Phishing Attacks in Singapore: How to Recognise and Avoid Them in 2026

Phishing attacks in Singapore have become one of the most financially damaging cybercrimes facing residents and businesses. According to the Singapore Police Force's annual scam statistics, phishing-related losses regularly cross hundreds of millions of dollars, with victims ranging from retirees receiving fake SingPost delivery notices to executives tricked by cloned DBS login pages. This guide explains how phishing works locally, the specific tactics scammers use against Singaporeans, and the practical habits that stop you from becoming the next headline.

What Are Phishing Attacks?

Phishing is a social engineering attack where criminals impersonate a trusted organisation — a bank, government agency, courier, or employer — to trick you into revealing credentials, OTPs, credit card details, or installing malware. In Singapore, phishing is the delivery mechanism behind most of the high-profile scams the police warn about: fake bank SMS, Singpass impersonation, job scams, and e-commerce fraud.

Unlike generic spam, modern phishing is targeted. Scammers know your telco (Singtel, StarHub, M1, Simba), your banks (DBS, OCBC, UOB), and your government touchpoints (IRAS, CPF, ICA, MOM). They weaponise that familiarity.

The Three Main Delivery Channels

1. Smishing (SMS phishing): Fake texts pretending to be from banks, SingPost, or IRAS with a link to a cloned website.
2. Email phishing: Fake invoices, HR notices, or "account suspended" warnings sent to your inbox.
3. Vishing (voice phishing): Calls from fake "police officers," MAS representatives, or China officials demanding transfers to "safety accounts."

Why Singapore Is a Prime Target

Singapore's high digital adoption rate makes it attractive to attackers. Nearly every adult uses PayNow, Singpass, and mobile banking daily. That trust in digital identity is exactly what phishers exploit.

• High-value victims: Average household wealth and English-language fluency make scams easier to localise.
• Dense digital ecosystem: One compromised Singpass or bank login unlocks CPF, HDB, tax, and investment accounts.
• Cross-border operations: Most phishing infrastructure is hosted overseas, making takedowns slow.
• Trusted brands to clone: DBS, OCBC, UOB, Lazada, Shopee, and government agencies are heavily impersonated.

Common Phishing Scams Targeting Singaporeans

1. Fake Bank SMS and "Unusual Transaction" Alerts

You receive an SMS that appears in the same thread as your real DBS or OCBC messages (SMS sender ID spoofing was heavily abused until the SG SMS Sender ID Registry tightened rules in 2023). The message says a large transaction is pending and asks you to click a link to cancel. The link opens a pixel-perfect clone of the bank's login page.

2. SingPost and Courier Delivery Scams

"Your parcel could not be delivered. Pay S$0.60 redelivery fee here." The amount is deliberately small to lower your guard. Once you enter card details, the scammers trigger a much larger overseas charge.

3. Singpass and Government Impersonation

Fake IRAS tax refund notices, fake MOM work pass renewals, and fake ICA passport reminders all funnel victims to counterfeit Singpass login pages. Real government agencies never send login links by SMS.

4. Job Scams on Telegram and WhatsApp

"Easy part-time work, S$150 per day, just like TikTok videos." After a few genuine payouts, victims are asked to "top up commission" to unlock bigger earnings. The phishing element is often a fake employer portal that harvests NRIC and bank details.

5. E-Commerce and Marketplace Phishing

On Carousell or Facebook Marketplace, a "buyer" sends you a link to "confirm your PayNow receipt." The link goes to a fake bank page. Instead of receiving money, you authorise an outbound transfer.

6. Investment and Crypto Phishing

Fake Binance, Coinbase, or local broker pages promoted through social media ads. Victims connect wallets or enter seed phrases, losing holdings instantly.

Red Flags: How to Recognise a Phishing Attempt

Every phishing attack has tells. If you train yourself to pause and scan for these, you'll catch 95% of attempts.

Red Flags in the Message

• Urgency and fear: "Your account will be suspended in 24 hours."
• Unexpected links: Any login link sent via SMS or email that you didn't request.
• Generic greetings: "Dear Customer" instead of your name.
• Grammar and spacing errors: Odd capitalisation, missing spaces, or awkward Singlish.
• Mismatch between sender and content: An SMS claiming to be from DBS but sent from a +65 mobile number or overseas code.
• Requests for OTP, PIN, or Singpass password: No legitimate organisation will ever ask for these.

Red Flags in the Link

• URL uses look-alike domains: dbs-secure.com, ocbc-sg.net, singpass-login.co.
• Extra subdomains: dbs.com.verify-login.xyz.
• Shortened links from unknown senders — always expand them first (see the next section).
• HTTP instead of HTTPS, or a padlock with a certificate issued to a random name.

How to Safely Check a Suspicious Link

Clicking is the point of no return on a mobile device because many phishing pages auto-trigger downloads or exploits. Instead, inspect the link first.

1. Long-press (don't tap) the link on your phone to preview the full URL.
2. Expand shortened URLs using a link-preview or URL-checker tool before visiting them. Shorteners like bit.ly can hide the destination, which is why reputable services such as Lunyb provide link previews and transparent destination checks — useful both for creating safe short links and for verifying ones you receive.
3. Type the official domain manually into your browser instead of clicking (e.g. dbs.com.sg).
4. Use the official app — the DBS, OCBC, or Singpass apps will show any genuine alerts in-app.
5. Cross-check with ScamShield, the free app from the Singapore Police Force and Open Government Products that blocks known scam numbers and links.

