Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have surged dramatically over the past few years, with the Singapore Police Force reporting over S$660 million lost to scams in 2023 alone — a significant portion stemming from phishing. From fake DBS SMS alerts to impersonated SingPost delivery notices, scammers are exploiting trust in familiar local brands to steal credentials, drain bank accounts, and compromise identities. This guide explains exactly how phishing works in the Singapore context, the red flags to watch for, and the practical steps you can take to protect yourself and your business.

What Is Phishing? A Quick Definition

Phishing is a form of social engineering where attackers impersonate trusted organisations — banks, government agencies, delivery services, or employers — to trick victims into revealing sensitive information such as passwords, OTPs, NRIC numbers, or credit card details. The attack usually arrives via email, SMS (smishing), WhatsApp, phone call (vishing), or a fraudulent website that looks nearly identical to the real thing.

In Singapore, phishing is particularly effective because residents routinely interact with digital services like Singpass, PayNow, DBS digibank, OCBC, and government portals — making impersonation campaigns highly believable when crafted with local branding and language.

The State of Phishing Attacks in Singapore

According to the Cyber Security Agency of Singapore (CSA) and the Singapore Police Force's annual scam reports, phishing-related scams consistently rank among the top cybercrime categories. Key statistics from recent years include:

Phishing scams accounted for thousands of reported cases in 2023, with losses exceeding S$14 million in that category alone.
Banking-related phishing remains the most damaging, with criminals using OTP harvesting to bypass two-factor authentication.
SMS phishing (smishing) targeting SingPost, IRAS, and ICA delivery or tax notices has spiked sharply.
Job scam phishing, often via Telegram and WhatsApp, has emerged as a leading vector among younger Singaporeans.

The Monetary Authority of Singapore (MAS) has responded by mandating Shared Responsibility Frameworks between banks and telcos, but individual vigilance remains the strongest defence.

Common Types of Phishing Attacks Targeting Singaporeans

1. Bank Impersonation Phishing

Attackers send SMS or emails claiming to be from DBS, UOB, OCBC, Standard Chartered, or Citibank. Typical messages warn of "suspicious transactions," "account suspension," or "reward redemption" and contain a link to a fake login page. Once you enter your credentials and OTP, the criminals immediately drain your account.

2. Government and Singpass Impersonation

Fraudsters impersonate IRAS (tax refunds), ICA (passport renewal), MOM (work pass updates), or Singpass itself. Messages may threaten penalties or promise refunds to create urgency. Genuine government agencies in Singapore use the gov.sg domain and never request login credentials via SMS.

3. Delivery and Logistics Scams

Fake SingPost, Ninja Van, Shopee, or Lazada messages claim a parcel is "undeliverable" and require a small "redelivery fee." The payment page harvests your card details. This is one of the fastest-growing phishing types in Singapore.

4. Job Offer and Investment Phishing

Unsolicited WhatsApp or Telegram messages offer high-paying part-time jobs or investment opportunities. Victims are directed to clone websites mimicking legitimate trading platforms or are asked to complete "tasks" that require uploading personal documents.

5. Spear Phishing and Business Email Compromise (BEC)

Targeted attacks against SME finance staff in Singapore often involve attackers impersonating CEOs or suppliers to request urgent wire transfers. BEC losses in Singapore frequently exceed S$100,000 per incident.

Red Flags: How to Recognize a Phishing Attempt

Most phishing messages share common warning signs. Train yourself to pause and check for these red flags before clicking anything:

Urgency or threats — "Your account will be suspended in 24 hours" or "Immediate action required."
Suspicious sender details — email addresses with misspellings (dbs-sg.com instead of dbs.com.sg) or unknown phone numbers.
Generic greetings — "Dear Customer" instead of your actual name.
Requests for OTPs, passwords, or NRIC — legitimate banks and government agencies never ask for these via SMS or email.
Mismatched or shortened links — hover over the link to see the real destination. Be cautious of unfamiliar shortened URLs.
Spelling and grammatical errors — though modern AI-generated phishing has reduced these significantly.
Unexpected attachments — especially .zip, .exe, or macro-enabled Office files.
Payment requests for small "fees" — particularly common in delivery scams.

How to Verify a Suspicious Link Safely

Before clicking any link in an unexpected message, take these steps:

Hover before you click. On desktop, hovering reveals the true destination URL in the bottom-left corner of your browser.
Check the domain carefully. Look at the part right before the first single slash. "dbs.com.sg.login-secure.xyz" is NOT DBS — the real domain is login-secure.xyz.
Use a link scanner. Services like VirusTotal, Google Safe Browsing, or urlscan.io can analyse a link without you visiting it.
Open the official app or type the URL manually. If your bank claims something is wrong, log in via the official app — never through the message link.
Use trustworthy link shorteners with previews. Reputable shorteners like Lunyb provide click analytics and let you verify destinations, which is helpful when you're sharing links and want recipients to trust them. Learn more in our honest review of Lunyb.

Phishing Vectors Compared: Risk and Detection

Vector	Common in Singapore?	Risk Level	Easiest Red Flag
SMS (Smishing)	Very High	High	Unknown number with link
Email	High	High	Mismatched sender domain
WhatsApp/Telegram	Very High	High	Unsolicited job/investment offer
Phone calls (Vishing)	High	Very High	Caller asks for OTP/NRIC
QR codes (Quishing)	Growing	Medium	QR in unsolicited email/sticker
Fake mobile apps	Medium	Very High	App sideloaded from link, not Play Store

How to Protect Yourself from Phishing in Singapore

Enable Strong Authentication

Use Singpass face verification, hardware security keys (YubiKey), or authenticator apps (Google Authenticator, Authy) instead of SMS OTPs where possible. Major Singapore banks now offer in-app digital tokens that are far more resistant to phishing than SMS codes.

