Phishing Attacks in Singapore: How to Recognize and Avoid Them

Phishing attacks in Singapore have evolved from clumsy email scams into sophisticated, highly localised operations that mimic banks, government agencies, and even delivery services with alarming accuracy. In 2023 alone, the Singapore Police Force reported over S$660 million in scam losses, with phishing-related cases forming one of the largest categories. If you live, work, or run a business in Singapore, understanding how these attacks operate is no longer optional — it is essential financial hygiene.

This guide breaks down the current phishing landscape in Singapore, the red flags you must memorise, and the practical steps you can take today to protect yourself, your family, and your organisation.

What Are Phishing Attacks?

Phishing is a form of social engineering in which attackers impersonate a trusted entity — such as DBS, OCBC, IRAS, SingPost, or SPF — to trick victims into revealing sensitive information like passwords, OTPs, credit card numbers, or SingPass credentials. The goal is almost always financial: direct theft, unauthorised transactions, or identity takeover that leads to loans fraudulently issued in your name.

While phishing is a global problem, Singapore is a particularly attractive target because of its high banking penetration, widespread digital payment adoption (PayNow, PayLah!), and the trust citizens place in official-looking communications.

The Current Phishing Landscape in Singapore

The Cyber Security Agency of Singapore (CSA) and the Singapore Police Force have repeatedly flagged phishing as one of the top cyber threats facing the nation. The tactics have shifted significantly over the past two years.

Common Phishing Channels in Singapore

• SMS phishing (smishing): Fake texts pretending to be from banks, SingPost parcel notifications, or ICA.
• WhatsApp impersonation: Scammers pose as friends, bosses, or family members asking for urgent transfers.
• Email phishing: Fake invoices, IRAS tax refund notices, or CPF statements.
• Voice phishing (vishing): Robocalls claiming to be from the police, MOH, or courier companies.
• QR code phishing (quishing): Fake QR stickers in hawker centres or on parking meters redirecting to malicious payment pages.

Recent High-Profile Scam Patterns

Three dominant patterns have emerged in Singapore:

1. Bank credential phishing: SMS warning of a "suspicious transaction" with a link to a cloned DBS, UOB, or OCBC login page.
2. Government impersonation: Messages claiming unpaid taxes, MOM work pass issues, or ICA document problems.
3. E-commerce and delivery scams: Fake Lazada, Shopee, Ninja Van, or SingPost notifications requesting "redelivery fees."

How to Recognise a Phishing Attempt

Attackers rely on urgency, authority, and familiarity. Learning to pause and inspect a message is the single most effective defence you can build.

Red Flags in Phishing Messages

Red Flag	What It Looks Like	Why It's Suspicious
Urgency	"Your account will be frozen in 24 hours"	Real banks give reasonable timeframes and multiple channels.
Unusual sender	SMS from a +60 or +63 number claiming to be DBS	Singapore banks use registered Sender IDs, not foreign mobile numbers.
Suspicious links	dbs-secure-login.xyz or bit.ly/sgpost-fee	Legitimate domains end in .com.sg or the brand's official TLD.
Requests for OTP	"Please share the 6-digit code to verify"	No legitimate agency ever asks for your OTP.
Poor grammar or odd phrasing	"Dear Customer, kindly do the needful immediately"	Official Singapore communications are proofread and localised.
Unexpected attachments	Invoice.pdf.exe or Statement.zip	Banks and agencies rarely send executable or zipped files.

Red Flags on Websites

• The URL does not match the official domain (e.g., singpass-login.net instead of singpass.gov.sg).
• No padlock icon or an invalid SSL certificate warning.
• The site asks for your SingPass password and OTP on the same page.
• Pop-ups demanding you install an "update" or APK file (especially on Android).
• Design looks almost right but fonts, spacing, or logos appear slightly off.

Real-World Phishing Examples Targeting Singaporeans

1. The SingPost "Redelivery Fee" Scam

Victims receive an SMS claiming a parcel could not be delivered and a small fee of S$1.50 is required. The link leads to a convincing clone of the SingPost site that captures card details. Because the amount is small, victims rarely hesitate — but the attackers then use the card for much larger overseas transactions.

2. The "Police Officer" WhatsApp Call

A caller claims to be from the SPF or China's authorities, accusing the victim of money laundering. They instruct the target to transfer funds to a "safe account" for investigation. Singapore Police have repeatedly stated: they will never ask you to transfer money or disclose banking credentials over the phone.

3. The Fake Bank Alert

An SMS appears in the same thread as genuine DBS or OCBC messages (thanks to Sender ID spoofing, now largely curbed by the SMS Sender ID Registry). The message warns of an unauthorised login and asks the victim to "verify" via a link. Entering credentials gives attackers full access, and the OTP request that follows completes the takeover.

4. The Malicious Android App

Victims are tricked into side-loading an APK — often disguised as a food delivery, cleaning service, or pet-sitting app advertised on Facebook. Once installed, the malware harvests banking credentials and intercepts SMS OTPs, leading to massive unauthorised withdrawals.

How to Protect Yourself from Phishing in Singapore

Personal Protection Checklist

1. Never click links in unsolicited SMS or emails. Open the official app or type the URL manually.
2. Enable the Money Lock feature offered by DBS, OCBC, UOB, and other local banks to ring-fence a portion of your savings from digital transfers.
3. Use the ScamShield app from the National Crime Prevention Council to automatically filter known scam SMS and calls.
4. Turn on two-factor authentication everywhere — SingPass, email, social media, and e-commerce accounts.
5. Never install Android APKs from outside the Google Play Store. iOS users should avoid installing configuration profiles from unknown sources.
6. Verify suspicious messages by calling the organisation directly using the number on their official website or the back of your debit card.
7. Inspect shortened links before clicking — hover on desktop or use a link-preview tool to see the real destination.

