Phishing Attacks in Singapore: How to Recognize and Avoid Them in 2026

Phishing attacks in Singapore have become one of the most damaging forms of cybercrime, costing victims hundreds of millions of dollars each year. According to the Singapore Police Force, scam-related losses crossed S$1 billion in recent reporting periods, with phishing schemes consistently ranking among the top three threats. As digital banking, SingPass logins, and e-commerce become woven into daily life, attackers have refined their tactics to mimic local banks, government agencies, delivery services, and even MOM or IRAS notifications.

This guide explains exactly how phishing attacks work in the Singapore context, the most common variants you will encounter, the red flags that give them away, and the practical steps you can take to protect yourself, your family, and your business.

What Are Phishing Attacks?

Phishing is a form of social engineering where criminals impersonate a trusted organisation or person to trick victims into revealing sensitive information, clicking malicious links, or transferring money. In Singapore, phishing typically arrives through SMS, WhatsApp, email, phone calls, or fake websites that closely resemble DBS, OCBC, UOB, Singpass, IRAS, ICA, or popular platforms like Shopee and Lazada.

The end goal is almost always one of three outcomes:

1. Stealing login credentials (banking, Singpass, corporate email).
2. Harvesting one-time passwords (OTPs) or 2FA codes in real time.
3. Convincing the victim to authorise a transfer or install a malicious app (malware-enabled scams).

Why Singapore Is a Prime Target

Singapore's high smartphone penetration, strong digital banking adoption, and concentration of wealth make it an attractive target. A few factors amplify the risk:

• Digital-first government services: Singpass is the single key to over 2,700 services, making it a high-value target.
• PayNow and instant transfers: Funds move in seconds, leaving little time for banks to reverse fraudulent transactions.
• Multilingual population: Scammers can craft messages in English, Mandarin, Malay, or Tamil to broaden their reach.
• Cross-border syndicates: Many operations are run from overseas call centres, complicating enforcement.

The Most Common Phishing Attacks in Singapore

1. Bank Impersonation SMS and Emails

You receive an SMS claiming your DBS, OCBC, UOB, or Standard Chartered account is locked, that an unauthorised transaction has occurred, or that your card is about to expire. The link leads to a near-perfect clone of the bank's login page. After entering your credentials, a fake OTP page captures your one-time password while attackers log in to the real site simultaneously.

2. Singpass and Government Agency Scams

Fake messages claiming to be from Singpass, IRAS (tax refund or unpaid tax), ICA (passport renewal), MOM (work pass issues), or even Singapore Police are common. They often invoke urgency: "Your Singpass will be suspended within 24 hours."

3. Parcel Delivery and SingPost Scams

"Your parcel could not be delivered. Please pay S$1.50 redelivery fee." The tiny fee is a smokescreen; the real purpose is to capture your card details and CVV, which are then used for much larger fraudulent purchases.

4. Job Scams on Telegram and WhatsApp

Victims are offered easy part-time tasks like liking videos or reviewing hotels. Small payouts build trust before the scammer asks for a "deposit" to unlock higher-paying tasks. Once paid, the scammer disappears.

5. Malware-Enabled Android Scams

A particularly damaging variant in Singapore involves convincing victims to sideload an APK file (often disguised as a food delivery, pet grooming, or e-commerce app). The malware then captures banking credentials and SMS OTPs, draining accounts overnight. This led to MAS introducing the Shared Responsibility Framework in 2024.

6. Investment and Cryptocurrency Phishing

Fake trading platforms, often promoted through Facebook ads or romance scams ("pig butchering"), lure victims into depositing money into platforms that show fake gains before locking withdrawals.

Red Flags: How to Recognise a Phishing Attempt

Most phishing messages share recognisable patterns. Train yourself and your colleagues to pause whenever you see:

• Urgency or fear: "Your account will be suspended in 24 hours."
• Unexpected links: Especially shortened or misspelled domains (e.g., dbs-secure.com, sing-pass.sg, iras-refund.com).
• Requests for OTPs, passwords, or NRIC: No legitimate Singapore bank or government agency will ever ask for these via SMS, email, or call.
• Generic greetings: "Dear Customer" instead of your name.
• Slightly off branding: Wrong logos, low-resolution images, awkward English, or odd punctuation.
• Unusual sender numbers: Legitimate banks in Singapore now use the SMS Sender ID Registry. If the sender shows a regular mobile number instead of the bank's official ID, treat it as a scam.
• Requests to install APK files or grant accessibility permissions.

How to Verify a Suspicious Message in 60 Seconds

1. Do not click any link in the message.
2. Open the official banking app directly from your phone (not via the message).
3. Check official channels: ScamShield app, scamshield.gov.sg, or call the bank's hotline printed on the back of your card.
4. If the message claims to be from a government agency, log in to Singpass independently.
5. Forward suspicious SMS to 9-SPF-SPF-SPF (97965979) or report via ScamShield.

Phishing Attack Types Compared

How to Protect Yourself: Practical Steps

1. Lock Down Your Banking Apps

All major Singapore banks now offer a "Money Lock" or "Security Shield" feature that ring-fences a portion of your savings so it cannot be transferred digitally. Enable it. Also activate kill-switches for instant card and account freezing.

