Phishing Attacks in Singapore: How to Recognize and Avoid Them in 2026

Phishing attacks in Singapore have evolved from clumsy email scams into sophisticated, multi-channel campaigns that mimic banks, government agencies, delivery firms, and even SingPass. According to the Singapore Police Force's Annual Scams and Cybercrime Brief, scam-related losses crossed S$1 billion in recent reporting periods, with phishing remaining one of the top attack vectors. This guide explains how phishing works locally, the red flags to watch for, and the steps you can take today to protect yourself and your organisation.

What Is a Phishing Attack?

A phishing attack is a social engineering technique where criminals impersonate a trusted entity to trick victims into revealing sensitive information such as passwords, OTPs, NRIC details, or banking credentials. The attacker's goal is usually financial fraud, identity theft, or unauthorised access to corporate systems.

In Singapore, phishing has become particularly dangerous because attackers tailor their lures to local context — using DBS, OCBC, UOB, IRAS, SingPost, Shopee, and Lazada branding, and exploiting Singlish phrasing and familiar national events (CDC vouchers, GST rebates, BTO updates) to lower victims' guard.

The Phishing Landscape in Singapore: 2026 Snapshot

The Cyber Security Agency of Singapore (CSA) and the Singapore Police Force have consistently flagged phishing as a top-three cybercrime concern. Key trends in the current threat landscape include:

• SMS phishing (smishing) impersonating banks, MOH, IRAS, and parcel couriers.
• QR code phishing (quishing) placed over legitimate QR codes at hawker centres, car parks, and on bubble tea cups.
• Job scam phishing via WhatsApp and Telegram offering high daily pay for "reviewing products".
• Investment phishing using deepfake videos of local figures like PM Lawrence Wong or business leaders.
• Business email compromise (BEC) targeting SMEs handling cross-border supplier payments.

Common Types of Phishing Attacks Targeting Singaporeans

1. SMS Phishing (Smishing)

Smishing messages claim your bank account is locked, a parcel cannot be delivered, or your SingPass has been suspended. They include a shortened or look-alike URL and urge immediate action. With the SMS Sender ID Registry (SSIR) now mandatory, any SMS from an unregistered alphanumeric sender is automatically labelled "Likely-SCAM" — pay attention to that label.

2. Email Phishing

Email phishing typically impersonates banks, IRAS tax refunds, Microsoft 365 password resets, or HR notices. Look closely at the sender address — scammers often use domains like dbs-sg-secure.com or iras-refund.net instead of the official .gov.sg or dbs.com.sg.

3. Voice Phishing (Vishing)

Callers pretend to be from MAS, the police, or the Ministry of Health, claiming you are involved in money laundering or a COVID-related investigation. They pressure you to transfer money to a "safety account" or share your SingPass OTP.

4. QR Code Phishing (Quishing)

A fake QR code sticker is pasted over a legitimate one. Scanning it leads to a fake PayNow or survey page that harvests your banking credentials. In 2023, a Singapore victim lost S$20,000 after scanning a malicious QR code on a bubble tea promotion.

5. Social Media and Messaging App Phishing

Scammers create fake Facebook Marketplace listings, Carousell pages, or WhatsApp Business profiles. They send payment links that look like PayNow or bank transfer pages but actually steal credentials.

Red Flags: How to Recognize a Phishing Attempt

A phishing message almost always contains at least two of the following warning signs. Train yourself to scan for them automatically.

1. Urgency or fear — "Your account will be suspended in 24 hours."
2. Requests for OTP, password, NRIC, or SingPass details — no legitimate bank or government agency will ever ask for these.
3. Suspicious sender address — misspelled domains, random numbers, or free email services (gmail.com) for "official" messages.
4. Generic greetings — "Dear Customer" instead of your name.
5. Mismatched or shortened links — hover over the link (or long-press on mobile) to preview the destination.
6. Grammar and tone errors — awkward Singlish that doesn't match a corporate brand.
7. Unexpected attachments — especially .zip, .htm, or .exe files.
8. "Likely-SCAM" label on SMS — never ignore this.

