Phishing Attacks in Singapore: How to Recognize and Avoid Them in 2026

Phishing attacks in Singapore have grown into one of the most financially damaging forms of cybercrime, costing residents hundreds of millions of dollars every year. Scammers impersonate banks like DBS, OCBC and UOB, government agencies such as IRAS and Singpost, and popular platforms like Shopee and Lazada to trick victims into handing over passwords, OTPs, and card details. This guide explains how modern phishing works in Singapore, how to recognize the warning signs, and how to protect yourself and your family.

What Are Phishing Attacks?

Phishing is a form of social engineering where attackers impersonate a trusted organization to steal sensitive information such as login credentials, banking details, or one-time passwords (OTPs). In Singapore, phishing is typically delivered through SMS (smishing), WhatsApp messages, phone calls (vishing), emails, and fake websites that closely mimic legitimate Singaporean brands.

According to the Singapore Police Force's annual scam reports, phishing-related scams consistently rank among the top cybercrime categories, with losses exceeding S$100 million in recent years. The Monetary Authority of Singapore (MAS) and the Cyber Security Agency of Singapore (CSA) continue to issue frequent public advisories because the attacks evolve quickly.

Why Singapore Is a Prime Target for Phishing

Singapore's high smartphone penetration, widespread digital banking adoption, and strong e-commerce ecosystem make it an attractive target. Several specific factors increase exposure:

• High digital banking usage: Over 90% of Singapore residents use mobile banking apps.
• SingPass and government digitalization: Scammers exploit trust in official platforms.
• Cross-border commerce: Many Singaporeans transact internationally, making unusual activity harder to spot.
• Multilingual environment: Messages in English, Mandarin, Malay, or Tamil give attackers more surface area.
• High disposable income: Average scam losses in Singapore are among the highest globally per victim.

Common Types of Phishing Attacks in Singapore

1. SMS Phishing (Smishing)

Text messages claiming to be from DBS, POSB, OCBC, UOB, Singpost, or IRAS urging you to "verify your account," "update delivery details," or "settle outstanding tax." They include a shortened or lookalike link such as dbs-verify-sg[.]com.

2. WhatsApp and Telegram Phishing

Attackers impersonate friends, bosses, or delivery agents. A common variant is the "takeover scam," where a hijacked WhatsApp account asks contacts for an OTP code.

3. Email Phishing

Fake emails pretending to be from Microsoft 365, Singtel, StarHub, or your employer's HR department, often with malicious attachments or links to credential-harvesting pages.

4. Voice Phishing (Vishing)

Callers impersonate officers from the Singapore Police Force, MOH, or China authorities, claiming you are involved in money laundering and must transfer funds for "investigation."

5. Fake E-commerce and Job Offer Scams

Phishing sites mimic Shopee, Lazada, Carousell, or Qoo10 checkout pages. Job scams on Telegram and Indeed lead victims to fake "task" platforms that eventually steal deposits.

6. QR Code Phishing (Quishing)

Fake QR codes placed over legitimate ones at hawker centres, bubble tea shops, or parking meters redirect victims to fraudulent payment pages.

Warning Signs of a Phishing Attempt

Learning to spot red flags is the single most effective defense. Watch for these indicators:

1. Urgency and fear: "Your account will be suspended in 24 hours."
2. Requests for OTPs or passwords: No legitimate bank or agency will ever ask.
3. Suspicious sender IDs: Numbers from unknown countries, or SMS senders not on the SSIR (Singapore SMS Sender ID Registry).
4. Lookalike domains: dbs-sg-login[.]com instead of dbs.com.sg.
5. Unexpected attachments: Especially .zip, .html, or .pdf files you didn't request.
6. Grammatical mistakes: Awkward phrasing, mixed languages, or inconsistent branding.
7. Requests to install apps outside official stores: APK sideloading is a major vector for Android malware in Singapore.

Phishing Attack Methods Compared

Method	Typical Channel	Common Impersonation	Risk Level
Smishing	SMS	Banks, Singpost, IRAS	Very High
Email Phishing	Email	Microsoft, Employers, Telcos	High
Vishing	Phone call	SPF, MOH, foreign authorities	Very High
WhatsApp Takeover	Messaging apps	Friends, family	High
Quishing	Physical QR codes	Hawker stalls, parking	Medium
Fake E-commerce	Websites, ads	Shopee, Lazada, Carousell	High

Real Examples of Phishing in Singapore

The OCBC SMS Scam (2021–2022)

Nearly 790 victims lost over S$13.7 million in one of Singapore's largest phishing incidents. SMSes appearing in the same thread as genuine OCBC messages led victims to fake login pages that captured credentials and OTPs.

Singpost "Undelivered Parcel" Scam

Victims receive an SMS saying a parcel cannot be delivered without a small customs payment. The phishing page captures card details, which are then used for unauthorized purchases.

Android Malware Scams

Victims are tricked into installing APK files disguised as cleaning services, pet grooming bookings, or seafood promotions. The malware intercepts SMS OTPs, allowing attackers to drain bank accounts.

