Phishing Attacks in Singapore: How to Recognise and Avoid Them

Phishing has become the single most common cyber threat facing Singapore residents and businesses. According to the Singapore Police Force and the Cyber Security Agency of Singapore (CSA), scam-related losses crossed record highs in recent years, with phishing acting as the entry point for the majority of these cases. Whether it arrives as a text claiming to be from DBS, a WhatsApp message impersonating SingPost, or an email pretending to come from IRAS, the goal is always the same: trick you into handing over credentials, OTPs or money.

This guide explains how phishing attacks in Singapore work in 2026, the local scams you are most likely to encounter, and the practical steps you can take to protect yourself, your family and your business.

What Are Phishing Attacks?

Phishing is a form of social engineering in which attackers impersonate a trusted entity — a bank, government agency, employer or brand — to deceive victims into revealing sensitive information or performing a harmful action. The "bait" is typically a message that creates urgency, fear or excitement.

In Singapore, phishing has evolved far beyond poorly written emails. Modern attacks use polished local branding, Singlish phrasing, spoofed SMS sender IDs and even AI-generated voice calls. The Monetary Authority of Singapore (MAS), Infocomm Media Development Authority (IMDA) and ScamShield have rolled out multiple countermeasures, but criminals adapt quickly.

Common Types of Phishing

• Email phishing — Fake emails from banks, e-commerce platforms or government bodies.
• Smishing (SMS phishing) — Text messages with malicious links, often spoofing official sender IDs.
• Vishing (voice phishing) — Phone calls impersonating police, MAS officers or bank staff.
• Quishing (QR code phishing) — Malicious QR codes stuck over legitimate ones at hawker centres, carparks or EV chargers.
• Spear phishing — Highly targeted attacks against specific employees, often HR or finance staff.

Why Singapore Is a Prime Target

Singapore's high digital adoption, strong banking sector and affluent population make it attractive to cybercriminals operating from across the region. Several local factors amplify the risk:

• High PayNow and digital banking usage makes real-time theft easier.
• Multilingual population allows scammers to tailor attacks in English, Mandarin, Malay and Tamil.
• Trust in official institutions is weaponised through impersonation of SPF, IRAS, CPF, MOM and ICA.
• Cross-border messaging apps like WhatsApp and Telegram are heavily used for both personal and business communication.

The Most Common Phishing Scams in Singapore (2026)

Below are the phishing variants Singaporeans are most likely to encounter this year, based on advisories from the Singapore Police Force, CSA and major local banks.

1. Bank Impersonation Scams

Victims receive an SMS or email claiming suspicious activity on their DBS, OCBC, UOB or Standard Chartered account. The link leads to a near-perfect clone of the real banking site, which captures the user ID, password and OTP in real time.

2. Government Agency Impersonation

Messages claim to be from IRAS (tax refund), ICA (passport renewal), MOM (work pass issue) or SPF (ongoing investigation). The scammer pressures the victim to click a link, make a payment, or transfer funds to a "safety account".

3. Parcel Delivery Scams

Fake SingPost, Ninja Van, J&T or Shopee messages claim a parcel is held up due to an unpaid customs fee. The link harvests card details or installs malware on Android devices.

4. Job Scams on Telegram and WhatsApp

Victims are offered "part-time work" boosting app ratings or doing simple tasks. After small initial payouts, they are asked to top up money that is never returned. Phishing links are often used to steal banking credentials along the way.

5. Malicious QR Codes (Quishing)

Stickers are placed over legitimate QR codes at hawker stalls, parking meters or bubble tea shops. Scanning leads to a fake PayNow page.

Phishing Red Flags: What to Look For

The following signals should immediately raise suspicion, even if a message looks professional.

Red Flag	Example	Why It's Suspicious
Urgency or threats	"Your account will be frozen in 2 hours"	Real banks and agencies do not pressure you by SMS.
Unusual sender domain	dbs-secure-sg.com instead of dbs.com.sg	Slight misspellings and extra words are telltale signs.
Requests for OTP or password	"Please confirm your SMS OTP"	Legitimate staff will never ask for OTPs.
Shortened or masked links	bit.ly/dbs-verify	Hover or long-press to preview before tapping.
Unexpected attachments	Invoice.apk, Receipt.html	APK files can install banking trojans on Android.
Generic greetings	"Dear Valued Customer"	Your bank usually addresses you by name.

How to Verify a Suspicious Message

Before clicking, calling back or replying, run through this simple verification process.

1. Pause. Scammers rely on emotional reactions. Give yourself five minutes.
2. Do not use the link or number in the message. Open your banking app directly or type the official URL manually.
3. Check the sender. Look at the full email address or SMS sender ID. Singapore Gov SMS now uses the "gov.sg" sender for official notifications.
4. Call the organisation. Use the number on the back of your bank card or the official website.
5. Report it. Forward suspicious SMS to 9-SPAM (79-26-68) or report via the ScamShield app.

Protecting Yourself: Practical Steps

1. Lock Down Your Banking Apps

All major Singapore banks now offer a "Money Lock" feature that ring-fences a portion of your savings from digital transfers. Enable it, and also activate transaction alerts for every outgoing transfer.

