Phishing Attacks in Singapore: How to Recognise and Avoid Them in 2026

Phishing attacks in Singapore have evolved from clumsy email scams into highly targeted operations that drain bank accounts, hijack SingPass credentials, and compromise CPF balances. In 2024 alone, Singaporeans lost over S$1.1 billion to scams according to the Singapore Police Force, with phishing consistently ranking among the top three attack vectors. Understanding how these attacks work, and training your instincts to recognise them, is now a basic life skill.

This guide breaks down the phishing landscape in Singapore, the local tactics criminals use, and the practical steps you can take to avoid becoming the next statistic.

What Is a Phishing Attack?

A phishing attack is a form of social engineering where a criminal impersonates a trusted organisation — a bank, government agency, courier, or employer — to trick you into revealing sensitive information or installing malware. The goal is almost always financial: stealing banking credentials, One-Time Passwords (OTPs), SingPass logins, or payment card details.

Phishing can arrive through several channels:

• Email (classic phishing)
• SMS (smishing)
• Voice calls (vishing)
• WhatsApp, Telegram, and WeChat messages
• Fake websites and ads on Google or Facebook
• QR codes on posters, parking signs, or bubble tea stickers (quishing)

The Phishing Landscape in Singapore

Singapore is a particularly attractive target for phishing operators because of its high digital banking adoption, widespread use of PayNow, and a population that heavily relies on government digital services like SingPass, MyInfo, and HealthHub. Attackers know that a single compromised SingPass account can unlock loans, rental deals, and even new SIM cards registered in the victim's name.

The Singapore Police Force and the Cyber Security Agency of Singapore (CSA) publish regular advisories on the most active scams. Recent high-volume campaigns include:

• Fake DBS, OCBC, UOB, and Trust Bank alerts about "suspicious transactions"
• Impersonation of IRAS claiming tax refunds or unpaid taxes
• Fake SingPost and Ninja Van delivery failure notices
• Counterfeit MOM and ICA messages about work pass or passport issues
• LTA parking fine and ERP charge scams
• Fake job offers on WhatsApp promising "easy part-time income"

Common Types of Phishing Attacks Targeting Singaporeans

1. Bank Impersonation Phishing

You receive an SMS or email claiming unusual activity on your DBS, OCBC, or UOB account, with a link to "verify" your identity. The link leads to a near-perfect clone of the bank's login page. Once you enter your credentials and OTP, attackers immediately drain your account via PayNow or overseas transfer.

2. Government Agency Scams

Fake messages from IRAS, ICA, MOM, or the Singapore Police claim you owe money, have a parcel held at customs, or are under investigation for money laundering. Victims are pressured to transfer funds to a "safety account" or hand over SingPass credentials.

3. Delivery and E-commerce Phishing

SMS or WhatsApp messages pretending to be from SingPost, Ninja Van, J&T, Shopee, or Lazada say your parcel is held up due to an unpaid customs fee of a few dollars. The small amount reduces suspicion, but the real goal is to capture your full card details on the payment page.

4. QR Code Phishing (Quishing)

Fake QR codes have been plastered over legitimate ones at hawker centres, bubble tea stalls, and HDB carparks. Scanning them leads to counterfeit payment pages that look like PayNow or GrabPay but send money to the scammer instead.

5. Job and Investment Scams

WhatsApp or Telegram messages offer part-time jobs "liking videos" or "reviewing hotels" for S$50–S$500 a day. After small initial payouts build trust, victims are asked to top up thousands of dollars to "unlock commissions" that never arrive.

6. Spear Phishing and Business Email Compromise (BEC)

Targeted at finance staff in SMEs, these emails impersonate the CEO or a known supplier and instruct urgent wire transfers. Singapore's business community has lost tens of millions to BEC in recent years.

How to Recognise a Phishing Attempt: 10 Red Flags

Phishing messages almost always share a set of tells. If you spot two or more of these in a single message, treat it as hostile until proven otherwise.

1. Urgency and fear — "Your account will be suspended in 24 hours."
2. Unexpected links — especially shortened or unfamiliar domains.
3. Requests for OTP, password, or SingPass login — no legitimate bank or agency will ever ask for these.
4. Spelling, grammar, or odd phrasing — "Dear Valued Customer, your account have been locked."
5. Mismatched sender address — e.g. "DBS-Security@gmail.com" instead of a dbs.com.sg domain.
6. Generic greetings — "Dear Customer" instead of your name.
7. Requests to switch channels — moving from SMS to WhatsApp or Telegram.
8. Pressure to install an app from a link outside the Play Store or App Store.
9. Too-good-to-be-true offers — easy jobs, guaranteed returns, free giveaways.
10. Requests for payment via cryptocurrency, gift cards, or PayNow to unknown mobile numbers.

Phishing Channels Compared

Different attack channels carry different risk profiles. Here's how they compare:

Channel	Common Lure	Risk Level	Best Defence
SMS (smishing)	Bank alerts, delivery fees	Very High	Never tap links in SMS; use the official app
Email	Invoices, tax refunds, BEC	High	Check sender domain; hover over links
WhatsApp / Telegram	Job offers, friend impersonation	High	Verify via a separate channel (phone call)
Voice Calls	Police, bank, ICA impersonation	Very High	Hang up; call the official hotline back
QR Codes	Fake payment stickers	Medium	Check the merchant name before paying
Fake Ads	Investment, shopping scams	Medium	Go to the brand's official site directly

How to Verify a Suspicious Link Before Clicking

Not every shortened or unfamiliar link is malicious — legitimate businesses in Singapore use link shorteners for marketing, SMS campaigns, and QR codes every day. The trick is to verify before you trust.

