Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have grown into one of the most damaging cybercrime categories facing residents, businesses, and government agencies. According to the Singapore Police Force's Annual Scams and Cybercrime Brief, scam-related losses have exceeded S$650 million in recent years, with phishing scams among the top contributors. Attackers impersonate banks like DBS, OCBC, and UOB, government agencies such as IRAS and SingPost, and popular services including Singtel and Shopee to trick victims into handing over credentials, OTPs, or money.

This guide explains how phishing works in the Singapore context, the specific tactics local scammers use, warning signs to watch for, and the practical steps you can take to protect yourself and your organisation.

What Is a Phishing Attack?

A phishing attack is a form of social engineering in which criminals impersonate a trusted entity to trick a target into revealing sensitive information, clicking a malicious link, or making a fraudulent payment. Phishing typically arrives via email, SMS (smishing), phone calls (vishing), or messaging apps like WhatsApp and Telegram.

In Singapore, phishing has evolved beyond generic "Nigerian prince" scams into highly localised, well-crafted campaigns that reference real Singaporean institutions, use accurate Singlish phrasing, and even spoof legitimate government hotlines and SMS sender IDs.

Common Categories of Phishing Seen in Singapore

• Bank impersonation phishing: Fake DBS, OCBC, UOB, Standard Chartered, or Citibank alerts.
• Government agency phishing: Fake notices from IRAS (tax refunds), ICA (passport renewal), MOM (work pass), or SingPost (parcel delivery).
• E-commerce and delivery scams: Fake Shopee, Lazada, Amazon, or Ninja Van tracking messages.
• Job scam phishing: Fake recruiters on WhatsApp or Telegram offering easy remote work.
• Investment phishing: Fake trading platforms or crypto sites impersonating MAS-licensed brokers.

Why Singapore Is a High-Value Target for Phishing

Singapore's status as a regional financial hub, its high smartphone penetration (over 90%), and widespread digital banking adoption make it an attractive target. Several structural factors amplify the risk:

1. Digital-first banking: Nearly all local banks use app-based authentication, SMS OTPs, and digital tokens, which scammers actively try to intercept.
2. Government digital services: Singpass, MyInfo, and CPF portals are prime impersonation targets.
3. Cross-border commerce: Frequent parcel deliveries from overseas make fake courier SMS believable.
4. Multilingual population: Attackers craft messages in English, Mandarin, Malay, and Tamil to widen their reach.
5. High disposable income: Successful scams yield larger payouts per victim compared with many regional markets.

The Most Common Phishing Tactics Used in Singapore

Understanding local tactics is the first step to avoiding them. Below are the phishing methods that Singapore's Cyber Security Agency (CSA) and Singapore Police Force have repeatedly flagged in advisories.

1. Fake Bank SMS with Spoofed Sender IDs

Scammers send SMS messages that appear under the exact same sender ID as your real bank (e.g., "DBS" or "OCBC"), often threading into your existing genuine message history. The message typically claims suspicious activity and links to a fake login page. Since 2022, the SMS Sender ID Registry (SSIR) has made this harder, but sophisticated attacks still slip through, especially via overseas SMS gateways.

2. WhatsApp and Telegram Job Scams

A stranger contacts you claiming to be a recruiter offering "part-time online tasks" paying S$50-S$300 per day. After small initial payouts to build trust, victims are asked to "top up" to unlock higher earnings, losing thousands.

3. Fake SingPost and Courier Delivery Notices

SMS or email claiming a parcel cannot be delivered due to unpaid customs duties. The link leads to a fake payment page harvesting card details and OTPs.

4. IRAS Tax Refund Scams

Emails claiming you are owed a tax refund and asking you to log in via a link. IRAS never sends refund links via email or SMS; refunds are processed automatically to your bank account or via GIRO.

5. Malicious Android APK Installations

One of Singapore's fastest-growing threats: victims are pushed to install "official" apps outside Google Play (sideloaded APKs). These apps request accessibility permissions and silently steal banking credentials. MAS and CSA have issued repeated warnings, and banks like DBS and OCBC have added anti-malware detection inside their apps.

6. QR Code Phishing (Quishing)

Stickers placed over legitimate QR codes at hawker centres, bubble tea shops, or on parking meters redirect victims to fake payment pages. Always verify the URL that a QR code opens before entering any details.

Warning Signs of a Phishing Attempt

Most phishing messages share tell-tale characteristics. Train yourself and your family to spot these red flags:

• Urgency and fear: "Your account will be suspended in 24 hours."
• Requests for OTPs or passwords: No legitimate bank or agency will ever ask for these.
• Suspicious URLs: Slight misspellings like dbs-sg-secure.com or iras-refund.net.
• Unusual sender addresses: Government emails should end in .gov.sg; check carefully.
• Unexpected attachments: Especially .apk, .zip, .exe, or macro-enabled Office documents.
• Requests to move to another platform: "Continue this conversation on WhatsApp / Telegram."
• Too-good-to-be-true offers: Guaranteed returns, free vouchers, unclaimed refunds.