2. Use Strong, Unique Passwords and a Password Manager

A reputable password manager (such as 1Password, Bitwarden or your device's built-in keychain) stops you from reusing credentials across sites. If one service is breached, others remain safe.

3. Enable Multi-Factor Authentication Everywhere

Use Singpass Face Verification, hardware security keys, or app-based authenticators instead of SMS OTP wherever possible. SMS is vulnerable to SIM swap attacks.

4. Keep Devices and Apps Updated

Many phishing campaigns rely on exploiting outdated Android versions. Turn on automatic updates and only install apps from the Google Play Store or Apple App Store — never through sideloaded APK links.

5. Install ScamShield

The ScamShield app, developed by the Singapore Police Force and Open Government Products, automatically blocks scam calls and filters suspicious SMS using a government-maintained list.

6. Inspect Shortened Links Before Clicking

Short links are convenient but also abused by scammers. Use a trustworthy link shortener for your own business communications so recipients learn to trust your branded domain, and use preview tools when you receive unknown short links. Services like Lunyb allow you to create branded short links with click analytics and privacy-respecting redirects — making your own marketing links easier for customers to verify. You can read our honest review of Lunyb or compare options in our 2026 URL shortener buyer's guide.

Phishing Protection for Businesses in Singapore

SMEs are increasingly targeted via business email compromise (BEC), where attackers impersonate a CEO, supplier or client to redirect payments. The Cyber Security Agency of Singapore recommends the following baseline controls.

Technical Controls

• Implement SPF, DKIM and DMARC on your email domain to stop spoofing.
• Enable advanced email filtering (Microsoft 365 Defender, Google Workspace security).
• Deploy endpoint detection and response (EDR) on all company devices.
• Use encrypted DNS resolvers to reduce exposure to malicious domains.
• Enforce multi-factor authentication for all staff accounts.

Human Controls

• Run quarterly phishing simulations and short training sessions.
• Publish a clear "verify before you pay" policy requiring a callback for any change in bank account details.
• Create an internal channel for staff to report suspicious emails without fear of blame.

Phishing Defence Comparison: Individuals vs SMEs

Control	Individuals	SMEs
Multi-factor authentication	Essential	Mandatory for all accounts
ScamShield / call filtering	Highly recommended	Recommended on corporate phones
Email authentication (SPF/DKIM/DMARC)	Not applicable	Essential
Phishing simulations	Optional	Recommended quarterly
Money Lock / payment controls	Highly recommended	Dual approval for payments
Device updates	Automatic updates on	Centrally managed via MDM

What to Do If You Have Been Phished

Speed matters. If you suspect you have clicked a phishing link or shared credentials, take these steps immediately.

1. Call your bank's 24/7 fraud hotline and request to freeze the account.
2. Change your passwords from a different, trusted device.
3. Revoke active sessions in your banking and email apps.
4. Lodge a police report online at eservices.police.gov.sg or at any Neighbourhood Police Centre.
5. Report to ScamShield and warn family or colleagues who may be targeted next.
6. Scan your device for malware; if an APK was installed, factory reset the phone.

The Future of Phishing in Singapore

Three trends are reshaping the threat landscape in 2026:

• AI-generated content — Flawless Singlish, Mandarin and Malay phishing messages are now trivial to produce.
• Deepfake voice and video — Scammers clone the voices of bosses and family members for urgent fund requests.
• Multi-channel attacks — A single campaign may start with an email, follow up with a WhatsApp message, then a phone call from a "MAS officer".

The defence is not any single tool, but a combination of skepticism, verification habits and layered technical controls.

Frequently Asked Questions

How do I report a phishing SMS or email in Singapore?

Forward suspicious SMS to 9-SPAM (79-26-68), report via the ScamShield app, or lodge a report at eservices.police.gov.sg. Phishing emails impersonating your bank can also be forwarded to the bank's dedicated reporting address (for example, phishing@dbs.com).

Will my bank refund me if I fall for a phishing scam?

Under the Shared Responsibility Framework introduced by MAS and IMDA, banks and telcos may bear part of the loss if they failed in their duties — for example, not sending required alerts. However, if you willingly disclosed your OTP or password, recovery is not guaranteed. Reporting quickly gives you the best chance.

Are shortened links always dangerous?

No. Shortened links are widely used by legitimate businesses, government agencies and marketers. The risk comes from the destination, not the format. Use a reputable shortener for your own communications, and preview unknown short links before clicking.

Is SMS OTP still safe for banking in Singapore?

SMS OTP is better than nothing, but increasingly vulnerable to SIM swap and real-time phishing. Where possible, switch to Singpass Face Verification, in-app approvals, or hardware security keys for stronger protection.

How can I teach elderly family members to spot phishing?

Keep the rules simple: never click links in SMS or WhatsApp, never share OTPs with anyone — including "bank staff" or "police" — and always call a family member before transferring money. Install ScamShield on their phone and enable Money Lock on their savings account.

Final Thoughts

Phishing attacks in Singapore are no longer clumsy, grammatically broken emails. They are polished, localised and multi-channel operations that exploit trust in institutions and emotional pressure. The good news is that the core defence has not changed: slow down, verify through an independent channel, and never share credentials or OTPs. Combine those habits with multi-factor authentication, updated devices and tools like ScamShield, and you will block the overwhelming majority of attacks before they ever reach your wallet.