Phishing Attacks in Singapore: How to Recognize and Avoid Them in 2026

Phishing attacks in Singapore have become one of the most financially damaging forms of cybercrime, with the Singapore Police Force reporting hundreds of millions of dollars lost each year to scam SMS, fake banking portals, and impersonation emails. Whether you are a DBS customer, a civil servant using Singpass, or a small business owner managing CPF contributions, understanding how modern phishing works is no longer optional. This guide explains how these attacks operate locally, what red flags to look for, and the practical steps you can take to protect yourself and your organisation.

What Are Phishing Attacks?

Phishing is a form of social engineering where attackers impersonate trusted organisations—banks, government agencies, delivery services, or employers—to trick victims into revealing credentials, one-time passwords (OTPs), or payment information. In Singapore, these attacks typically arrive through SMS, WhatsApp, email, or fake websites that closely mirror legitimate services such as DBS, OCBC, UOB, Singpass, IRAS, or SingPost.

Unlike generic global phishing, Singapore-targeted campaigns are highly localised. Scammers reference local brands, use Singlish phrasing sparingly, mimic government notification formats, and often time attacks to coincide with tax season, GST voucher payouts, or major shopping events like 11.11 and Black Friday.

The Current Phishing Landscape in Singapore

According to the Singapore Police Force's annual scam reports, phishing-related scams—including bank phishing, government official impersonation, and e-commerce scams—consistently rank among the top scam types. Losses frequently exceed S$600 million annually across all scam categories, with phishing being a primary attack vector.

Several factors make Singapore an attractive target:

• High digital adoption: Nearly universal use of PayNow, Singpass, and mobile banking.
• Wealthy consumer base: High average account balances make successful attacks lucrative.
• Trust in official channels: Residents tend to trust SMS and emails that appear to come from .gov.sg or local banks.
• Multilingual population: Attackers can craft messages in English, Mandarin, Malay, or Tamil to broaden reach.

Common Types of Phishing Attacks in Singapore

1. Smishing (SMS Phishing)

SMS phishing remains the most prolific attack method. Victims receive texts claiming to be from DBS, POSB, OCBC, or UOB warning of "unusual transactions" or "account suspension," with a link to a fake login page. The Monetary Authority of Singapore (MAS) and the major banks have moved to remove clickable links from official SMS, so any bank SMS containing a link should be treated as suspicious by default.

2. Singpass and Government Impersonation

Scammers impersonate IRAS, ICA, MOM, or the Singapore Police Force, claiming the victim owes taxes, has an expired work pass, or is involved in a money laundering investigation. Victims are directed to fake Singpass login pages that harvest credentials and 2FA codes in real time.

3. Delivery and Parcel Scams

Messages pretending to be from SingPost, Ninja Van, or Lazada claim that a parcel cannot be delivered due to an unpaid fee or incorrect address. The link leads to a fake payment page requesting card details.

4. Job Scams and Business Email Compromise (BEC)

Fake recruiters on Telegram, WhatsApp, and LinkedIn offer part-time jobs that eventually request bank login details or upfront payments. BEC attacks target SME finance teams with spoofed emails from "the CEO" requesting urgent payments to new accounts.

5. Fake Investment and Crypto Platforms

Victims are lured into fake trading platforms promising high returns, often promoted through hijacked social media accounts or deepfake videos of local personalities.

How to Recognize a Phishing Attempt

Modern phishing is far more convincing than the typo-ridden emails of a decade ago. Here are the red flags that remain consistent in 2026:

1. Urgency and fear: "Your account will be suspended in 24 hours." Legitimate banks give you time.
2. Links in SMS from banks: Singapore banks no longer send clickable links in SMS. Any such link is a scam.
3. Mismatched URLs: Hover (or long-press) a link to see the real destination. Watch for lookalike domains like dbs-sg.com, singpass-login.net, or iras.gov-sg.co.
4. Requests for OTP or Singpass credentials: No legitimate agency will ever ask for your OTP, PIN, or full password.
5. Unexpected attachments: Especially .zip, .html, or Office files with macros.
6. Generic greetings: "Dear Customer" instead of your name.
7. Payment to unfamiliar PayNow numbers or overseas accounts.

Red Flags Comparison Table

Indicator	Legitimate Message	Phishing Message
Sender	Verified short code or official domain	Random mobile number or spoofed sender ID
Links	Rarely included; never for bank SMS	Shortened or lookalike domain
Tone	Informational, polite	Urgent, threatening, time-pressured
Request	Directs you to open the official app	Asks for OTP, password, or Singpass login
Grammar	Professional, consistent	Awkward phrasing or unusual spacing
Payment	Through official billing channels	Direct PayNow to personal account

How to Verify a Suspicious Link Safely

Before clicking any link, especially those received via SMS or messaging apps, you can take several steps to verify its safety:

1. Preview the full URL: On mobile, long-press the link to see where it actually leads.
2. Check the domain carefully: Government sites end in .gov.sg. Banks use their primary domains (e.g., dbs.com.sg, ocbc.com, uob.com.sg).
3. Use a link scanner: Services like VirusTotal, URLVoid, or Google Safe Browsing can analyse suspicious URLs.
4. Open the official app instead: If a bank or agency claims there is an issue, log into the official app directly—never through a link.
5. Call the official hotline: Use the number printed on the back of your bank card, not one provided in the message.

When sharing links yourself—especially in marketing, customer communications, or internal reports—using a trusted shortener like Lunyb helps your recipients recognise your brand and avoid confusion with scam links. Legitimate branded short links with transparent analytics are far easier to trust than random, obscure domains. You can read more in our honest review of Lunyb or compare options in our 2026 URL shortener buyer's guide.

