Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have surged into one of the most damaging categories of cybercrime, with the Singapore Police Force reporting hundreds of millions of dollars lost to scams each year. From fake DBS SMS alerts to convincing SingPost delivery notifications, phishing schemes now target every resident with a mobile phone or email address. Understanding how these attacks work — and how to recognise them before you click — is essential for anyone who banks, shops, or works online in Singapore.

What Is a Phishing Attack?

A phishing attack is a form of social engineering where criminals impersonate a trusted entity — a bank, government agency, courier, or employer — to trick victims into revealing sensitive information or transferring money. In Singapore, phishing typically arrives via SMS, WhatsApp, email, or fake websites that closely mimic legitimate local brands.

The attacker's goal is usually one of three things: harvest login credentials, capture one-time passwords (OTPs) to drain bank accounts, or install malware that gives them remote control of your device. Because Singaporeans are highly digital and rely heavily on services like Singpass, PayNow, and internet banking, the attack surface is unusually large.

Why Singapore Is a Prime Target

Singapore's high smartphone penetration, wealthy population, and near-universal use of digital banking make it especially attractive to phishing syndicates operating out of the region and beyond. Several local factors amplify the risk:

• Ubiquitous digital services: Nearly every resident uses Singpass, SingHealth, iRAS, and at least one local bank app.
• SMS-based OTPs: Many services still rely on SMS OTPs, which can be phished in real time.
• Trusted local brands: Attackers impersonate DBS, OCBC, UOB, SingPost, IRAS, LTA, and MOM — organisations residents inherently trust.
• Multilingual population: Scam messages are crafted in English, Mandarin, Malay, and Tamil to widen reach.

The Cyber Security Agency of Singapore (CSA) and the Monetary Authority of Singapore (MAS) have introduced measures like the SMS Sender ID Registry and kill-switches on banking apps, but attackers continue to adapt.

Common Types of Phishing Attacks in Singapore

1. SMS Phishing (Smishing)

Text messages claiming to be from your bank, SingPost, or a government agency. Typical examples: "Your DBS account has been suspended. Verify at dbs-verify.com" or "SingPost: Your parcel is on hold. Pay S$1.20 customs fee."

2. Email Phishing

Emails impersonating IRAS during tax season, CPF Board, or LinkedIn recruiters offering fake jobs. These often contain PDF attachments or links to credential-harvesting pages.

3. WhatsApp and Telegram Scams

Fake job offers, investment opportunities, or "friend in trouble" messages. Attackers frequently hijack a WhatsApp account via a phished verification code, then message the victim's contacts.

4. Voice Phishing (Vishing)

Callers pretending to be from the Singapore Police Force, MOH, or China officials, claiming you are involved in a crime and must transfer funds to a "safe account."

5. QR Code Phishing (Quishing)

Fake QR codes stuck over legitimate ones at hawker centres, on parking meters, or in survey flyers. Scanning leads to a fake PayNow or payment page.

6. Malicious Android APKs

Victims are told to download a "secure app" to complete a purchase or verify identity. The APK is actually malware that reads SMS OTPs and drains bank accounts — a technique responsible for tens of millions of dollars in losses in Singapore.

Red Flags: How to Recognise a Phishing Attempt

Most phishing messages share tell-tale signals. Train yourself to look for these before clicking anything:

1. Urgency or fear: "Your account will be suspended in 24 hours." Legitimate banks never rush you like this.
2. Suspicious sender IDs: Real DBS SMS come from "DBS" via the SSIR registry. A message from a +65 mobile number claiming to be DBS is a scam.
3. Mismatched URLs: Hover over links. "dbs.com.sg-login.info" is not DBS.
4. Requests for OTPs, passwords, or Singpass credentials: No legitimate agency ever asks for these.
5. Unexpected attachments or APK downloads: Never install apps outside the Google Play Store or Apple App Store.
6. Poor grammar or odd phrasing: Though AI-generated scams are getting better, many still contain subtle errors.
7. Payment requests to personal PayNow numbers: Government agencies do not collect fees via personal accounts.

Phishing Message Examples Seen in Singapore

Impersonated Brand	Typical Message	What They Want
DBS / POSB	"Unusual login detected. Verify identity: [link]"	Internet banking login + OTP
SingPost	"Parcel undelivered. Pay S$1.20 redelivery fee."	Credit card details
IRAS	"You are eligible for a S$680 tax refund. Claim here."	Singpass credentials
LTA / OneMotoring	"Outstanding ERP charge. Pay before summons."	Card details or APK install
MOH / ICA	"Health declaration required for re-entry."	Personal data + Singpass
StarHub / Singtel	"Loyalty points expiring. Redeem S$200 voucher."	Card details

How to Verify a Suspicious Message

When in doubt, verify through an independent channel. Never use the phone number or link inside the suspicious message itself.

1. Go direct: Open your bank's official app or type the URL manually (e.g., dbs.com.sg).
2. Call the official hotline: Use the number printed on the back of your ATM card or on the agency's official website.
3. Check ScamShield: The ScamShield app, run by the Singapore Police and Open Government Products, flags known scam numbers and links.
4. Use the Anti-Scam Helpline: Call 1799 if you are unsure whether something is a scam.
5. Inspect shortened links carefully: If a link is shortened, use a link preview service before clicking. Reputable shorteners like Lunyb provide transparent redirects and analytics, whereas scam links often use throwaway domains that hide their destination.

