In this guide · 8 sections
- 01How SIM swap and OTP theft work
- 02Which business logins are most at risk
- 03Replace SMS OTP: digital tokens, authenticator apps and passkeys
- 04Protecting business bank accounts beyond the login
- 05Warning signs of a SIM swap and what to do
- 06The one rule every staff member needs
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Stop relying on SMS codes for anything important. Use your bank's digital token for business banking, passkeys or an authenticator app for Microsoft 365, Google and admin logins, and set transaction limits and dual approval so one stolen code cannot empty the account. Never read an OTP out to anyone.
How SIM swap and OTP theft work
In a SIM swap, a criminal convinces or bribes a telco channel to move your mobile number to a SIM card they control, often using stolen personal details. Your phone loses signal; theirs now receives your calls and SMS, including bank and login codes. SIM swap is only one route. Most OTP theft in practice is simpler:
| Method | How the code is stolen | Stops it |
|---|---|---|
| Phishing page | Fake bank or Microsoft login asks for the OTP and relays it in real time | Passkeys, digital tokens bound to the device |
| Social engineering | Caller posing as the bank, police or IT asks you to read out the code | Rule: nobody legitimate ever asks for an OTP |
| SIM swap | Your number is moved to the attacker's SIM | Not using SMS for important logins |
| Malware on the phone | Fake app reads SMS or the screen | Install apps only from official stores; bank app anti-malware checks |
| Shared phone or inbox | Codes go to a shared office phone or email many people see | Personal tokens per user, never shared |
The MAS and ABS joint release of 9 July 2024 said scammers had become able to phish OTPs more easily, and announced that major retail banks would phase out OTPs for account login by customers who use digital tokens within three months. Physical token users were not affected.
Which business logins are most at risk
List every login where a stolen code would let someone move money, read customer data or lock you out. For most small businesses:
- Business internet banking (DBS IDEAL, OCBC Velocity, UOB Infinity and similar) and the owner's personal banking if it is used for the business
- Microsoft 365 or Google Workspace admin accounts, which control every mailbox
- Domain registrar and DNS, where a takeover redirects your website and email
- Payment gateways such as Stripe and HitPay, where payout bank details can be changed
- Singpass and Corppass, which open government services and many business sign-ups
- Social media business accounts and Meta Business Manager, which run your ads and pages
- Accounting software with supplier bank details
If any of these still use SMS as the only second factor, they are the ones to fix first.
Replace SMS OTP: digital tokens, authenticator apps and passkeys
Passkeys and security keys
Strongest- Bound to the real website, so phishing pages cannot use them
- Nothing to read out or type
- Supported by Microsoft, Google and many other services
Best for: Admin accounts, owners and finance staff.
Bank digital token or authenticator app
Good- Lives in an app on your own phone, not in SMS
- Not affected by a SIM swap
- A convincing phishing page can still trick you into approving
Best for: Banking, and everyone else's work logins.
SMS OTP
Last resort- Works on any phone
- Vulnerable to SIM swap, phishing and social engineering
- Keep only where nothing better is offered
Best for: Low-risk accounts with no alternative.
Our guide to phishing-resistant MFA explains passkeys in detail. If you use push approvals, read about MFA fatigue attacks and turn on number matching so staff cannot approve a login by accident.
Protecting business bank accounts beyond the login
Even with a strong login, assume someone could get in one day. Bank settings decide how much they could take. Our guide to corporate bank account scam safeguards covers each in detail; the short list:
Business banking safeguards
ScamShield's I have been scammed page links to each bank's anti-scam hotline and explains the kill switch that lets you freeze accounts quickly. Note that Singapore's Shared Responsibility Framework for phishing losses covers individuals' personal accounts, not accounts used for business, so business owners depend more on their own settings.
Warning signs of a SIM swap and what to do
A SIM swap usually shows up as your phone suddenly losing mobile service while Wi-Fi still works and colleagues' phones are fine. Act within minutes:
Call your telco from another phone
Use the number on the telco's official website. Ask whether your SIM was replaced or ported and have it reversed and blocked.
Call your bank's anti-scam hotline
Ask them to block online access or use the kill switch, and check for new payees, limit changes or transfers.
Change passwords from a clean device
Start with email, Microsoft 365 or Google admin, banking and domain registrar. Sign out all sessions.
Check recovery details
Look for changed recovery phone numbers, emails or new MFA devices on your key accounts, and remove any you don't recognise.
Report it
File a police report online and keep the telco and bank reference numbers. If customer data may be affected, consider your PDPA obligations.
Prevention on the telco side is limited for customers, but ask your telco what extra verification it offers for SIM replacement and port requests, keep your registered contact details current, and be careful with requests that ask you to confirm personal details by phone. Fraudsters often use a phone takeover as the first step in business email compromise.
The one rule every staff member needs
Most OTP theft ends with a person reading a code to a stranger. Make the rule simple and repeat it: no bank, government agency, IT provider or colleague will ever ask you for an OTP, token approval or passkey prompt. If anyone asks, hang up and call back on a number you look up yourself.
Back the rule with practice. Short, regular awareness sessions with real examples, such as fake bank calls and "your account will be suspended" SMS, work better than a one-off talk. A police and GovTech advisory on Singpass phishing makes the same point: Singpass does not send SMS messages with links asking you to log in with your password and OTP.
Do it yourself or get help?
Activating bank digital tokens, setting limits and dual approval, and switching admin accounts to passkeys or authenticator apps can be done in a day by the owner and one admin.
If you want help, our Microsoft 365 / Google Security Lockdown (S$590) moves admins to phishing-resistant MFA, removes SMS as a fallback where possible and sets up break-glass access. Security Awareness Training (S$390) teaches staff to spot OTP and impersonation scams with examples based on Singapore cases. Bank settings stay with you and your bank.
Frequently asked questions
It is better than a password alone, but it is the weakest second factor. Codes can be stolen by SIM swap, phishing pages, malware or by tricking the user. Singapore's major banks phased out login OTPs for digital token users after a July 2024 MAS and ABS announcement. Activate your bank's digital token instead.
The usual sign is your phone suddenly showing no mobile service or emergency calls only, while Wi-Fi still works and other phones nearby have signal. You may also stop receiving SMS or get unexpected messages about SIM changes. Call your telco from another phone straight away, then your bank.
Yes. Authenticator app codes and push approvals are generated on your device, not sent by SMS, so moving your phone number to another SIM does not give the attacker those codes. They do not stop a convincing phishing page from relaying a code, which is why passkeys are better for admin accounts.
No. Singapore's Shared Responsibility Framework for phishing scam losses covers individuals' personal accounts, not accounts used for business. Business owners should rely on their own controls: digital tokens, transaction limits, dual approval for new payees and quick use of the bank's kill switch if something goes wrong.
Act immediately. Call the bank's anti-scam hotline to block access or use the kill switch, change the affected account's password from a clean device, sign out all sessions and check for new payees or changed recovery details. File a police report and keep the reference numbers.