What to Do If You Clicked a Phishing Link

If you suspect you have fallen for a phishing attempt in Singapore, act quickly—most financial losses happen within minutes of credentials being entered.

1. Disconnect: Turn off Wi-Fi and mobile data on the affected device.
2. Lock your bank accounts: Every major Singapore bank now offers a "Money Lock" or "Kill Switch" feature in their app or via hotline.
3. Change passwords: Start with your Singpass, email, and banking passwords from a clean device.
4. Revoke device access: Within banking apps and Singpass, remove any unknown devices.
5. Report to the authorities: Call the ScamShield Helpline at 1799 or lodge a report at the Singapore Police Force e-services portal.
6. Report the message: Forward scam SMS to 7726 (SPAM) and report phishing emails to your IT team or provider.
7. Scan your device: Run a reputable antivirus scan to detect any dropped malware.

Protecting Yourself: A Practical Checklist

For Individuals

• Enable biometric login and transaction signing on all banking apps.
• Turn on the Money Lock feature at your primary bank.
• Download the ScamShield app from the National Crime Prevention Council.
• Use a password manager—never reuse passwords across Singpass, bank, and email.
• Switch on 2FA using an authenticator app rather than SMS where possible.
• Keep your phone's OS and apps updated.
• Only install apps from the official App Store or Google Play—sideloading is a major phishing vector.

For Businesses and SMEs

• Implement DMARC, SPF, and DKIM on your email domains to reduce spoofing.
• Train employees quarterly with simulated phishing exercises.
• Establish a dual-approval process for any payment above a defined threshold.
• Verify payment detail changes by phone using a known number—never by replying to email.
• Use branded, trackable short links for all customer communications so recipients can distinguish genuine messages from scams.
• Follow guidance from the Cyber Security Agency of Singapore (CSA) and SingCERT advisories.

Phishing Tools and Protection Comparison

Protection Layer	What It Does	Cost	Who It's For
ScamShield App	Blocks known scam calls and SMS in Singapore	Free	All residents
Money Lock (Banks)	Locks funds from online transfers	Free	Banking customers
Password Manager	Generates unique passwords, warns on fake sites	Free–S$60/year	Everyone
Authenticator App	Replaces SMS OTP with time-based codes	Free	Everyone
Encrypted DNS (e.g., 1.1.1.1 for Families)	Blocks known malicious domains network-wide	Free	Households, SMEs
Email Security Gateway	Filters phishing before inbox delivery	From S$3/user/month	Businesses
Branded URL Shortener	Builds link trust, enables click analytics	Free–S$30/month	Marketers, SMEs

Why Branded Links Matter in Anti-Phishing

One underrated defence against phishing is link literacy on both sides of a message. When your customers consistently see links from a recognisable, branded domain, anything that deviates stands out. Conversely, if your organisation sends out raw, unbranded links from a mix of random domains, you train customers to click first and think later—exactly the behaviour scammers exploit.

This is why many Singapore businesses have moved to branded short links with proper analytics, deep-link protection, and expiry controls. Tools like Lunyb let you create short, trustworthy links tied to your own brand, while competitors offer similar features at various price points—we compare several options in our Rebrandly review and our broader 2026 shortener comparison.

Emerging Phishing Trends to Watch

AI-Generated Voice and Video Scams

Deepfake voice calls impersonating family members or senior executives have been reported in Singapore. Always verify unusual requests through a second channel.

QR Code Phishing ("Quishing")

Fake QR codes stuck over legitimate ones at hawker centres, car parks, and EV chargers lead to phishing payment pages. Always check the URL before paying and prefer in-app payments.

Malicious Mobile Apps

Scammers trick victims into sideloading APK files that grant accessibility permissions, allowing attackers to see OTPs and remote-control the device. Never install apps from links sent via SMS or chat.

Hybrid Scams

Attacks increasingly combine SMS, phone calls, and in-app chat. A scam SMS leads to a WhatsApp conversation with a "bank officer" who guides the victim through authorising fraudulent transactions.

FAQ: Phishing Attacks in Singapore

How do I report a phishing SMS or email in Singapore?

Forward suspicious SMS to 7726 (SPAM), report to the ScamShield Helpline at 1799, and file a police report via the SPF e-Services portal if money has been lost. Phishing emails impersonating government agencies can be reported to SingCERT.

Will my bank refund me if I fall victim to phishing?

Under the Shared Responsibility Framework introduced by MAS and the IMDA, banks and telcos may bear part of the loss if they failed to meet their anti-scam duties. However, if you shared your OTP, Singpass credentials, or installed a malicious app, recovery is not guaranteed. Act within minutes to maximise the chance of recovering funds.

Is it safe to click short links received via SMS?

Treat them with caution. Legitimate Singapore banks do not send clickable links in SMS. For other senders, long-press to preview the full URL, verify the domain, and when in doubt, open the official app or website directly instead of clicking.

What is the ScamShield app and should I install it?

ScamShield is a free app developed by the National Crime Prevention Council and GovTech. It blocks known scam calls and filters scam SMS using a government-maintained database. It is highly recommended for all residents in Singapore.

How can SMEs in Singapore protect staff from phishing?

Combine technical controls (DMARC, email filtering, encrypted DNS, MFA) with regular staff training and clear payment approval procedures. CSA's SG Cyber Safe programme and SingCERT publish free resources tailored to local SMEs.

Final Thoughts

Phishing attacks in Singapore will continue to evolve, but the fundamentals of defence remain the same: slow down, verify through official channels, and never share OTPs or credentials. Combining built-in protections like Money Lock and ScamShield with good personal habits—unique passwords, authenticator apps, and link literacy—dramatically reduces your risk. For organisations, investing in email authentication, staff training, and trusted branded links is no longer a nice-to-have; it is a baseline requirement for operating safely in Singapore's digital economy.