Phishing Attacks in Singapore: How to Recognize and Avoid Them in 2026

Phishing attacks in Singapore have surged into one of the most damaging forms of cybercrime, costing victims hundreds of millions of dollars each year. From fake bank SMS messages to spoofed SingPass logins and elaborate WhatsApp impersonation scams, attackers are targeting Singaporean residents and businesses with increasingly sophisticated techniques. This guide explains what phishing looks like in Singapore today, how to recognise the warning signs, and the practical steps you can take to protect yourself, your family, and your organisation.

What Is Phishing? A Quick Definition

Phishing is a form of social engineering attack where criminals impersonate trusted entities — banks, government agencies, delivery companies, or colleagues — to trick victims into revealing sensitive information or transferring money. In Singapore, phishing typically arrives via SMS, email, WhatsApp, phone calls, or fake websites that closely mimic legitimate services like DBS, OCBC, UOB, IRAS, or SingPost.

The end goal is almost always one of the following: stealing login credentials, capturing OTPs, harvesting credit card details, installing malware, or convincing the victim to authorise a fraudulent fund transfer.

The Phishing Landscape in Singapore

According to the Singapore Police Force and the Cyber Security Agency of Singapore (CSA), scam-related losses crossed S$1 billion in recent years, with phishing scams ranking among the top three categories. The Singapore Police Force's Anti-Scam Centre regularly issues alerts about new variants, and the Monetary Authority of Singapore (MAS) has rolled out the Shared Responsibility Framework (SRF) requiring banks and telcos to share liability when customers fall victim to phishing.

Despite these protections, phishing continues to evolve. Attackers now use AI-generated voices, deepfake videos, and well-crafted Singlish text to bypass the usual red flags people are trained to spot.

Why Singapore Is a Prime Target

High digital adoption: Almost universal smartphone and digital banking usage.
Wealthy population: High average savings and frequent cross-border transactions.
Trust in institutions: Singaporeans tend to act quickly on messages claiming to be from MOH, IRAS, or local banks.
Multilingual environment: Scammers exploit English, Mandarin, Malay, and Tamil to target specific demographics.

Common Types of Phishing Attacks in Singapore

1. SMS Phishing (Smishing)

Fake SMS messages claiming to be from your bank, SingPost, or LTA. Common examples include "Your DBS account has been suspended" or "Your parcel could not be delivered, click here to reschedule." The link leads to a cloned login page that captures your credentials and OTP in real time.

2. Email Phishing

Spoofed emails from IRAS about tax refunds, CPF statements, or corporate vendors requesting urgent payment. Business Email Compromise (BEC) is especially damaging — attackers impersonate a CEO or supplier to redirect invoice payments.

3. WhatsApp and Telegram Scams

Job offers promising easy income, fake investment groups, or impersonation of family members asking for urgent money transfers. "Hi Mum/Dad, this is my new number" remains a stubbornly effective scam.

4. Voice Phishing (Vishing)

Calls claiming to be from the Singapore Police Force, ICA, or China authorities accusing the victim of involvement in money laundering. AI voice cloning has made these calls eerily realistic in 2026.

5. Fake SingPass and Government Sites

Cloned SingPass, MyInfo, or HealthHub websites designed to harvest national digital identity credentials — giving attackers access to a victim's entire digital life.

6. QR Code Phishing (Quishing)

Stickers placed over legitimate QR codes at hawker centres, parking meters, or on "survey" flyers redirecting users to malicious payment pages.

How to Recognise a Phishing Attempt

Most phishing messages share recognisable patterns. Use this checklist before clicking any link or replying to any unexpected message.

Red Flag	What to Look For	Example
Urgency	Threats of account closure or arrest within hours	"Your account will be frozen in 24 hours"
Suspicious sender	Slightly misspelled domains or random numbers	dbs-secure.com instead of dbs.com.sg
Unexpected links	Shortened or unfamiliar URLs	bit.ly/dbs-verify
Requests for OTP	No legitimate bank asks for your OTP	"Please share OTP to verify identity"
Generic greetings	"Dear Customer" instead of your name	Real banks address you by name
Grammar errors	Awkward phrasing or wrong Singlish	"Kindly do the needful immediately"
Wrong channel	Banks no longer send clickable links via SMS	Any clickable bank SMS link

The MAS "No Clickable Links" Rule

Since 2022, all major Singapore banks — DBS, OCBC, UOB, Standard Chartered, Maybank, Citibank — have stopped sending clickable links in SMS or email to retail customers. If you receive a bank SMS with a link, it is almost certainly a scam. Open the bank's official app instead.

Real Phishing Examples Targeting Singaporeans

The OCBC Phishing Wave

In one of Singapore's largest phishing incidents, nearly 800 OCBC customers lost S$13.7 million to SMS phishing where scammers spoofed the official OCBC sender ID. This led directly to the SMS Sender ID Registry (SSIR) being made mandatory.

SingPost Parcel Scam

Victims receive an SMS claiming a parcel is held due to incomplete address details. The link leads to a fake SingPost page requesting credit card information for a small "redelivery fee" — which is then used for far larger fraudulent transactions.

Job Scam on Telegram

"Earn S$200–500 daily by liking videos." Victims complete small tasks and receive small payments to build trust, then are asked to deposit funds for "premium tasks" — funds they never recover.