Protecting Yourself: Practical Defences

Secure Your Accounts

• Enable hardware security keys or app-based authenticators (Google Authenticator, Authy) instead of SMS OTPs where possible.
• Turn on the banking app "kill switch" and Money Lock features offered by DBS, OCBC, and UOB to ring-fence savings.
• Set daily transfer limits to the lowest amount you realistically need.
• Use unique, strong passwords managed by a reputable password manager.

Harden Your Devices

• Never sideload APKs. Keep "Install unknown apps" disabled on Android.
• Keep iOS and Android up to date — most exploits target outdated systems.
• Install ScamShield and enable call/SMS filtering.
• Use an encrypted DNS resolver (like Cloudflare 1.1.1.1 or Quad9) to block known phishing domains at the network level.

Think Before You Click

• Bookmark your bank, IRAS, and Singpass websites. Access them only through bookmarks or official apps.
• Treat every unexpected message as suspicious until proven otherwise.
• If a link looks unusual, expand it or preview it before opening. If you frequently share or receive shortened links, learn how legitimate shorteners work — our 2026 buyer's guide to URL shorteners explains what to look for.

What to Do If You've Been Phished

Speed matters. If you suspect you've fallen for a phishing attack, act within minutes:

1. Freeze your accounts: Use your bank's kill switch immediately via the app, hotline, or ATM.
2. Call your bank's 24/7 fraud hotline: DBS 1800-339-6963, OCBC 1800-363-3333, UOB 1800-222-2121.
3. Change passwords: Start with your email, Singpass, and any accounts sharing the same password.
4. Report to the police: File a report at any Neighbourhood Police Centre or online at police.gov.sg. Call the Anti-Scam Helpline at 1799.
5. Uninstall suspicious apps: If you installed an APK, put the phone in airplane mode, back up important data, and perform a factory reset.
6. Notify contacts: If your WhatsApp or email was compromised, warn friends and family who may be targeted next.

Phishing Trends to Watch in 2026

Attackers are evolving fast. Several trends are shaping the phishing landscape in Singapore:

• AI-generated messages: Grammar is nearly perfect; scams are personalised using leaked data.
• Deepfake voice calls: Cloned voices of family members or executives request urgent transfers.
• Business Email Compromise (BEC): SMEs are increasingly targeted with fake invoice redirects.
• Malicious browser extensions: Fake "security" extensions steal banking session cookies.
• QR-code overlays: Physical stickers placed over legitimate QR codes at merchants and public infrastructure.

Guidance for Businesses in Singapore

Under the PDPA and MAS Technology Risk Management guidelines, organisations have a duty to protect customer data. Practical steps include:

• Register your business SMS sender IDs with the Singapore SMS Sender ID Registry (SSIR).
• Implement DMARC, SPF, and DKIM on all email domains.
• Run quarterly phishing simulations for staff.
• Use branded, verifiable short links for marketing campaigns so customers can distinguish real communications from scams. Learn more in our Lunyb review or compare tools in our Rebrandly 2026 review.
• Provide clear reporting channels for customers who receive suspicious messages claiming to be from your brand.

Frequently Asked Questions

How common are phishing attacks in Singapore?

Extremely common. The Singapore Police Force consistently ranks phishing scams among the top scam types by both number of cases and value lost, with hundreds of millions of dollars lost annually. Nearly every mobile user in Singapore has received at least one phishing SMS.

Will my bank reimburse me if I'm phished?

Under the Shared Responsibility Framework introduced by MAS and IMDA, banks and telcos may share liability if they failed to meet specific anti-scam duties (such as sending phishing SMS through legitimate channels). However, if you willingly disclosed your OTP or Singpass credentials, recovery is unlikely. Prevention remains far more effective than recovery.

Is ScamShield enough to protect me?

ScamShield is a strong first layer — it blocks known scam calls and flags suspicious SMS — but it cannot catch every new scam. Combine it with banking kill switches, low transfer limits, app-based authenticators, and cautious clicking habits for meaningful protection.

How do I check if a shortened link is safe?

Use a link expander or preview service to see the final destination before clicking. Reputable shortener services display the destination clearly and are transparent about ownership. Be extra cautious with links from unknown senders, even if the shortener domain looks familiar.

What should I do if I clicked a phishing link but didn't enter anything?

Close the tab immediately, clear your browser cache, and run a malware scan. If the link prompted an APK download or app install and you accepted, treat the device as compromised: enable airplane mode, contact your bank to freeze accounts, and factory-reset the device.

Final Thoughts

Phishing attacks in Singapore will keep evolving, but the fundamentals of defence remain the same: slow down, verify through independent channels, lock down your accounts, and treat urgency as a red flag rather than a reason to act. A few seconds of scepticism can save you thousands of dollars and months of recovery. Share this guide with family members — especially older relatives who are frequent targets — and make phishing awareness part of your household's digital hygiene.