Phishing Attack Comparison: Channels and Risk Levels

Channel	Common Impersonation	Primary Goal	Risk Level
SMS (Smishing)	Banks, SingPost, IRAS	Credential theft, OTP capture	Very High
Email	Microsoft 365, banks, HR	Account takeover, malware	High
Phone Call (Vishing)	SPF, MAS, MOH	Bank transfer fraud	Very High
QR Code (Quishing)	PayNow, F&B promos	Banking credential theft	Medium-High
WhatsApp/Telegram	Job offers, investments	Money mule recruitment	High
Social Media	Carousell, FB Marketplace	Payment fraud	Medium

How to Verify a Suspicious Link Before Clicking

Links are the delivery mechanism for most phishing payloads. Before you tap or click any link, run through this checklist:

1. Hover or long-press to see the full destination URL.
2. Check the domain carefully — dbs.com.sg is legitimate; dbs-com.sg.security-alert.net is not. Always read from right to left.
3. Look for HTTPS, but remember that HTTPS alone does not mean safe — phishing sites also use HTTPS.
4. Use a link preview tool if the URL is shortened. Reputable shorteners such as Lunyb let recipients preview the destination, and Lunyb scans links against known malicious domain lists before redirecting. You can read more in our honest Lunyb review or browse the 2026 best URL shorteners guide to understand which providers offer security features by default.
5. Type the URL manually for sensitive sites like Internet Banking or SingPass — never click through from email or SMS.

What to Do If You Receive a Phishing Message

Take these steps in order. Speed matters — but accuracy matters more.

1. Do not click, reply, or scan anything in the message.
2. Screenshot the message including the sender details and timestamp.
3. Report it:
   • Forward suspicious SMS to 7726 (SPAM).
   • Report phishing websites and scams via the ScamShield app or call the Anti-Scam Helpline 1800-722-6688.
   • Submit to SingCERT (csa.gov.sg) for cybersecurity incidents.
4. Delete the message after reporting.
5. Warn friends and family, especially elderly relatives who are common targets.

What to Do If You Already Clicked or Shared Information

If you suspect you have fallen for a phishing attack, act within minutes — not hours.

1. Call your bank's anti-scam hotline immediately. DBS, OCBC, UOB, Standard Chartered, and Citibank all operate 24/7 lines. Ask them to freeze the account and reverse transfers.
2. Activate the "Money Lock" feature if your bank offers it, to ring-fence funds from digital withdrawal.
3. Change all passwords, starting with email, banking, and SingPass. Enable two-factor authentication (2FA) on every account.
4. Revoke SingPass sessions at singpass.gov.sg and reset your SingPass password.
5. File a police report at the nearest Neighbourhood Police Centre or via the e-Services portal.
6. Run an antivirus scan on your device and remove any unfamiliar apps.
7. Monitor your CBS credit report for unauthorised loan applications.

How to Protect Yourself Long-Term

Personal Protective Measures

• Install the ScamShield app (free, by Open Government Products) to filter scam SMS and calls automatically.
• Enable Money Lock with your bank to prevent digital transfers of locked funds.
• Use a password manager so each account has a unique, strong password.
• Turn on 2FA everywhere — ideally using an authenticator app rather than SMS OTPs.
• Keep your phone OS and apps updated to patch known vulnerabilities.
• Use encrypted DNS (such as 1.1.1.1 or Quad9) to block known phishing domains at the network level.
• Sideload apps with caution — Android malware scams in Singapore often start with an APK downloaded from a phishing site.