Activate Banking Safeguards

All major Singapore banks now offer features like:

Money Lock (DBS, OCBC, UOB) — ring-fence funds that cannot be transferred digitally.
Kill Switch — instantly freeze your account if you suspect compromise.
Transaction limits — set low daily transfer limits and require cooling-off periods for increases.

Use Encrypted DNS and Safe Browsing

Enable encrypted DNS (such as Cloudflare 1.1.1.1 for Families or Quad9) on your devices. These services block known phishing domains at the network level before your browser even loads them. Chrome, Edge, and Safari also have built-in Safe Browsing — keep it enabled.

Keep Software Updated

Phishing attacks often pair with malware. Keep your iOS, Android, Windows, and browser versions updated. Singapore's CSA regularly publishes advisories on vulnerabilities being actively exploited.

Train Yourself and Your Team

For businesses, run quarterly phishing simulations. For individuals, follow CSA's SG Cyber Safe and ScamShield channels for the latest scam patterns. Download the official ScamShield app — it blocks known scam numbers and lets you report suspicious messages directly.

Be Careful with Shortened Links You Share

If you run a business, the way you share links influences whether customers trust them. Use a reputable shortener with branded domains and analytics so recipients can verify legitimacy. Our 2026 buyer's guide to URL shorteners compares the leading options, and our Rebrandly review covers one of the most popular branded-link platforms.

What to Do If You've Been Phished

If you suspect you've clicked a phishing link or shared credentials, act immediately. Every minute matters:

Activate your bank's Kill Switch or call the 24/7 hotline (DBS: 1800-339-6963, OCBC: 1800-363-3333, UOB: 1800-222-2121).
Change all affected passwords — start with banking, email, and Singpass.
Revoke active sessions in your email and banking apps.
Run a malware scan on your device using Malwarebytes, Bitdefender, or Microsoft Defender.
Report the scam to the Singapore Police via the ScamShield app or call 1800-722-6688 (Anti-Scam Helpline).
File a police report at eservices.police.gov.sg if money was lost.
Notify your contacts in case attackers use your compromised account to phish others.
Monitor your credit via Credit Bureau Singapore for unauthorised loan applications.

Phishing Prevention Checklist for Singapore Residents

✅ Never share OTPs, passwords, or Singpass credentials with anyone.
✅ Install the ScamShield app and enable call/SMS filtering.
✅ Use in-app digital tokens instead of SMS OTPs.
✅ Enable Money Lock for your emergency funds.
✅ Set low daily transfer limits.
✅ Verify every unexpected message via the official app or hotline.
✅ Keep your devices and browsers updated.
✅ Use a password manager so each account has a unique strong password.
✅ Bookmark official banking and government websites — don't search for them.
✅ Educate elderly family members, who are disproportionately targeted.

Phishing Trends to Watch in 2025 and Beyond

Phishing in Singapore is evolving rapidly. Three trends deserve special attention:

AI-generated phishing. Generative AI is producing grammatically perfect, hyper-personalised phishing emails in English, Mandarin, Malay, and Tamil — eliminating one of the classic red flags.

Deepfake vishing. Voice cloning is being used to impersonate family members or executives. If a caller asks for money or sensitive data, verify via a separate channel.

QR code phishing (quishing). Fake QR codes on parking signs, hawker stalls, and posters redirect to malicious payment pages. Always confirm the URL preview before paying.

Frequently Asked Questions

How do I report a phishing SMS or email in Singapore?

Forward suspicious SMS to 7726 (SPAM) or report directly through the ScamShield app. Phishing emails can be reported to your email provider as spam, and to your impersonated organisation (most banks have a dedicated email like phishing@dbs.com). For financial loss, call the Anti-Scam Helpline at 1800-722-6688 or file a police report online.

Will my bank refund me if I fall for a phishing scam?

Under Singapore's Shared Responsibility Framework (effective from 2024), banks and telcos may bear part of the loss if they failed to meet specific anti-scam duties. However, if you knowingly disclosed your OTP or password, recovery is often limited. Acting within minutes via the Kill Switch significantly improves recovery odds.

Is it safe to click shortened links?

Shortened links themselves aren't dangerous — they're just redirects. The risk depends on the destination. Use a link preview tool, hover to see the expanded URL, or rely on shorteners with built-in safety scanning and analytics. Reputable platforms like Lunyb give both senders and recipients more transparency.

What's the difference between phishing, smishing, and vishing?

Phishing typically refers to fraudulent emails. Smishing uses SMS messages, and vishing uses voice calls (including AI-generated deepfake voices). All three use the same social-engineering playbook — urgency, authority, and fear — to extract credentials or money.

How can elderly Singaporeans be protected from phishing?

Set up Money Lock on their savings, enable the lowest possible transfer limits, install ScamShield, and arrange for a trusted family member to be notified of large transactions. The Silver Infocomm Initiative and CSA's Go Safe Online campaign offer free workshops specifically for seniors.

Final Thoughts

Phishing attacks in Singapore are becoming more sophisticated, but the fundamentals of defence haven't changed: pause, verify, and never share credentials. By combining technical safeguards (digital tokens, Money Lock, encrypted DNS, ScamShield) with healthy scepticism toward unsolicited messages, you can dramatically reduce your risk. Share this guide with friends and family — especially those less familiar with current scam tactics. In the fight against phishing, an informed community is the strongest firewall.