A text about a parcel you did not order. An email warning your bank account will be “suspended” today. A message that looks like it is from a delivery firm, a government agency, or even a friend. These are the everyday face of phishing scams in Singapore, and they are designed to make you panic and click before you think. The reassuring truth is that a handful of simple habits protect you against almost all of them.
This is general guidance to help you stay safe, not personalised advice. Scam tactics change constantly, so treat the principles here as a foundation and keep checking official sources for the latest warnings.
How Phishing Works
Phishing is any attempt to trick you into handing over sensitive information or money by pretending to be someone you trust. The message might arrive by SMS, email, WhatsApp, a social media chat, or even a phone call. It usually pushes one of three emotional buttons: fear, urgency, or reward.
A fear-based message claims something is wrong. Your account is compromised, a payment failed, or you owe a fine. An urgency message says you must act within minutes or lose access. A reward message dangles something good, such as a prize, a refund, or a too-good deal, to lower your guard.
Whatever the story, the goal is the same. The scammer wants you to click a link, log in on a fake site, or read out a code. Modern fake websites can look almost identical to the real thing, right down to the logo and layout, which is why you cannot rely on appearance alone.
The Red Flags to Watch For
You do not need to be a technology expert to spot most phishing attempts. Train yourself to pause when you notice any of these signs:
- Unexpected links. A message asking you to click through to “verify”, “unlock”, or “update” your account.
- Pressure and deadlines. Threats that something bad happens today or within the hour.
- Requests for codes or logins. Anyone asking for your one-time password (OTP), PIN, banking password, or Singpass details.
- Slightly wrong details. Odd sender addresses, misspelled web addresses, or a link that does not match the real organisation’s official domain.
- Unusual payment requests. Being told to transfer money to a “safe account”, pay via gift cards, or install an app to “resolve” an issue.
When two or more of these appear together, treat the message as a scam until proven otherwise. It is completely reasonable to ignore a message, and to verify separately through official channels instead.
The Golden Rules That Keep You Safe
If you remember nothing else, remember these. They stop the large majority of phishing scams in Singapore in their tracks.
Never share your OTPs, passwords, banking logins, or Singpass details with anyone. Not with a caller, not on a link, not with someone claiming to be from your bank or a government agency. Banks and government agencies will never ask you for these. A genuine officer does not need your password or your OTP, ever.
Do not click links in unexpected messages. Instead, go to the organisation directly. Type the official web address yourself, or use the app you already have installed. If a message says it is from your bank, open your banking app or call the number on the back of your card, not any number in the message.
Do not let anyone rush you. Scammers rely on speed. Slowing down, and checking with someone you trust, is often all it takes to break the spell.
Never let anyone use your bank account to receive or move money. Acting as a “money mule”, even unknowingly, is a crime. If a stranger, an online “employer”, or a new online friend asks to route funds through your account, refuse and report it. You can read more about how to avoid becoming a money mule.
What to Do If You Have Been Caught Out
If you clicked a link, entered your details, or fear you have been scammed, act fast and do not blame yourself. These scams fool careful, intelligent people every day.
- Contact your bank immediately through its official hotline or app so it can try to freeze accounts and stop transfers. Speed matters most in the first minutes and hours.
- Change any passwords you may have exposed, starting with banking and email, and enable extra security where you can.
- Report the scam to ScamShield, using the ScamShield helpline and app, and make a police report. Reporting helps the authorities track and disrupt these operations.
Be especially careful afterwards about recovery scams. Once you have been a victim, fraudsters may approach you posing as investigators, lawyers, or “recovery agents” who promise to get your money back for a fee. This is a second scam layered on the first. No legitimate party will guarantee to recover lost funds for an upfront payment. If you need to rebuild after a loss, our guide on how to financially recover from a scam walks through sensible next steps.
Staying Alert Without Living in Fear
You do not need to be anxious about every message. You just need a few firm rules and a habit of pausing. Guard your OTPs, passwords, logins, and Singpass like house keys. Verify through official channels rather than links. Never move money for strangers. And if something ever goes wrong, act quickly and report it.
Phishing works on hesitation and haste. Replace both with a calm, consistent routine, and these messages lose almost all their power. Alongside this, building broader awareness of common money scams in Singapore will help you and the people you care about stay one step ahead.