Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have evolved from clumsy email scams into sophisticated, multi-channel operations that drain bank accounts, hijack SingPass credentials, and compromise entire businesses. In 2024 alone, scam victims in Singapore lost over S$1.1 billion, with phishing consistently ranking among the top three scam types reported to the Singapore Police Force. Whether you're a resident checking your DBS account on PayLah!, a business owner managing CPF contributions, or an expatriate new to the local digital ecosystem, understanding how phishing works here is essential.

This guide explains what phishing looks like in the Singaporean context, how attackers exploit local brands and government services, and the practical steps you can take to protect yourself and your organisation.

What Are Phishing Attacks?

Phishing is a form of social engineering where attackers impersonate trusted organisations to trick victims into revealing sensitive information such as passwords, banking credentials, OTPs, or credit card details. In Singapore, phishing attempts frequently masquerade as messages from local banks (DBS, OCBC, UOB), government agencies (IRAS, MOM, ICA), delivery services (SingPost, Ninja Van), and telcos (Singtel, StarHub, M1).

Unlike generic global phishing, Singapore-targeted attacks are highly localised. Scammers reference Singlish phrasing, local public holidays, GST refunds, HDB payments, and even trending news events to appear credible. The result is a convincing message that bypasses the natural scepticism most users have towards obvious scams.

Why Singapore Is a High-Value Target

Singapore's position as a global financial hub, combined with high smartphone penetration and widespread digital banking adoption, makes it an attractive target for cybercriminals. Several factors amplify the risk:

• High digital banking adoption: Over 90% of Singapore residents use mobile banking apps, giving attackers a large pool of potential victims.
• Centralised digital identity: SingPass access unlocks tax records, CPF accounts, HDB services, and healthcare data — a single compromise can be catastrophic.
• High disposable income: Singapore's wealth makes successful attacks more lucrative per victim than in many other markets.
• Multilingual population: Attackers craft phishing in English, Mandarin, Malay, and Tamil to broaden their reach.
• Trust in institutions: Singaporeans tend to trust official-looking communications, which scammers exploit.

Common Types of Phishing Attacks in Singapore

1. SMS Phishing (Smishing)

SMS-based phishing is the most prevalent form in Singapore. Despite the SMS Sender ID Registry (SSIR) introduced by IMDA, attackers still bypass controls using international numbers or spoofed short codes. Common smishing templates include:

• "Your DBS account has been locked. Verify at dbs-secure.sg-login.com"
• "SingPost: Your parcel cannot be delivered. Update address: [malicious link]"
• "IRAS: You are eligible for a GST voucher refund of S$300. Claim now."

2. Email Phishing

Email phishing in Singapore often impersonates HR departments, SingPass, or corporate IT. Business Email Compromise (BEC) is particularly damaging — attackers impersonate CEOs or finance directors to authorise fraudulent wire transfers, often targeting SMEs with weaker email authentication.

3. WhatsApp and Telegram Scams

With WhatsApp being the dominant messaging app in Singapore, scammers increasingly use it for phishing. Common tactics include fake job offers promising high pay for "liking videos", fake investment groups, and romance scams that eventually request bank details.

4. Voice Phishing (Vishing)

Scammers call pretending to be from the Singapore Police Force, MAS, or China authorities, claiming the victim is involved in money laundering. They pressure victims to transfer funds to "safe accounts" or share OTPs.

5. QR Code Phishing (Quishing)

Fake QR codes are placed over legitimate ones at hawker centres, car parks, and bubble tea shops. Scanning leads to phishing pages that collect payment details under the guise of PayNow or NETS transactions.

Red Flags: How to Recognise a Phishing Attempt

Learning to spot phishing requires a trained eye. Below is a comparison of legitimate versus suspicious communications you might receive in Singapore:

Indicator	Legitimate Message	Phishing Attempt
Sender	Registered SMS Sender ID (e.g., "DBS", "IRAS")	Random mobile number or "Likely-SCAM" tag
Links	Official domains (dbs.com.sg, iras.gov.sg)	Lookalike domains (dbs-sg.com, iras-refund.net)
Tone	Informational, no urgency	Urgent threats, deadlines, account suspension
Request	Never asks for OTP, PIN, or SingPass password	Requests credentials, OTPs, or immediate payment
Grammar	Professional, accurate	Awkward phrasing, odd capitalisation
Attachments	Rarely sent unsolicited	Unexpected .zip, .html, or .pdf files

Specific Warning Signs

• Requests to install an APK file outside the Google Play Store (a hallmark of Android banking trojans active in Singapore).
• Messages claiming you've won lucky draws from NTUC FairPrice, Shopee, or Lazada you never entered.
• Requests to "verify" SingPass credentials via a link — the real SingPass team never does this.
• Pressure to switch the conversation to WhatsApp or Telegram from an official platform.

How to Verify Suspicious Links Safely

If you receive a link you're unsure about, follow this process:

1. Do not click immediately. Hover over the link on desktop to preview the URL, or long-press on mobile.
2. Check the domain carefully. Look for subtle misspellings — "singt3l.com" instead of "singtel.com", or extra words like "-login" or "-secure".
3. Use a link preview tool. Services that expand shortened URLs can reveal where a link actually leads before you visit it.
4. Visit the official site directly. Instead of clicking, type the known URL into your browser or use the official mobile app.
5. Report to ScamShield. Forward suspicious SMS to 9SPF-SCAM (97235-7226) or report via the ScamShield app.

