Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have surged into one of the most costly cybercrime categories tracked by the Singapore Police Force, with victims losing hundreds of millions of dollars each year to fraudulent SMS, emails, and fake websites. Whether you bank with DBS, use PayNow, receive parcels from Ninja Van, or file taxes with IRAS, scammers are impersonating the brands you trust every single day. This guide breaks down how these attacks work, how to recognize them, and exactly what to do when one lands in your inbox.

What Are Phishing Attacks?

Phishing is a type of social engineering attack where criminals impersonate a legitimate organization to trick you into revealing sensitive information such as passwords, OTPs, credit card numbers, or SingPass credentials. In Singapore, phishing typically arrives through SMS ("smishing"), email, WhatsApp messages, phone calls ("vishing"), or fake advertisements on Facebook and Instagram.

The goal is almost always the same: get you to click a link, enter your details on a fake site, or authorize a transaction. Once attackers have your credentials or OTP, they can drain bank accounts, hijack e-wallets, or take over your digital identity within minutes.

The Scale of Phishing in Singapore

According to the Singapore Police Force's annual scam reports, phishing scams consistently rank among the top five scam types by both case volume and monetary loss. In recent years, victims have collectively lost well over S$100 million annually to phishing-related fraud, with individual cases sometimes exceeding six-figure losses.

Common impersonated entities include:

• Local banks: DBS/POSB, OCBC, UOB, Standard Chartered, Citibank
• Government agencies: IRAS, ICA, MOM, SingPost, Ministry of Health
• Delivery services: SingPost, Ninja Van, J&T, Shopee Xpress
• Telcos: Singtel, StarHub, M1
• E-commerce and payment platforms: Shopee, Lazada, PayNow, GrabPay

Common Types of Phishing Attacks in Singapore

1. SMS Phishing (Smishing)

The most prevalent form. You receive a text claiming your bank account is locked, a parcel is undelivered, or your IRAS refund is pending. The message includes a shortened or lookalike link (e.g., dbs-secure-sg.com instead of dbs.com.sg).

2. Email Phishing

Fake emails from "customer service" of banks, Netflix, Microsoft 365, or courier companies. These often include company logos, spoofed sender addresses, and urgent language demanding immediate action.

3. WhatsApp and Social Media Scams

Impersonators pose as friends, government officials, or even MAS staff. "Job scams" on WhatsApp and Telegram remain a top vector, where victims are lured into fake part-time work that eventually asks for bank credentials or "deposits."

4. Malicious Android Apps (APK Scams)

A Singapore-specific epidemic. Scammers advertise cheap seafood, cleaning services, or pet grooming on Facebook, then push victims to download an APK file outside the Play Store. The app grants attackers full access to the phone, intercepting SMS OTPs and enabling unauthorized bank transfers.

5. Voice Phishing (Vishing)

Callers pretending to be from the police, ICA, or China authorities accuse victims of money laundering or unpaid fines, demanding transfers to "safety accounts."

6. Fake QR Codes (Quishing)

Stickers placed over legitimate QR codes at hawker centres, bubble tea shops, or on surveys lead to malicious payment pages that steal card details.

Red Flags: How to Recognize a Phishing Attempt

Almost every phishing message shares a predictable set of warning signs. Train yourself to spot at least three of these before clicking anything:

1. Urgency and fear: "Your account will be suspended in 24 hours," or "Immediate action required."
2. Unusual sender addresses: Emails from @dbs-support-sg.net instead of @dbs.com.
3. Suspicious links: Shortened URLs, domains with hyphens, misspellings (iras-gov.sg-refund.com), or non-.gov.sg addresses claiming to be from a government body.
4. Requests for OTP, password, or SingPass credentials: No legitimate bank or government agency will ever ask for these.
5. Poor grammar or awkward phrasing: Though AI has made phishing text more polished, small errors still appear.
6. Unexpected attachments: Especially .apk, .exe, .zip, or .html files.
7. Too-good-to-be-true offers: Free vouchers, cash rebates, or investments promising guaranteed returns.
8. Requests to install apps outside official app stores.

Real Examples of Singapore Phishing Attacks

Example 1: The "OCBC" SMS Scam

In one of Singapore's largest phishing incidents, nearly 800 OCBC customers lost more than S$13 million after receiving SMSes claiming there were issues with their accounts. The messages appeared in the same SMS thread as legitimate bank notifications, making them extremely convincing.

Example 2: The IRAS Tax Refund Scam

A common seasonal attack around tax filing season (March-April). Victims receive an email or SMS: "You are eligible for a tax refund of S$438.20. Click here to claim." The link leads to a fake SingPass login page that harvests credentials.

Example 3: The Parcel Delivery Scam

"Your SingPost parcel could not be delivered. Please pay S$0.85 redelivery fee." The small amount is a psychological trick; entering card details gives scammers full card data for larger fraudulent purchases.