For SMEs and Businesses

• Run quarterly phishing simulations for staff. CSA's SG Cyber Safe programme provides resources.
• Implement DMARC, SPF, and DKIM on your email domains to prevent spoofing.
• Enforce 2FA on Microsoft 365 and Google Workspace.
• Use a branded link shortener with click analytics and malware scanning for outbound marketing — recipients are more likely to trust a recognisable domain. Our Rebrandly review and our URL shortener comparison guide can help you choose.
• Establish a verification protocol for any financial request — always confirm via a second channel (phone call to a known number).
• Subscribe to SingCERT advisories for sector-specific threat intelligence.

Singapore-Specific Resources and Hotlines

Resource	Contact	Use Case
Anti-Scam Helpline	1800-722-6688	Advice on suspected scams
Police Hotline	1800-255-0000	Non-urgent reporting
Emergency	999	Active fraud in progress
ScamShield App	iOS & Android	Block scam calls/SMS
SingCERT	csa.gov.sg/singcert	Report cyber incidents
SMS Spam Reporting	Forward to 7726	Report scam SMS
ScamAlert Website	scamalert.sg	Latest scam advisories

The Psychology Behind Phishing: Why Smart People Still Fall for It

Phishing succeeds not because victims are careless, but because attackers exploit cognitive shortcuts. Understanding the psychology helps you build resistance:

• Authority bias — messages that appear to come from the police, MAS, or your bank trigger automatic compliance.
• Urgency — short deadlines shut down analytical thinking.
• Loss aversion — "Your account will be closed" feels more pressing than "You will win S$500."
• Social proof — fake reviews and testimonials on phishing sites.
• Familiarity — local references (CDC vouchers, BTO, NDP) lower scepticism.

The antidote is a deliberate pause. Whenever a message creates emotional pressure to act now, that is precisely when you must slow down, verify through an independent channel, and consult a trusted source.

Frequently Asked Questions

1. How do I report a phishing SMS in Singapore?

Forward the SMS to 7726 (which spells "SPAM") at no cost. You can also report scams via the ScamShield app or call the Anti-Scam Helpline at 1800-722-6688. For phishing websites, submit a report to SingCERT at csa.gov.sg.

2. Will my bank reimburse me if I fall for a phishing scam?

Under Singapore's Shared Responsibility Framework (SRF), banks and telcos may bear losses if they failed to meet their anti-scam obligations. However, if you voluntarily disclosed your OTP, password, or SingPass details, recovery is unlikely. Activate Money Lock and 2FA to reduce risk in the first place.

3. Are shortened URLs always dangerous?

No. Shortened URLs are widely used in legitimate marketing, social media, and SMS campaigns where character limits matter. The risk is that you cannot see the destination. Use shorteners that offer link previews and malware scanning, such as Lunyb, and always preview unfamiliar shortened links with an online expander before clicking.

4. What is the difference between phishing and smishing?

Phishing is the broad term for any social engineering attack designed to steal information, typically via email. Smishing is phishing delivered via SMS. In Singapore, smishing has overtaken email phishing as the most common channel, largely because mobile messages feel more immediate and personal.

5. Can I install ScamShield if I'm not a Singapore resident?

ScamShield is designed for Singapore numbers and uses a local scam database maintained by the National Crime Prevention Council and Open Government Products. It works best on Singtel, StarHub, M1, and Simba numbers. Non-residents can use general spam-blocking apps, but they will not benefit from the local intelligence feed.

6. How often should businesses run phishing awareness training?

CSA recommends at least quarterly phishing simulations combined with annual refresher training. High-risk roles such as finance, HR, and senior leadership should receive more frequent, targeted exercises. Track click rates over time as a key security KPI.

Final Thoughts

Phishing in Singapore is not going away — if anything, AI-generated content, deepfake voices, and local-language tailoring are making attacks more convincing. The good news is that the defensive playbook is well established: pause before clicking, verify through an independent channel, use 2FA and Money Lock, install ScamShield, and report anything suspicious to 7726 or the Anti-Scam Helpline.

Treat every unexpected message — no matter how official it looks — as guilty until proven innocent. A 30-second verification today can save you tens of thousands of dollars and months of recovery tomorrow.