Phishing Attack Vectors Compared

Attack Vector	How It Reaches You	Common Impersonation	Primary Risk
Email phishing	Inbox / spam folder	IRAS, banks, Microsoft 365	Credential theft, malware
Smishing (SMS)	Text message with link	DBS, OCBC, SingPost, ICA	Fake login page, OTP theft
Vishing (voice)	Phone call, often spoofed	SPF, MAS, bank fraud desk	Coerced fund transfers
WhatsApp / Telegram	Unsolicited message	Recruiters, delivery agents	Job scams, romance scams
Quishing (QR)	Physical or digital QR code	PayNow, parking, F&B outlets	Payment fraud
Malicious APK	Sideloaded Android app	Bank apps, government apps	Full device takeover

How to Verify a Suspicious Link Before Clicking

Even careful users occasionally receive convincing messages. Before clicking any link, apply these checks:

1. Hover before you click. On desktop, hover over the link to preview the destination in the browser's status bar.
2. Inspect the domain carefully. Legitimate Singapore government sites end in .gov.sg. Banks use their own primary domains (e.g., dbs.com.sg).
3. Use a link expander. Shortened links can hide the true destination. Paste them into a preview tool to see where they lead. Reputable shorteners such as Lunyb support link previews and scan destinations for malicious content, which is one reason to prefer trusted services over unknown ones. You can read more in our honest Lunyb review.
4. Type the URL manually. If in doubt, don't click. Open a new tab and type the official URL yourself.
5. Check ScamShield. Singapore's ScamShield app (developed by the National Crime Prevention Council) can filter suspicious calls and SMS.

A Note on Shortened Links

Shortened URLs are convenient but frequently abused in phishing. Choosing a well-known link management platform with abuse monitoring reduces the risk that a shortened link you share (or receive) leads somewhere malicious. See our 2026 buyer's guide to URL shorteners and our Rebrandly review for a comparison of trusted providers.

Practical Steps to Protect Yourself in Singapore

For Individuals

1. Enable the ScamShield app on iOS and Android.
2. Activate money lock features offered by DBS, OCBC, UOB, and Standard Chartered to ring-fence funds that cannot be transferred out digitally.
3. Never install banking apps from links. Only use the official App Store or Google Play.
4. Turn on biometric login and disable SMS OTP where possible in favour of in-app digital tokens.
5. Use unique passwords managed by a reputable password manager.
6. Enable two-factor authentication on Singpass, email, and social accounts.
7. Keep your phone's operating system updated to receive the latest anti-malware protections.
8. Verify unusual requests via a second channel — call the official hotline from the bank's website, not the number in the message.

For Businesses and SMEs

1. Implement DMARC, SPF, and DKIM on your email domains to reduce spoofing.
2. Run quarterly phishing simulations for staff — CSA's SG Cyber Safe programme offers resources.
3. Enforce multi-factor authentication on all cloud services (Microsoft 365, Google Workspace, Xero, etc.).
4. Restrict administrative privileges and use conditional access policies.
5. Deploy endpoint detection and response (EDR) software on all company devices.
6. Establish an incident response playbook that includes reporting to SingCERT and the Singapore Police Force.
7. Review vendor and payment processes to prevent business email compromise (BEC) — always verify bank account changes by phone.

What to Do If You Suspect You've Been Phished

Speed matters. If you clicked a suspicious link or shared credentials, act within minutes:

1. Call your bank's 24/7 fraud hotline immediately to freeze accounts and cards.
2. Change passwords for the affected account and any other account sharing that password.
3. Revoke sessions in your account security settings and reset MFA methods.
4. Report to the Singapore Police Force via 1800-255-0000 or file an e-report at police.gov.sg.
5. Report the scam to ScamShield or the Anti-Scam Helpline at 1800-722-6688.
6. Report the phishing site to SingCERT (csa.gov.sg/singcert) so it can be taken down.
7. Run a full malware scan and consider a factory reset if you installed a suspicious APK.
8. Notify your employer if the compromised account was work-related.

Singapore's Legal and Regulatory Response

Singapore has significantly tightened its anti-scam framework:

• Shared Responsibility Framework (SRF) — from late 2024, banks and telcos share responsibility with consumers for phishing losses when they fail to meet defined duties.
• SMS Sender ID Registry (SSIR) — non-registered alphanumeric sender IDs are blocked or labelled "Likely-SCAM."
• Protection from Scams Act (PSA) — allows authorities to restrict bank transactions of individuals believed to be under a scammer's influence.
• Anti-Scam Centre (ASC) — coordinated by SPF to freeze fraudulent accounts and recover funds quickly.

These measures help, but consumer vigilance remains the strongest line of defence.

Building a Long-Term Anti-Phishing Habit

Phishing awareness is not a one-off exercise. Treat it like a monthly hygiene routine: review your account security settings, discuss recent scams with family members (especially seniors), and stay informed via CSA and SPF advisories. Follow the Singapore Police Force's Scam Alert channel on Telegram and subscribe to SingCERT alerts.

The rule of thumb: slow down before you click, and verify before you act. Scammers rely on urgency; time is your best defence.

Frequently Asked Questions

How common are phishing attacks in Singapore?

Phishing is consistently among the top three scam types reported to the Singapore Police Force each year, with tens of thousands of cases and hundreds of millions in losses. Phishing-related scams, e-commerce scams, and job scams together account for the majority of reported cases.

Can I get my money back if I fall for a phishing scam?

Recovery depends on how quickly you report. If the Anti-Scam Centre can freeze the recipient account before funds are withdrawn, partial or full recovery is possible. Under the Shared Responsibility Framework, banks may also compensate victims if they failed to meet their duties, but this is assessed case-by-case.

Are SMS OTPs still safe to use in Singapore?

SMS OTPs are increasingly being phased out in favour of in-app digital tokens, which are more resistant to phishing. Most major Singapore banks now default to app-based authentication. Where possible, disable SMS OTP fallback and use biometrics plus digital tokens.

What should I do if I receive a suspicious WhatsApp message from an unknown number?

Do not reply, click any links, or open attachments. Report the number inside WhatsApp (Contact info → Report), block it, and forward the message to ScamShield. Never move a conversation to another platform at the sender's request.

How can I tell if a URL is genuinely from a Singapore government agency?

All official Singapore government websites use the .gov.sg domain. Legitimate agencies will never ask for your Singpass password, banking OTPs, or credit card details via email or SMS. If unsure, go directly to the agency's official website by typing the address yourself.