Phishing Attack Types Compared

Attack Type	Channel	Common Bait	Risk Level
Smishing	SMS	Bank alerts, parcel delivery	Very High
Email Phishing	Email	Account verification, invoices	High
APK Malware	Facebook ads, WhatsApp	Cheap food, services, jobs	Critical
Vishing	Phone call	Police, ICA, courier impersonation	High
Quishing	QR codes	Payments, surveys, parking	Medium
Social Media	Facebook, Instagram, Telegram	Investment, job offers, giveaways	High

How to Protect Yourself: A Step-by-Step Guide

1. Enable the ScamShield app. Developed by the Singapore Police Force and NCPC, it blocks known scam calls and SMSes automatically.
2. Use the Money Lock feature offered by DBS, OCBC, UOB, and other banks to ring-fence a portion of your savings from digital transfers.
3. Never click links in SMS or email claiming to be from your bank. Instead, open the official banking app directly.
4. Verify domains carefully. Singapore government sites always end in .gov.sg. Banks use their exact registered domain (dbs.com.sg, ocbc.com, uob.com.sg).
5. Never install APK files or apps from links shared over WhatsApp, SMS, or social media ads. Only use Google Play or the Apple App Store.
6. Turn on two-factor authentication (2FA) for email, SingPass, and all financial accounts. Prefer app-based authenticators over SMS OTP where possible.
7. Enable transaction alerts on all banking apps so you're notified of every debit instantly.
8. Use a password manager to generate unique credentials for each site, so one compromised password doesn't cascade.
9. Keep your phone updated. Apply iOS and Android security patches promptly.
10. Educate family members, especially elderly parents, who are frequently targeted.

Safe Link Handling and URL Verification

Because so many phishing attacks depend on tricking you into clicking a disguised link, understanding how URLs work is one of the most powerful defenses. Before tapping any link:

• Long-press (mobile) or hover (desktop) to preview the full destination URL.
• Look for the exact registered domain: the part immediately before .com, .sg, or .gov.sg. Everything before that can be faked.
• Watch for character substitution: rn that looks like m, or Cyrillic letters that mimic Latin ones.
• Use link expanders or preview tools to see where shortened URLs actually lead.

If you're a business or content creator sending links to customers, use a reputable link management platform that gives you traceable, branded, and analytics-enabled short links. Trusted shorteners like Lunyb let you create clean links you can proudly share while being able to monitor click behavior for suspicious activity. See our detailed Lunyb honest review and the broader 2026 URL shortener buyer's guide for comparisons with alternatives like Rebrandly.

What to Do If You've Been Phished

Speed is everything. If you suspect you've entered credentials into a phishing site or authorized a fraudulent transfer:

1. Call your bank immediately. All major Singapore banks operate 24/7 anti-fraud hotlines. Request an immediate freeze on accounts and cards.
2. Kill switch: DBS, OCBC, UOB, and Standard Chartered all offer in-app "kill switches" that instantly lock your accounts.
3. Change passwords for the affected account, your email, and SingPass. Do this from a different, trusted device if you suspect malware.
4. Report the scam to the Singapore Police Force via the ScamShield helpline at 1799 or file a report at police.gov.sg/iwitness.
5. Factory reset your phone if you installed a suspicious APK. Do not restore from a recent backup.
6. Notify SingPass at 6335 3533 if your SingPass credentials were exposed.
7. Monitor credit reports via Credit Bureau Singapore for any unauthorized loans or credit applications.

How Businesses in Singapore Can Prevent Phishing

For SMEs and larger organizations, phishing is often the first step in ransomware and business email compromise (BEC) attacks. Recommended controls include:

• Deploy email authentication protocols: SPF, DKIM, and DMARC with a reject policy.
• Enable advanced threat protection on Microsoft 365 or Google Workspace.
• Conduct quarterly phishing simulation exercises for staff.
• Implement passwordless or FIDO2 authentication for critical systems.
• Use branded, verifiable short links in customer communications so recipients learn to trust only your official domain.
• Maintain an incident response plan aligned with CSA (Cyber Security Agency of Singapore) guidelines.

Frequently Asked Questions

Are phishing SMSes in Singapore illegal?

Yes. Sending phishing messages is a criminal offense under the Computer Misuse Act and the Penal Code. Offenders can face fines and imprisonment. Singapore also implemented the SMS Sender ID Registry (SSIR), which blocks unregistered alphanumeric sender IDs used by scammers.

Will my bank refund me if I fall for a phishing scam?

It depends. Under Singapore's Shared Responsibility Framework, banks and telcos may bear part of the loss if they failed to implement required safeguards. However, if you willingly disclosed your OTP or credentials, recovery is difficult. Always report immediately to maximize your chances.

How can I tell if a website is a legitimate Singapore government site?

Legitimate Singapore government websites end in .gov.sg. Look for the official "Government of Singapore" masthead at the top of the page and check the URL carefully. If in doubt, navigate directly by typing the agency's name into Google rather than clicking a link.

What is the ScamShield app and should I install it?

ScamShield is a free anti-scam app developed by the National Crime Prevention Council and the Singapore Police Force. It filters known scam SMSes and blocks scam calls using a regularly updated database. It's highly recommended for all Singapore residents, especially those with elderly family members.

Can antivirus software stop phishing attacks?

Antivirus and mobile security apps help detect malicious APKs and known phishing sites, but they cannot stop social engineering. The most reliable defense is user awareness combined with strong 2FA, transaction limits, and account safeguards like Money Lock.

Final Thoughts

Phishing attacks in Singapore continue to evolve, with scammers combining psychological manipulation, spoofed sender IDs, malicious apps, and AI-generated content to target victims. But every successful phishing attack still relies on one thing: the victim clicking, downloading, or disclosing something they shouldn't. By learning the red flags, verifying URLs, using ScamShield, and locking down your bank accounts, you can neutralize the vast majority of these threats before they cause harm.

Stay skeptical, verify twice, and remember: no legitimate organization in Singapore will ever ask for your OTP, password, or SingPass credentials over SMS, email, or phone.