How to Protect Yourself from Phishing Attacks

1. Verify Before You Click

Never click links in unsolicited SMS or emails. Open your bank's official app directly. If a message claims to be from IRAS or Singpass, log in through the official website by typing the URL manually.

2. Use Link Previews and URL Scanners

Before clicking any shortened link, preview the destination. Reputable link platforms, including Lunyb, offer transparent redirects and malware checks, which help you avoid surprise destinations. You can read our honest Lunyb review for details on how safe link handling works.

3. Enable Strong Authentication

• Turn on Money Lock features offered by DBS, OCBC and UOB to ring-fence savings.
• Use hardware security keys or app-based authentication where possible.
• Enable biometric login on your banking apps.

4. Keep Devices and Apps Updated

Install iOS and Android security patches promptly. Avoid sideloading APKs; Android 14+ in Singapore now blocks sideloaded apps from reading SMS, a significant protection enabled by the CSA.

5. Use the ScamShield App

Developed by the National Crime Prevention Council and Open Government Products, ScamShield filters scam SMS and calls on both iOS and Android. It is free and highly recommended.

6. Verify Sender IDs

Since 2023, all legitimate organizations in Singapore must register their SMS Sender IDs. Any unregistered sender appears as "Likely-SCAM." Treat these messages as hostile.

7. Protect Your Network

Use encrypted DNS services (such as Cloudflare 1.1.1.1 with Families, or Quad9) to block known phishing domains at the network level. Many Singapore ISPs also offer router-level security filtering.

8. Educate Family Members

Elderly parents and young children are frequent targets. Walk through examples together and establish a family rule: never share OTPs, even with people claiming to be relatives.

What to Do If You've Been Phished

1. Call your bank immediately using the 24/7 anti-scam hotlines (DBS: 1800-339-6963, OCBC: 1800-363-3333, UOB: 1800-222-2121).
2. Freeze your accounts through the banking app's kill switch feature.
3. Call the Anti-Scam Hotline at 1800-722-6688 or report via ScamShield.
4. File a police report online at police.gov.sg.
5. Change passwords for Singpass, email, and all financial services.
6. Scan your devices for malware; factory reset Android devices if an APK was installed.
7. Notify your contacts if a messaging account was compromised.

Phishing Protection Tools: Quick Comparison

Tool	Purpose	Cost	Availability in SG
ScamShield	Blocks scam SMS/calls	Free	iOS & Android
Money Lock (DBS/OCBC/UOB)	Ring-fences savings	Free	All major banks
Cloudflare 1.1.1.1 for Families	Blocks malicious domains	Free	Global
Hardware Security Keys (YubiKey)	Phishing-resistant 2FA	S$70+	Available locally
Google Play Protect / Enhanced Safe Browsing	App & URL scanning	Free	Default on Android/Chrome

How Businesses in Singapore Can Reduce Phishing Risk

SMEs are increasingly targeted by business email compromise (BEC) scams. Key defenses include:

• Enforce DMARC, SPF and DKIM on company email domains.
• Deploy mandatory multi-factor authentication for Microsoft 365 and Google Workspace.
• Run quarterly phishing simulations and refresher training.
• Use branded short links for all marketing campaigns so customers learn to recognize your legitimate domains. Our 2026 URL shortener comparison breaks down the best options.
• Segregate finance approvals: require voice confirmation for any payment above a set threshold.

The Role of Trusted Link Shorteners

Shortened URLs are a double-edged sword: convenient for marketing, but also abused by attackers. Choosing a reputable provider makes a difference. Platforms like Lunyb apply automated scanning on destinations and provide click analytics so suspicious patterns can be spotted early. For businesses evaluating alternatives, see our Rebrandly review for 2026.

FAQ

How do I report a phishing SMS or email in Singapore?

Forward phishing SMS to 9-1-1-1 (the ScamShield reporting number) or report through the ScamShield app. Phishing emails can be reported to the Singapore Cyber Emergency Response Team (SingCERT) via csa.gov.sg. For financial loss, call the Anti-Scam Hotline at 1800-722-6688.

Will DBS, OCBC, or UOB ever ask for my OTP?

No. Singapore banks will never ask for your OTP, PIN, or password via SMS, email, phone call, or chat. Any such request is a scam, full stop.

Is it safe to click shortened links from unknown senders?

No. Even legitimate-looking short links can mask phishing destinations. Only click links from senders you trust, and consider using a URL preview tool or a reputable shortener that scans destinations automatically.

Can antivirus software prevent phishing?

Antivirus helps but is not sufficient alone. Modern phishing relies on social engineering rather than malware. Combine antivirus with ScamShield, strong 2FA, encrypted DNS, and user awareness for the best protection.

What should I do if I entered my banking details on a fake site?

Immediately call your bank's 24/7 anti-scam hotline, activate the kill switch in your banking app, change all affected passwords, enable Money Lock, and file a police report. Speed matters — most unauthorized transfers happen within minutes of credential theft.