For organisations that regularly share links with customers, using a trusted link management platform like Lunyb helps build recipient confidence. Branded, traceable short links let users verify the sender's identity, and analytics help detect if links are being abused in impersonation campaigns. You can read more about how it compares to alternatives in our 2026 URL shortener buyer's guide.

Protecting Yourself: Practical Defence Steps

For Individuals

1. Enable Money Lock on your bank account. DBS, OCBC, and UOB all offer this feature, which ring-fences funds that cannot be transferred digitally.
2. Install the ScamShield app. Developed by the Singapore Police Force and Open Government Products, it blocks known scam calls and SMS.
3. Turn on biometric login and 2FA. Use fingerprint or face recognition for banking apps and enable two-factor authentication everywhere possible.
4. Never sideload Android apps. Only install apps from Google Play or the Apple App Store. MAS and banks have activated anti-malware measures that block transactions on devices with sideloaded apps.
5. Keep your devices updated. Install OS and app updates promptly to patch known vulnerabilities.
6. Use strong, unique passwords. A password manager helps you avoid reusing credentials across sites.

For Businesses and SMEs

1. Implement DMARC, SPF, and DKIM on your email domain to prevent spoofing.
2. Conduct regular phishing simulations. Train employees with realistic scenarios tailored to Singapore (fake IRAS notices, MOM work pass renewals).
3. Enforce multi-factor authentication on all corporate accounts, especially email and finance systems.
4. Establish a verification protocol for fund transfers. Any wire transfer request should be confirmed via a second channel (phone call to a known number).
5. Use encrypted DNS and endpoint protection to block known phishing domains at the network level.
6. Report incidents to SingCERT and the Singapore Police Force promptly to limit damage and help others.

What to Do If You've Been Phished

If you suspect you've fallen victim to a phishing attack, act quickly:

1. Contact your bank immediately. All major Singapore banks have 24/7 anti-scam hotlines. DBS: 1800-339-6963. OCBC: 1800-363-3333. UOB: 1800-222-2121.
2. Call the Anti-Scam Helpline at 1800-722-6688 for guidance and to initiate fund-freezing procedures.
3. Make a police report at the nearest Neighbourhood Police Centre or via the e-services portal.
4. Change all affected passwords and revoke SingPass sessions via the SingPass app.
5. Monitor your accounts and consider a credit freeze with Credit Bureau Singapore.
6. Report the phishing content to the platform (SMS to ScamShield, phishing emails to the impersonated organisation).

The Regulatory Response in Singapore

Singapore has introduced a layered defence against phishing. The Shared Responsibility Framework (SRF), effective from December 2024, outlines how banks and telcos must share liability for phishing losses when they fail in their anti-scam duties. The SMS Sender ID Registry (SSIR) blocks unregistered aliases, and major banks have removed clickable links from SMS notifications entirely.

However, regulation alone cannot stop phishing. User awareness remains the strongest line of defence. The Monetary Authority of Singapore (MAS), Infocomm Media Development Authority (IMDA), and Cyber Security Agency (CSA) continue to run campaigns like "ACT Against Scams" to educate the public.

FAQ: Phishing Attacks in Singapore

How do I report a phishing SMS or email in Singapore?

Forward suspicious SMS to 9SPF-SCAM (97235-7226) or report via the ScamShield app. For phishing emails, forward them to the impersonated organisation (for example, phishing@dbs.com for DBS) and to SingCERT via the CSA website. If you've suffered financial loss, call the Anti-Scam Helpline at 1800-722-6688 and file a police report.

Will my bank refund me if I'm phished in Singapore?

Under the Shared Responsibility Framework, banks and telcos may be required to compensate victims if they failed in specific anti-scam duties. However, if you willingly shared your OTP, password, or SingPass credentials despite warnings, you may bear the loss. Each case is assessed individually, so report quickly and document everything.

Why do I keep getting phishing SMS even after enabling ScamShield?

ScamShield relies on a database of known scam numbers. New numbers, international spoofed numbers, and OTT messages via WhatsApp or Telegram may slip through. Keep the app updated, report new scam messages, and never click links in unsolicited SMS regardless of filtering.

Is it safe to click shortened URLs in Singapore?

Shortened URLs are safe when they come from a trusted sender and a reputable shortening service. Problems arise when scammers use shorteners to disguise malicious destinations. Use a link expander or hover-to-preview feature before clicking, and favour senders who use branded short links from established providers like Lunyb or Rebrandly, which make the destination recognisable.

What should I do if I accidentally entered my SingPass credentials on a phishing site?

Immediately log in to the official SingPass app and change your password. Revoke all active sessions, enable face verification, and review your transaction history for unauthorised activity across government e-services. File a police report and notify any agencies that may have been impacted (IRAS, CPF, HDB). Consider temporarily locking affected accounts.

Final Thoughts

Phishing attacks in Singapore are relentless, well-funded, and continually evolving. But they rely on a single ingredient: a moment of inattention from the target. By understanding the local playbook — the fake IRAS refunds, the DBS impersonations, the SingPost parcel scams — and by building habits of verification, you dramatically reduce your risk. Share this knowledge with family members, especially elderly relatives who are disproportionately targeted. In a connected society like Singapore's, collective vigilance is the best firewall.