Safer Link Sharing for Businesses

Businesses that regularly share links with customers should use a reputable shortener with analytics, custom domains, and transparent destination previews. Trustworthy branded links reduce the chance that your customers mistake a real message for a phishing attempt. We've reviewed the leading options in our 2026 buyer's guide to URL shorteners, and platforms like Lunyb provide click tracking plus the ability to brand your links so recipients can verify the source at a glance.

Business and Organisational Defences

Defence Layer	What to Implement	Impact
Email security	SPF, DKIM, and DMARC on all company domains	Prevents attackers from spoofing your brand
Staff training	Quarterly phishing simulations	Reduces click-through on malicious emails by 60–80%
Endpoint protection	EDR tools and automatic patching	Catches malware that gets past the user
Access controls	MFA, least-privilege roles, hardware keys for admins	Limits damage when credentials leak
Incident response	Documented playbook with SingCERT contact details	Faster containment and regulatory compliance

What to Do If You've Been Phished

Speed is everything. The first 60 minutes after a successful phishing attack often determine whether you lose S$50 or your entire savings.

1. Call your bank immediately using the hotline on your card to freeze accounts and cards. All major Singapore banks have dedicated 24/7 anti-scam lines.
2. Report to the Anti-Scam Centre at 1800-722-6688 or file a report via police.gov.sg.
3. Change your passwords for the affected account and any others sharing the same password.
4. Revoke SingPass sessions via the SingPass app if you suspect credential compromise, and reset your password.
5. Report the scam SMS or URL to ScamShield so other Singaporeans are protected.
6. Monitor your CPF, credit bureau report, and bank statements for the next 90 days.
7. If malware was installed, factory reset the device before signing back into any accounts.

Singapore-Specific Resources

• ScamShield App — call and SMS filtering by NCPC and Open Government Products.
• Anti-Scam Helpline — 1800-722-6688.
• SingCERT — report cyber incidents at csa.gov.sg/singcert.
• ScamAlert.sg — up-to-date list of known scam tactics.
• SMS Sender ID Registry (SSIR) — organisations register legitimate Sender IDs; unregistered ones now show as "Likely-SCAM."

The Future of Phishing in Singapore

AI-generated phishing is already reshaping the threat landscape. Attackers now use large language models to craft perfectly worded Singlish messages, clone voices for vishing calls, and generate deepfake videos of executives authorising fraudulent transfers. The old advice — "look for bad grammar" — is no longer sufficient.

Expect to see more:

• Deepfake video calls impersonating CFOs and relatives.
• Context-aware phishing that references real purchases or recent travel (scraped from social media).
• QR code attacks replacing SMS links as consumers grow more cautious of texts.
• Supply chain phishing targeting SMEs that service larger regulated industries.

The response must be equally modern: passkeys replacing passwords, hardware security keys for high-value accounts, and a culture of "verify, then trust" across households and workplaces.

Frequently Asked Questions

How do I report a phishing SMS in Singapore?

Forward the SMS to 9-SPF-SCAM (97235226) or report it through the ScamShield app. You can also submit scam URLs directly to SingCERT at csa.gov.sg/singcert. If you've lost money, call the Anti-Scam Helpline at 1800-722-6688 and lodge a police report immediately.

Will banks in Singapore refund money lost to phishing?

Under the Shared Responsibility Framework introduced by MAS and IMDA, banks and telcos may bear part of the loss if they failed to meet their anti-scam duties. However, consumers are still expected to exercise due care. Reporting within minutes of the transfer dramatically improves your chances of recovery, since funds can sometimes be frozen before they are withdrawn overseas.

Is it safe to click shortened links from unknown senders?

No. Any shortened link from an unknown sender should be inspected first. Use a link-preview service, or simply ignore it and navigate to the organisation's site directly. Businesses sharing links with customers should use branded domains so recipients can verify authenticity — see our comparison of trusted URL shorteners for options.

What is the most common phishing scam in Singapore right now?

Bank credential phishing via SMS and WhatsApp remains the most prevalent, followed closely by e-commerce delivery scams (SingPost, Ninja Van, Lazada) and government impersonation (IRAS, ICA, MOM). Android malware delivered through side-loaded apps has also surged, often promoted via Facebook ads.

Can two-factor authentication stop all phishing?

Two-factor authentication blocks the majority of credential-theft attacks, but sophisticated phishing kits can relay OTPs in real time. For maximum protection, use phishing-resistant methods such as passkeys, hardware security keys (YubiKey, Google Titan), or in-app push approvals rather than SMS OTPs where possible.

Final Thoughts

Phishing attacks in Singapore are not going away — they are becoming more targeted, more localised, and more convincing. The good news is that most attacks still rely on the same emotional triggers: urgency, fear, and authority. Train yourself and your team to pause before clicking, verify through a second channel, and treat every unsolicited link as suspicious until proven otherwise.

Combine that mindset with the technical safeguards built into Singapore's banking system — Money Lock, ScamShield, the SMS Sender ID Registry, and the Shared Responsibility Framework — and you dramatically shrink the window of opportunity for attackers. Stay vigilant, stay informed, and when in doubt, hang up and call back on a number you trust.