2. Use the ScamShield App

Developed by the National Crime Prevention Council and GovTech, ScamShield filters scam SMS and calls automatically. It is free and available for both iOS and Android.

3. Never Sideload Apps

Only install apps from the official Apple App Store or Google Play. If anyone, friend, "customer service," or a website, asks you to install an APK file, it is almost certainly a scam.

4. Strengthen Your Authentication

• Use Singpass Face Verification where available.
• Enable biometric login on banking apps.
• Use a password manager so every account has a unique, strong password.
• Turn on hardware security keys for high-value accounts (Gmail, Microsoft, crypto exchanges).

5. Inspect Links Before Clicking

Hover over links on desktop or long-press on mobile to preview the actual URL. Be especially wary of shortened links from unknown senders. When you do need to share or shorten URLs for legitimate marketing or personal use, use a reputable service. Lunyb, for instance, provides transparent link analytics and click tracking so recipients can trust where a link will take them. For a broader look at trustworthy options, see our 2026 buyer's guide to URL shorteners.

6. Use Secure DNS and a Modern Browser

Enable encrypted DNS (DNS over HTTPS) in Chrome, Edge, or Firefox to block known phishing domains at the network level. Browsers like Brave and Safari also include built-in phishing and tracker protection.

7. Educate Family Members

Elderly relatives and teenagers are disproportionately targeted. Have regular conversations about scams, share examples, and make it clear they can call you to verify any suspicious message without judgment.

What to Do If You've Been Phished

1. Act immediately — minutes matter.
2. Call your bank's 24/7 fraud hotline and freeze the account.
3. Use the in-app kill-switch if available.
4. Change passwords for affected accounts from a clean device.
5. File a police report at any Neighbourhood Police Centre or via the SPF e-Services portal.
6. Report the scam to ScamShield (scamshield.gov.sg).
7. Notify Singpass support if your Singpass may have been compromised: call 6335 3533.
8. Check your credit report through Credit Bureau Singapore for unauthorised loan applications.
9. If malware was installed, factory-reset the affected device.

Phishing Protection for Singapore Businesses

SMEs in Singapore face the same threats at scale. Business email compromise (BEC), where attackers impersonate a CEO or supplier to redirect invoice payments, has caused multi-million-dollar losses to local firms.

Recommended Controls

• Deploy email authentication: SPF, DKIM, and DMARC (enforced policy).
• Enable advanced anti-phishing in Microsoft 365 or Google Workspace.
• Run quarterly phishing simulations for all staff.
• Establish a callback policy: any change to supplier bank details must be verified by phone using a number on file.
• Segment finance systems and require dual approval for transfers above a set threshold.
• Subscribe to CSA SingCERT advisories.

The Singapore Regulatory Landscape

Singapore has responded to the phishing surge with several initiatives worth knowing:

• Shared Responsibility Framework (SRF): Since December 2024, banks and telcos can be held partly liable for phishing losses if they fail their duties.
• SMS Sender ID Registry (SSIR): All organisations sending SMS to Singapore numbers must register their Sender ID; unregistered ones appear as "Likely-SCAM."
• Anti-Scam Command (ASCom): A dedicated Singapore Police Force unit that works with banks for rapid fund recovery.
• Money Lock: Now offered by all major retail banks.

FAQ

How common are phishing attacks in Singapore?

Very common. Phishing-related scams consistently appear in the top three scam types reported each year, with thousands of cases and hundreds of millions in losses annually. Almost every Singapore mobile user receives multiple phishing attempts per month.

Will my bank refund me if I fall for a phishing scam?

It depends. Under the Shared Responsibility Framework introduced in 2024, banks and telcos may bear part of the loss if they failed specific anti-scam duties. However, if you voluntarily provided your OTP or installed an unauthorised app, recovery is often partial or denied. Always report within minutes for the best chance of fund recall.

How can I tell if an SMS is really from my bank?

Legitimate banks now use registered Sender IDs (e.g., "DBS," "OCBC," "UOB") and will never include clickable links asking you to log in. If a message contains a link or threatens immediate account closure, treat it as a scam. When in doubt, open the bank's official app directly.

Is it safe to click shortened links?

Shortened links are not inherently dangerous, they are widely used for marketing, analytics, and convenience. The key is the source. A shortened link from a trusted sender or a reputable platform like Lunyb is fine; one from an unknown SMS claiming to be your bank is not. You can preview most shortened URLs by adding a "+" at the end or using a link-expander tool before clicking.

What is the single most important habit to avoid phishing?

Never enter credentials or OTPs into a page you reached via a link in a message. Always navigate to banking and government services by opening the official app or typing the URL yourself. This one habit defeats the majority of phishing attempts.

Final Thoughts

Phishing in Singapore is sophisticated, localised, and constantly evolving, but it is not unbeatable. The vast majority of successful attacks rely on a single moment of urgency or distraction. By slowing down, verifying through official channels, locking down your banking and Singpass accounts, and educating those around you, you remove almost all of the attacker's leverage. Combine these habits with the tools the government and banks now provide, ScamShield, Money Lock, registered Sender IDs, and you turn a high-risk environment into a manageable one.

Stay alert, stay sceptical of urgency, and when in doubt, hang up, delete, and verify.