simple: instead of a counter covered in stickers for every wallet and bank, the merchant shows one label carrying the logos of the schemes it accepts. At launch, 27 schemes signed up, including PayNow, NETS and GrabPay.

PayNow, the banks' instant transfer service, adopted the SGQR specifications on 11 November 2019, according to the Association of Banks in Singapore (ABS). To get paid, a business registers its UEN (Unique Entity Number) as its PayNow proxy and links that proxy to the label. The customer scans with their own banking app, checks the merchant name, enters the amount and pays. The basic offering is a static QR code; dynamic codes, carrying an amount and reference for each charge, can be arranged with the bank.

Adoption is broad. In a parliamentary reply in October 2022, the government reported around 5.5 million bank accounts registered with PayNow and more than 210,000 merchants accepting SGQR, over 90% of the total.

Where the documented risks are

• Tampered QR codes: in May 2023, the Cyber Security Agency (CSA) and the Singapore Police Force (SPF) warned in a joint advisory that QR codes displayed by businesses were being altered to divert payments to scammers' accounts. The same advisory covers QR codes that lead to phishing sites or malware downloads.
• QR codes sent by the scammer: in June 2026, the SPF warned about concert ticket scams on social media, with at least 14 cases; victims were told to pay by PayNow or by scanning a PayNow QR code sent by the fake seller.
• Fake PayNow website: in December 2024, police warned about messages claiming a PayNow certificate was about to expire. The link led to a page asking for card details. PayNow has no website for that kind of registration.

There is a nuance worth noting: according to the same parliamentary reply, scams involving fake payment QR codes and customers who pretended to have paid added up to 20 cases from 2020 to the first half of 2022, and were not considered prevalent. The risk is real, but good habits on both sides still go a long way.

Why the online checkout is the new label

Official consumer guidance comes down to one habit: checking that the merchant name shown in the banking app matches the name printed on the label. SGQR rules also require merchant acquirers to teach merchants how to verify payments and protect the label against fraud.

An online store has no physical label. The PayNow QR code is generated by the store's or payment provider's system and displayed in the buyer's browser, alongside everything else the page loads: plugins, marketing tools, chat widgets, third-party scripts. Malicious code on that page can replace the QR code with another valid one, for the same amount, pointing to a registered UEN with a plausible name. The buyer checks a name that looks right and confirms. The store is not paid, and the customer is certain they paid.

In the card world, this blind spot is already covered by rules: PCI DSS requirements 6.4.3 and 11.6.1 call for controlling payment page scripts and detecting unauthorised changes to what reaches the browser. The PCI Security Standards Council published dedicated guidance on these two requirements in March 2025. The same logic applies to a PayNow QR code.

A checklist for merchants accepting PayNow online

1. Use a dynamic QR code per order, with an amount and reference, and reconcile each credit against that reference.
2. Show your registered name and UEN as text next to the QR code, and ask customers to check that the name in their banking app matches exactly.
3. Release orders only on confirmed payment from your bank or provider, never on a screenshot. MAS advises checking for a successful payment notification before releasing goods.
4. Tell customers your store never sends QR codes by message or social media and never asks for card details to “activate” PayNow.
5. Cut the scripts on your checkout and keep platform, theme and plugins up to date, removing anything unused.
6. Monitor the live payment page, comparing the QR code on screen with the one your system issued.
7. If you suspect fraud, contact your merchant acquirer immediately, as MAS advises, and point customers to the ScamShield Helpline on 1799.

To see what can be swapped in a PayNow charge, and what lies beyond the reach of any on-page protection, read about protection for PayNow and SGQR.

Proteside checks, in the buyer's browser, that the SGQR code, PayNow identifier and amount shown at checkout are exactly the ones your store issued, and blocks any swap before the payment is confirmed, alerting you and generating PCI DSS evidence. It works with any e-commerce platform and payment provider. Try it free for 14 days.