Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have surged into one of the most costly cybercrime categories, with the Singapore Police Force reporting hundreds of millions of dollars lost each year to scam-related offences. From fake DBS SMS messages to counterfeit SingPass login pages, attackers are increasingly sophisticated — and increasingly local. This guide explains how phishing works in the Singapore context, what red flags to watch for, and how individuals and businesses can defend themselves.

What Are Phishing Attacks?

Phishing is a form of social engineering where attackers impersonate a trusted organisation — a bank, government agency, delivery service, or employer — to trick victims into revealing credentials, OTPs, payment information, or installing malware. In Singapore, phishing commonly arrives through SMS (smishing), email, WhatsApp, Telegram, voice calls (vishing), and even QR codes placed on physical surfaces.

The goal is almost always the same: capture something valuable. That could be your SingPass credentials, internet banking login, credit card details, or access to your corporate email.

Why Singapore Is a High-Value Target

Singapore's high digital adoption, concentrated wealth, and heavy use of mobile banking make it an attractive target for phishing syndicates operating both locally and from overseas. Several factors contribute:

• Universal digital ID: SingPass is used for banking, tax, healthcare, and government services — a single compromised account can unlock many systems.
• Mobile-first culture: Most Singaporeans manage finances via mobile apps, making SMS and in-app phishing effective.
• Multi-channel communication: Businesses routinely contact customers via SMS, email, and WhatsApp, making it harder for users to distinguish legitimate messages from fakes.
• Cross-border logistics: Residents regularly receive parcels from overseas, which scammers exploit with fake SingPost, Ninja Van, or customs notifications.

Common Types of Phishing Attacks in Singapore

1. Banking SMS and Email Phishing

Fake messages claim to be from DBS, OCBC, UOB, Standard Chartered, or Citibank, warning about suspicious transactions or locked accounts. The link leads to a convincing clone of the bank's login page. Since 2022, major Singapore banks have moved away from sending clickable links in SMS — any bank SMS with a link should be treated as suspicious by default.

2. SingPass Impersonation

Attackers send messages claiming your SingPass needs re-verification or that a government payout is available. The fake login page captures your username, password, and 2FA code in real time, allowing attackers to log in and loot CPF or IRAS systems.

3. Delivery and Parcel Scams

"Your SingPost parcel could not be delivered — pay $0.50 customs fee" is one of the most common lures. The small fee feels harmless, but the payment page harvests full card details, which are then used for larger fraudulent transactions.

4. Job Scams on WhatsApp and Telegram

Scammers pose as recruiters from TikTok, Shopee, Lazada, or well-known hotels, offering easy part-time work. Victims are moved to Telegram, asked to complete "tasks" involving small deposits, and eventually drained of larger sums.

5. Business Email Compromise (BEC)

Attackers impersonate CEOs, suppliers, or finance staff and request urgent fund transfers or changes to bank account details. This is one of the most financially damaging categories for Singapore SMEs.

6. QR Code Phishing (Quishing)

Fake QR stickers are placed on bubble tea stalls, hawker payment terminals, or e-scooter rentals. Scanning leads to a counterfeit PayNow or payment page.

How to Recognize a Phishing Message

Phishing messages share recognisable traits once you know what to look for. Use this checklist whenever you receive an unexpected message:

1. Urgency and fear: "Your account will be suspended in 24 hours" or "Unauthorised transaction detected."
2. Unexpected links: Any shortened or unfamiliar URL in a message claiming to be from your bank or a government agency.
3. Lookalike domains: dbs-sg-secure.com, singpass-verify.net, or singpost-delivery.co — none of these are legitimate.
4. Requests for OTP or password: No legitimate Singapore bank or agency will ever ask you to share these.
5. Mismatched sender: An SMS from a random mobile number claiming to be from DBS. Legitimate banks use registered SMS Sender IDs under the SSIR registry.
6. Poor grammar or odd phrasing: Though AI-generated phishing has reduced this tell, awkward sentences remain common.
7. Attachments you didn't expect: Especially .zip, .html, or .pdf files from unknown senders.

How to Verify Suspicious Links Safely

Before clicking anything, inspect the link. On mobile, long-press to preview the destination. On desktop, hover over the link to see the real URL. Legitimate Singapore government sites end in .gov.sg, and major banks use their primary domains (dbs.com.sg, ocbc.com, uobgroup.com).

If you need to share links with colleagues or customers, use a reputable link management platform that offers click analytics and the ability to deactivate malicious or compromised URLs quickly. Tools like Lunyb let you create branded short links with transparent destination previews, which helps recipients confirm authenticity. For a broader comparison of trustworthy link shorteners, see our 2026 buyer's guide.