How to Protect Yourself: 10 Practical Steps

Never click links in SMS or email from banks. Open the official app directly.
Enable the Money Lock feature on DBS, OCBC, UOB, and other major banks to ring-fence savings.
Activate ScamShield — the official app from the Singapore Police Force and NCPC.
Use multi-factor authentication on every account, preferably with an authenticator app rather than SMS.
Verify URLs before clicking. Hover over links on desktop, long-press on mobile to preview the destination.
Never share OTPs — not with bank staff, police, or family. No legitimate party will ever ask.
Set transaction limits low for daily transfers and only raise them temporarily when needed.
Verify unusual requests through a second channel — call the person back on a known number.
Keep devices updated with the latest iOS, Android, and app patches.
Report suspicious messages to ScamShield (call 1799) and forward phishing SMS to 9XSCAM (99-7226).

Tools and Services to Help

Several Singapore-specific and global tools can dramatically reduce your phishing risk:

Tool	What It Does	Cost
ScamShield (SPF/NCPC)	Filters scam SMS and calls automatically	Free
SMS Sender ID Registry (SSIR)	Blocks spoofed business sender IDs at telco level	Free for users
Money Lock (DBS/OCBC/UOB)	Locks part of your savings from digital transfers	Free
Authenticator apps (Google, Microsoft, Authy)	Stronger 2FA than SMS OTP	Free
Password managers (1Password, Bitwarden)	Auto-fill only on real domains, exposing fakes	Free–S$8/mo
VPN with phishing filter	Blocks known malicious domains	S$5–10/mo

Be Careful With Shortened Links

Shortened URLs are convenient, but attackers love them because they hide the real destination. When you receive a short link, expand it before clicking using a link-preview tool. If you create short links yourself for marketing or sharing, use a transparent provider that shows clean, branded URLs and protects against malicious redirects. Lunyb, for example, is a privacy-focused URL shortener that gives users branded links and click analytics without selling tracking data — useful for businesses in Singapore that want to maintain customer trust. You can read our honest review of Lunyb or compare it against alternatives in our 2026 URL shortener buyer's guide.

What to Do If You've Been Phished

Speed matters. Within the first hour after a phishing incident, follow these steps in order:

Call your bank's 24-hour anti-fraud hotline immediately (DBS: 1800 339 6963, OCBC: 1800 363 3333, UOB: 1800 222 2121).
Freeze affected cards and accounts through the mobile app if possible.
Change passwords for the compromised account and any account sharing the same password.
Lodge a police report at any Neighbourhood Police Centre or via the e-Services portal.
Report to ScamShield by calling 1799 or via the app.
Notify SingPass at +65 6643 0555 if your digital identity was compromised.
Monitor your CBS credit report for unauthorised loan applications.
Document everything — screenshots, transaction IDs, timestamps — for the investigation.

Phishing Protection for Businesses in Singapore

SMEs are increasingly targeted because they often lack dedicated IT security. Business Email Compromise alone costs Singapore companies tens of millions annually. Recommended baseline controls include:

Implement DMARC, SPF, and DKIM on all corporate email domains.
Mandatory phishing simulation training every quarter (KnowBe4, Hoxhunt, or local providers).
Verbal verification policy for any payment change request, regardless of how legitimate the email looks.
Segregation of duties — no single employee should be able to authorise high-value transfers alone.
Endpoint Detection and Response (EDR) on all company devices.
Cyber insurance that covers social engineering fraud, not just data breaches.

The Future of Phishing in Singapore

Three trends will define phishing in 2026 and beyond:

AI-generated content: Perfect grammar, personalised details scraped from LinkedIn and social media, and Singlish that sounds genuinely local.
Deepfake voice and video: CEO fraud calls and Zoom impersonations of senior staff.
Multi-channel attacks: An email followed by a confirming WhatsApp message followed by a phone call — all parts of the same coordinated scam.

The best defence remains a sceptical mindset combined with strong technical controls. Treat every unexpected message — no matter how convincing — as suspicious until verified through an independent channel.

Frequently Asked Questions

How do I report a phishing SMS in Singapore?

Forward the SMS to 9XSCAM (99-7226) or report it through the ScamShield app. You can also call the anti-scam helpline at 1799 for advice. If you have already lost money, lodge a police report immediately and contact your bank's 24-hour fraud hotline.

Will my bank refund me if I get phished in Singapore?

Under the Shared Responsibility Framework (SRF) implemented by MAS, banks and telcos must compensate customers if they failed in their duties — for example, if a bank allowed a high-risk transaction without proper alerts. However, if you voluntarily shared your OTP or password, your claim may be reduced. Each case is assessed individually.

Is ScamShield really effective?

Yes. ScamShield, jointly developed by the Singapore Police Force and the National Crime Prevention Council, blocks millions of scam calls and messages each year. It is free, lightweight, and recommended for every Singapore resident with a smartphone.

How can I tell if a website is a fake SingPass page?

The official SingPass URL is always singpass.gov.sg. Look for the green padlock and verify the exact spelling — fakes often use variants like singpass-sg.com or singpasslogin.net. SingPass will never ask you to log in via a link sent through SMS, email, or WhatsApp. Always type the URL manually or use the official SingPass app.

What is the most common phishing scam in Singapore right now?

Parcel delivery scams (impersonating SingPost, Ninja Van, or DHL) and bank impersonation scams remain the most common. Job scams on Telegram and WhatsApp targeting young adults and homemakers have also grown sharply, often involving fake "task-based" earnings that escalate into deposit demands.

Should I use a password manager to prevent phishing?

Absolutely. A password manager only auto-fills credentials on the exact domain it has saved, so if you land on a phishing site, the password manager will silently refuse to fill — which itself is a strong warning sign. Combined with hardware security keys or authenticator apps, this is one of the most effective anti-phishing defences available.

Stay vigilant, verify before you trust, and remember: in Singapore, no legitimate bank, government agency, or police officer will ever ask you for your OTP or password. When in doubt, hang up and call the official number yourself.