In this guide · 8 sections
What phishing emails are after
SingCERT's page on reporting a phishing email says phishing emails typically try to:
- trick you into giving away login IDs, passwords, card details or other personal information;
- trick you into transferring money;
- get malicious software onto your computer;
- test whether a mailbox is active, so it can be targeted again.
Scams remain a large problem in Singapore. ScamShield reports that in the first half of 2026 the number of scam cases fell 14.4% to 16,281, and losses fell 17.9% to about S$410.6 million (ScamShield). Email is only one route, alongside SMS, WhatsApp and calls, but it is the main one for attacks on businesses.
The warning signs, with examples
SingCERT's advice is to watch for spelling and grammar errors, be wary of urgent or threatening messages, check the sender's address matches the name, hover over links before clicking, and scan attachments. In practice, these are the signs that catch most phishing aimed at small businesses:
| Warning sign | What it looks like | What to do |
|---|---|---|
| Pressure to act now | "Your mailbox will be deleted in 24 hours", "Pay today to avoid suspension" | Slow down; urgency is the scammer's main tool |
| Sender name and address don't match | "Microsoft 365 Admin" sent from a free webmail address, or a lookalike domain like yourc0mpany.com | Expand the sender details and read the actual address |
| Link text and destination differ | A button labelled "View invoice" that points to an unfamiliar website | Hover (or long-press on a phone) to see the real address |
| A login page after a link | A page that looks like Microsoft or Google sign-in, reached from an email | Never sign in from an email link; go to the site yourself |
| Unexpected attachment | "Payment advice.html", a zipped invoice, a document asking you to enable macros | Don't open; check with the sender by phone |
| Bank details changed | A supplier or landlord says their account has changed and asks you to pay the new one | Call them on a number you already have, not one in the email |
| Odd requests from a boss | "Are you at your desk? I need you to buy gift cards" | Confirm in person or by a known phone number |
| Government or delivery impersonation | A tax refund, fine, parcel fee or licence renewal that needs payment by link | Government sites end in .gov.sg; check by going to the agency's site yourself |
One rule stops the most expensive scams: never change payment details, or pay a new account, on the strength of an email alone. Always confirm by phone using a number you already had.
Fake invoices and business email compromise
Business email compromise (BEC) is when a criminal either takes over a real mailbox (yours or a supplier's) or impersonates one convincingly, then uses it to redirect payments. Because the email may come from the genuine account, the usual signs can be missing. Watch instead for:
- a change in bank details, especially to an overseas account or a personal name;
- a supplier who suddenly wants payment early, or by a different method;
- a reply in an existing email thread that adds new payment instructions;
- replies that go to a slightly different address from the one you wrote to.
If your own mailbox has been taken over, attackers often set up hidden forwarding rules so they can read your mail. Our guide to what to do when business email is hacked covers how to find and remove them.
Someone clicked: what to do in the next hour
- Don't panic and don't hide it. The sooner it is reported, the less damage it does. Make it clear to staff that reporting a mistake will not get them in trouble.
- If a password was typed in, change it immediately from a different, trusted device, and sign the account out of all sessions.
- Check MFA is on for that account, and that no new MFA method or recovery phone was added.
- If an attachment was opened, disconnect the computer from the network and run a full antivirus scan.
- If money was sent, call your bank straight away to try to stop or recall the payment, then make a police report.
- Check the mailbox for new forwarding or inbox rules the attacker might have created.
- Warn others who received the same email, and block the sender.
SingCERT's advice for anyone using a work laptop or phone is to contact your IT team first. If personal data may have been exposed, assess whether it is a notifiable breach under the PDPA; see our PDPA data breach notification guide.
How to report phishing in Singapore
| Who | When | How |
|---|---|---|
| SingCERT (CSA) | Any phishing email, so it can be taken down | Submit the email through SingCERT's "Report a phishing email" page; SingCERT may work with hosting providers to take down the address and websites used |
| ScamShield | Unsure whether something is a scam | ScamShield app, or the 24/7 ScamShield Helpline at 1799 |
| Police | Money lost, or a cybercrime committed | Online police report through the SPF e-services |
| Your bank | A payment was made to a scammer | Call the bank's hotline immediately |
| Microsoft or Google | Phishing reached your business mailbox | Use the Report phishing button in Outlook or Gmail, which also trains the filters |
Stopping phishing before it reaches people
Training helps, but some phishing will always look convincing. The settings that matter most for a small business are:
- Multi-factor authentication for every account, so a stolen password alone isn't enough. See our guide to setting up MFA.
- SPF, DKIM and DMARC on your domain, so criminals can't easily send email that appears to come from you.
- Link and attachment scanning (Safe Links and Safe Attachments in Microsoft Defender for Office 365, or Google's advanced protections).
- Impersonation protection for directors and finance staff, and an "external sender" banner on mail from outside.
- Short, regular training with local examples: fake PayNow requests, delivery fees, government impersonation and WhatsApp account takeovers.
Do it yourself or get help?
You can start today: share the warning-sign table above with your team, agree the "always phone to confirm bank changes" rule, and turn on MFA everywhere.
For the technical side, Email Threat Protection (S$290) turns on link and attachment scanning, impersonation protection, an external-sender banner and a report-phishing button for everyone. Security Awareness Training (S$390) sets up a year of 5-minute lessons with Singapore-specific scam topics and completion tracking, in your own account.
Frequently asked questions
SingCERT lists spelling and grammar errors, urgent or threatening messages, a sender address that doesn't match the sender's name, links that point somewhere unexpected, and suspicious attachments. For businesses, also watch for any request to change bank details or make an urgent payment.
Send it to SingCERT through its "Report a phishing email" page, which lets CSA work on taking down the addresses and websites used. If you are unsure whether something is a scam, call the ScamShield Helpline at 1799. If money was lost, contact your bank and make a police report.
If you entered a password, change it from a trusted device and sign out all sessions. Check MFA is on and unchanged. If you opened a file, disconnect the device and scan it. If you paid money, call your bank immediately and make a police report.
Yes. In business email compromise, criminals take over a real mailbox and send from it, often replying in genuine threads. That's why payment changes should always be confirmed by phone on a number you already know.
It stops most attacks that rely only on a stolen password, which makes it one of the most effective protections. Some phishing kits try to capture MFA codes too, so phishing-resistant methods such as passkeys or security keys are stronger still.