Phishing Red Flags at a Glance

Signal	Legitimate Message	Phishing Message
Sender ID	Registered Sender ID (e.g. "DBS", "Singpass")	"Likely-SCAM" label, random mobile number, or spoofed ID
Greeting	Uses your name or masked account number	"Dear Customer" or no greeting
Link	Official domain (dbs.com.sg, singpass.gov.sg)	Look-alike or shortened unknown link
Request	Directs you to open the official app	Asks for OTP, password, NRIC, or card CVV
Tone	Informational, no deadline pressure	Urgent, threatening, or too-good-to-be-true reward
Attachments	Rare; usually PDFs from known contacts	Unexpected .zip, .apk, or HTML files

Practical Steps to Protect Yourself

1. Lock Down Your Accounts

• Enable the Money Lock feature offered by DBS, OCBC, UOB, and other local banks to ring-fence a portion of your savings from online transfers.
• Turn on biometric or hardware-key two-factor authentication on Singpass, email, and banking apps.
• Set low default daily transfer limits and raise them only when needed.

2. Use the Right Tools

• ScamShield app — filters scam SMS and calls at the OS level.
• Encrypted DNS (such as 1.1.1.1 or Quad9) on your phone and router to block known phishing domains before they load.
• Browser safe-browsing warnings — keep them enabled in Chrome, Safari, and Edge.
• Password manager — if it doesn't auto-fill on a page, that's a strong hint the domain is fake.

3. Change Your Habits

1. Never log in through a link — always open the app or type the URL.
2. Never share OTPs, even with someone claiming to be bank staff or police.
3. Pause for 30 seconds on any "urgent" message — urgency is the scammer's weapon.
4. Verify unusual requests from colleagues or family through a second channel (a phone call).
5. Review bank statements weekly, not monthly.

4. Protect Your Business

SMEs are heavily targeted through CEO-fraud emails and fake invoice phishing. Enforce DMARC, SPF, and DKIM on your domain, train staff quarterly, and require two-person approval for any payment above a set threshold. If you shorten links in customer-facing marketing, use a trustworthy service with analytics and link editing so you can disable a compromised link quickly — see our review of Lunyb as a privacy-first URL shortener for how transparent short links reduce phishing risk for your audience.

What to Do If You've Been Phished

Speed is everything. The first 60 minutes determine whether you recover your money.

1. Call your bank's 24/7 anti-scam hotline immediately (DBS: 1800-339-6963, OCBC: 1800-363-3333, UOB: 1800-222-2121) to freeze transfers.
2. Call the Anti-Scam Helpline at 1799 or make a police report at police.gov.sg/iwitness.
3. Change passwords on the compromised account and any account sharing that password.
4. Revoke Singpass sessions via the Singpass app if you entered credentials on a fake page.
5. Reset your device if you downloaded any .apk file — malware droppers are common in SG scams.
6. Report the phishing URL to the Singapore Cyber Emergency Response Team (SingCERT) so it can be taken down.

How Singapore Is Fighting Back

The ecosystem has tightened significantly:

• SMS Sender ID Registry (SSIR): Unregistered senders are now tagged "Likely-SCAM."
• Shared Responsibility Framework (SRF): Banks and telcos share liability for certain phishing losses.
• Anti-Scam Command (ASCom): Coordinates with banks to freeze mule accounts within minutes.
• Money Lock and kill switches: Now standard across major banks.
• App safety features: Banking apps detect sideloaded apps, screen sharing, and accessibility abuse — common malware vectors.

These are strong defences, but they don't replace personal vigilance. The weakest link remains the human clicking the link.

Frequently Asked Questions

How common are phishing attacks in Singapore?

Phishing is consistently among the top-reported scam types in the Singapore Police Force's annual scam report, with tens of thousands of cases and nine-figure losses each year. Nearly every mobile user in Singapore receives at least one phishing SMS or email per week.

Will my bank refund me if I fall for a phishing scam?

Under Singapore's Shared Responsibility Framework, banks and telcos may bear part of the loss if they failed in their duties (for example, not blocking a spoofed Sender ID). However, if you willingly entered your OTP or password on a phishing site, recovery is not guaranteed. Reporting within the hour maximises your chances.

Are shortened links always dangerous?

No. Shortened links are a legitimate tool for marketing, print materials, and social media. The risk comes from shorteners that hide the destination entirely. Reputable services like Lunyb offer previews, analytics, and the ability to disable links, which actually make short links safer than raw URLs in many cases. The rule: only click shortened links from senders you trust, and preview them when in doubt.

How can I tell if a Singpass login page is real?

The genuine domain is always singpass.gov.sg (or app.singpass.gov.sg). Anything else — singpass-sg.com, singpass.login.co, mysingpass.net — is fake. The safest method is to open the Singpass app directly and scan the QR code shown on the legitimate site, rather than typing credentials.

What should I teach elderly family members about phishing?

Three rules cover most scenarios: (1) never click links in SMS or email — always open the app, (2) never share OTPs with anyone, including "bank staff" or "police," and (3) when in doubt, call 1799 (the Anti-Scam Helpline) before acting. Install ScamShield on their phones and set low banking transfer limits as a safety net.

Final Thoughts

Phishing in Singapore is sophisticated, localised, and relentless — but also highly predictable once you know the patterns. Urgency, unexpected links, requests for OTPs, and look-alike domains are the four signals that catch almost every attack. Combine that awareness with ScamShield, strong 2FA, Money Lock, and the habit of opening apps instead of clicking links, and you move from easy target to hard target. Scammers always move on to the easy ones.