How to Report a Scam Website or Phishing Page in Singapore

Which channel to use: quick guide

Each channel has a different job. Government channels collect intelligence and can push for takedowns; your bank can stop payments; browsers can warn visitors within hours; the host can remove the page. Use more than one.

If you are unsure whether something is a scam at all, ScamShield's check for scams page points to the ScamShield app and the 24/7 helpline on 1799.

Report the scam website to ScamShield

The ScamShield portal links a 'Report a Scam' form at go.gov.sg/scamreport. It asks what you want to report: a person who called you, a message, a website link or an email. For a website, you enter the URL. The form notes that web reporting is currently an experimental feature.

• Website link: paste the full address (for example the exact page, not just the home page).
• Message: choose SMS, WhatsApp or Telegram, then upload a screenshot or paste the text, with the sender's ID or number.
• Email: the form asks you to forward the suspicious email to report_email@triage.scamshield.gov.sg.
• Calls: give the number, the call type and who the caller claimed to be.

Report a phishing site or email to SingCERT

SingCERT, part of the Cyber Security Agency of Singapore (CSA), takes reports of cyber incidents based in Singapore. Its Cyber Aid page lists phishing websites, scam emails, website defacements and malware hosting among the incidents you can report, with a technical form for IT specialists.

For a phishing email, CSA's report a phishing email page asks you to submit it, ideally with the email header. CSA says SingCERT will review the report and, if it finds something malicious, may work with hosting providers to take down the email address and any malicious websites linked in the email. If your mail system blocks forwarding, email singcert@csa.gov.sg without the attachment.

This is the channel to use when a page imitates your company, your bank or a government agency, even if nobody has lost money yet.

If money was lost: bank first, then the police

ScamShield's I've been scammed page sets out four steps. Speed matters most with the first one.

1. 1

   Call your bank's anti-scam hotline

   If a bank account or card was compromised, the bank can act straight away to limit further losses. ScamShield keeps a list of bank anti-scam hotlines and explains the banks' kill switch.

2. 2

   File a police report

   File online through Police e-services or at a Neighbourhood Police Centre. For urgent help, call 999.

3. 3

   Secure accounts and warn contacts

   Change passwords on any account whose login you typed into the fake site, turn on multi-factor authentication, and tell contacts if an email or social account was taken over.

4. 4

   Report to the platform

   For e-commerce scams, report the seller to the marketplace or social platform as well, so it can act against the account.

ScamShield's FAQ is frank that money moved overseas is hard to recover, and that seized money is only returned after investigations end. That is why the bank call comes first.

What evidence to include in a scam report

ScamShield's page on what to include in a police report gives a useful list for any report, not just the police one.

Do not log in, pay or download anything to 'test' the site. Screenshot it as it appears, and if a staff member already entered a password, treat that account as compromised.

Get the site blocked in browsers and taken down

Government reports take time. While they progress, browser and provider reports can protect your staff and customers quickly.

• Google Safe Browsing: report the URL at Google's phishing report page. Chrome and other browsers that use Safe Browsing warn visitors once Google confirms it.
• Microsoft: report it via Microsoft's unsafe site report so Edge and Microsoft's mail services warn users.
• Registrar and host: look up the domain at ICANN Lookup (or SGNIC for .sg) and email the abuse contacts with your screenshots.
• Ad and social platforms: if the link was spread through an ad or post, report that too.

If the fake site impersonates your own business, our guides on lookalike domain takedowns and fake social media ads using your brand cover warning customers and dispute options in more detail.

Do it yourself or get help?

Reporting is something anyone can do in 15 minutes with the steps above. The harder part for a business is making sure staff recognise fake pages before they type in a password, and know who to tell when they do. Our guide on how to spot a phishing email is a good starting point to share with your team.

Our Security Awareness Training (S$390) covers phishing pages, payment scams and a simple reporting routine for staff, so incidents get reported in minutes rather than days.