Phishing Attack Types vs. Warning Signs

Attack Type	Common Channel	Primary Red Flag	What You Should Do
Bank impersonation	SMS, email	Clickable link to "verify" account	Open the bank app directly
SingPass impersonation	SMS, email	Request to re-login or re-verify	Go to singpass.gov.sg manually
Parcel scam	SMS, WhatsApp	Small customs or redelivery fee	Check tracking on the courier's app
Job scam	WhatsApp, Telegram	High pay for simple tasks + deposits	Report and block immediately
BEC	Email	Urgent fund transfer, changed bank details	Verify by phone with known contact
Quishing (QR)	Physical QR codes	QR sticker overlaid on original	Pay via official app, not scanned code

Steps to Take If You've Been Phished

Acting within the first hour dramatically increases the chance of recovering funds or limiting damage. Follow these steps in order:

1. Call your bank immediately using the anti-scam hotline printed on the back of your card. All major Singapore banks have 24/7 fraud lines.
2. Freeze affected cards and accounts through your mobile banking app's "kill switch" or money lock feature.
3. Reset passwords for the compromised service, SingPass, and your primary email — in that order.
4. Revoke active sessions and remove unknown devices from your account security settings.
5. Report to the Anti-Scam Centre via ScamShield (1799) or the Singapore Police Force at police.gov.sg/iwitness.
6. File a police report — essential for any insurance claim or chargeback.
7. Check CPF, IRAS, and HDB portals if SingPass was compromised, and reset your SingPass password and 2FA.
8. Scan your device with reputable anti-malware software if you downloaded any attachment or APK.

How to Protect Yourself Proactively

Enable Strong Authentication

Turn on hardware security keys or app-based authenticators (Google Authenticator, Authy) wherever supported. SMS OTP is better than nothing, but it is vulnerable to SIM-swap attacks.

Use the ScamShield App

The ScamShield app, developed by the National Crime Prevention Council and Open Government Products, blocks known scam SMS and calls. It is free and should be installed on every household member's phone, particularly for elderly relatives.

Activate Money Lock and Kill Switches

DBS, OCBC, UOB, and Standard Chartered all offer "Money Lock" features that ring-fence a portion of your funds so they cannot be transferred digitally — even if your account is compromised.

Keep Devices and Browsers Updated

Phishing kits increasingly exploit outdated browsers to deliver drive-by malware. Enable automatic updates on iOS, Android, Windows, and macOS. Use browsers with built-in phishing protection, such as Chrome, Edge, Safari, or Firefox with Enhanced Tracking Protection enabled.

Use Encrypted DNS

Services like Cloudflare's 1.1.1.1 for Families or Quad9 can block known phishing domains at the DNS level, giving you a quiet layer of protection that works across every app on your device.

Never Install Apps From Links

A persistent scam tactic in Singapore involves tricking victims into sideloading malicious Android APKs that bypass the Play Store. Only install apps from the official Google Play Store or Apple App Store. Google Play Protect's Enhanced mode now blocks sideloaded apps that request risky permissions.

Protecting Your Business from Phishing

Singapore SMEs are frequent BEC targets. A few practical defences dramatically reduce risk:

• Deploy DMARC, SPF, and DKIM on your email domain to prevent spoofing.
• Mandate dual approval for any fund transfer above a defined threshold, with verification by phone to a known number.
• Run quarterly phishing simulations for staff — awareness decays within months.
• Use branded short links for marketing and customer communication so recipients can recognise your domain at a glance. A platform like Lunyb helps you maintain consistent branded URLs and monitor click patterns for suspicious activity.
• Separate finance email accounts from marketing or public-facing addresses.
• Enforce phishing-resistant MFA such as FIDO2 security keys for finance and admin staff.

Where to Report Phishing in Singapore

• ScamShield Helpline: 1799 (24/7)
• Singapore Police Force: 999 (emergency), 1800-255-0000 (non-emergency)
• Police i-Witness: police.gov.sg/iwitness
• SingCERT: csa.gov.sg/singcert for cyber incident reports
• Your bank's 24/7 anti-scam hotline (printed on your card)

Frequently Asked Questions

How common are phishing attacks in Singapore?

Phishing-related scams are among the top five scam types reported annually by the Singapore Police Force, with tens of thousands of cases and losses exceeding hundreds of millions of dollars each year. Nearly every adult in Singapore has received at least one phishing SMS.

Will DBS, OCBC, or UOB ever send me a link via SMS?

No. Since 2022, major Singapore banks have committed to removing clickable links from retail SMS messages as part of the industry-wide anti-scam framework. Any SMS claiming to be from these banks containing a link should be treated as a scam.

What should I do if I accidentally entered my password on a phishing site?

Immediately change the password on the real site, revoke all active sessions, enable or reset two-factor authentication, and monitor the account for unauthorised activity. If it was a banking credential, call your bank's anti-scam hotline right away and freeze the account.

Can antivirus software stop phishing?

Modern security software and browsers block many known phishing sites, but new sites appear constantly and often last only hours. Technical controls help, but user awareness remains the strongest defence. Combine browser protection, encrypted DNS, strong authentication, and healthy scepticism.

Is it safe to click short links I receive?

Short links are not inherently dangerous — they're widely used by legitimate businesses — but you should only click them when you expect them from a known sender. Reputable services like Lunyb allow link previews so you can see the destination before clicking. When in doubt, navigate to the organisation's website directly instead.

Final Thoughts

Phishing attacks in Singapore are evolving quickly, powered by AI-generated content, convincing local branding, and refined social engineering. But the fundamentals of defence remain unchanged: slow down, verify independently, keep authentication strong, and never act on urgency alone. Share this guide with family members — especially elderly relatives — because the biggest losses often happen to those least familiar with current scam tactics. Awareness, combined with a few sensible tools, is still the most reliable protection you have.