Follow this three-step check:

1. Preview the destination. Use a link preview tool, or on a desktop browser, hover over the link to see the real URL at the bottom of the screen.
2. Check the domain carefully. Scammers register look-alike domains such as "dbs-sg-secure.com" or "singpost-delivery.net". Legitimate domains end in .dbs.com.sg, .gov.sg, .singpost.com, and so on.
3. Use a reputable shortener that encrypts and audits its links. Privacy-focused services like Lunyb provide click analytics and metadata-light redirects, which help businesses prove to recipients that their branded short links are genuine. If you're curious whether a particular platform is trustworthy, our honest review of Lunyb walks through how a privacy-first shortener should behave.

Practical Steps to Avoid Phishing Attacks

Lock Down Your SingPass

SingPass is the master key to your digital identity in Singapore. Enable Face Verification, use the SingPass app instead of SMS OTPs where possible, and review your transaction history in the app monthly. Never log in to SingPass from a link — always open the app or type the URL manually.

Use the Official Banking Apps Only

DBS, OCBC, UOB, Trust, GXS, and Maribank all push security alerts through their apps rather than SMS. If you receive an SMS about your account, close the message and open the app directly. Most banks in Singapore have also rolled out a "Money Lock" or "Safe Account" feature — use it to ring-fence savings from digital transfers.

Register for ScamShield

ScamShield, developed by the National Crime Prevention Council and Open Government Products, filters known scam SMSes and calls on both iOS and Android. It's free and genuinely effective at cutting down smishing volume.

Turn On Two-Factor Authentication Everywhere

Use an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy) rather than SMS OTPs for email, social media, and crypto accounts. SMS can be intercepted via SIM-swap attacks, which are rising in Singapore.

Protect Your Network

Avoid logging into banking or SingPass over free public Wi-Fi at malls or Changi Airport. If you must, use mobile data instead. Enable encrypted DNS (DNS-over-HTTPS) in Chrome, Firefox, or Safari to prevent your DNS queries from being tampered with on hostile networks. A private browser like Brave or Firefox with strict tracking protection adds another layer of defence against malicious ad networks that push phishing pages.

Train Your Household

Elderly parents and younger siblings are disproportionately targeted. Walk them through the red flags above, and establish a family rule: no financial decision is made based on a single message or call — always verify with a family member first.

What to Do If You've Been Phished

If you suspect you've entered credentials or made a payment to a phishing site, act within minutes — attackers automate the drain.

1. Call your bank's anti-scam hotline immediately. DBS: 1800-339-6963. OCBC: 1800-363-3333. UOB: 1800-222-2121. Ask them to freeze transfers and card activity.
2. Change your passwords from a clean device — not the one that may be compromised.
3. Revoke SingPass sessions inside the SingPass app and reset your password.
4. Report to the Singapore Police Force at 1800-255-0000 or via the ScamShield app. File a police report online at eservices.police.gov.sg.
5. Call the Anti-Scam Helpline at 1800-722-6688 for guidance.
6. Scan your device for malware, and if you installed an APK from an SMS link, do a factory reset — Android banking trojans are commonly distributed this way in Singapore.

How Businesses in Singapore Can Reduce Phishing Risk

SMEs are a favourite target because they often lack dedicated security teams. If you run a business, at minimum you should:

• Enforce multi-factor authentication on all email and cloud accounts (Microsoft 365, Google Workspace).
• Configure SPF, DKIM, and DMARC records on your domain to stop spoofed emails.
• Train staff quarterly with simulated phishing exercises.
• Use branded, verifiable short links in customer communications so recipients learn to trust only your official domain. Tools like Lunyb or Rebrandly let you shorten links under a custom domain — compare them in our review before choosing.
• Adopt a "call-back verification" policy for any payment change request, no matter how urgent.

Frequently Asked Questions

How common are phishing attacks in Singapore?

Extremely common. The Singapore Police Force recorded tens of thousands of phishing-related scam cases in 2024, with losses exceeding S$1.1 billion across all scam types. Phishing SMSes and calls are a daily occurrence for most mobile users in Singapore.

Will a bank in Singapore ever ask for my OTP or password?

No. DBS, OCBC, UOB, Trust, and every other MAS-regulated bank have stated publicly that they will never ask for your OTP, Internet banking password, PIN, or SingPass credentials via SMS, email, or phone call. Any such request is a scam, full stop.

Is it safe to click shortened links I receive in Singapore?

Shortened links are safe when they come from a sender you trust and point to a domain you recognise. Preview the full URL before clicking, and be especially cautious with links in unsolicited SMS messages. Reputable shorteners like Lunyb offer transparent redirects and analytics so legitimate senders can prove their links are genuine.

What should I do if I accidentally gave my SingPass password to a scammer?

Open the SingPass app immediately, reset your password, and revoke all active sessions. Then call the SingPass helpdesk at 6335-3533 and file a police report. Monitor your CPF, HDB, and IRAS accounts closely for the next few weeks, as scammers often try to take out loans or make changes within hours.

Does ScamShield block all phishing messages?

No tool blocks 100%, but ScamShield significantly reduces the volume of known scam SMSes and calls reaching your phone. It works best alongside personal vigilance — treat every unexpected message as suspicious until you verify it through official channels.

The bottom line: phishing attacks in Singapore are sophisticated, localised, and relentless, but they rely on you reacting emotionally rather than logically. Slow down, verify independently, and never act on a single unsolicited message. That one-minute pause is the single most powerful anti-phishing tool you have.