You will be able to spot phishing messages and suspicious calls from people pretending to be your bank.
Open your SMS inbox and scroll back a few weeks. Look for any message that uses a bank's name, says something is wrong with your account and asks you to tap a link. Many people already have at least one message like this, unread or half forgotten. Some of these messages look almost identical to the real alerts your bank sends.
When scammers pretend to be a bank, they mostly use three tools. The first is the phishing message. The second is the fake login page that the message leads to. The third is a phone call from a number that looks local. Each tool has a signal you can check without being an expert. None of the signals needs technical knowledge, and you can see all of them at a glance.
The simplest rule in this whole module is that banks in Singapore no longer send clickable links by SMS or email to retail customers. Your bank may still message you about a transaction, a one-time password or a change to your account, but those messages come without a link.
That means you don't need to judge the spelling, the logo or the tone. If a message claims to be from a bank and contains a link, treat it as a scam and delete it. If the message has left you worried about your account, open your banking app or call the number on the back of your card.
Scammers know about the no-links change too. Some of their messages now leave out the link and ask you to call a number instead, and that number goes to the scammer. The rule from Lesson 1.3 still applies here: use contact details you found yourself, never the ones in the message.
Some messages arrive with a sender name, such as a bank's or a delivery company's name, in place of a phone number. The SMS Sender ID Registry is the system that lets organisations register the names they send SMS under. Any organisation that sends SMS with a sender name must register that name. If a message uses a sender name that isn't registered, it can be labelled Likely-SCAM before it reaches you. This catches scammers who try to send messages under a bank's name.
The label has a limit. It applies only to messages sent under a sender name, so a scam text from an ordinary mobile number won't carry it. A message without the label is no proof that the message is genuine. When you see the label, treat it as a free warning, and keep checking everything else as usual.
Caller ID can be faked. A scam call can show a local-looking number or even your bank's real hotline. Singapore telcos add a plus sign in front of the number when a call comes from overseas. A number starting with "+" came from outside Singapore, even if the caller says they are from a local bank or agency.
Many people read "+65" as a sign that the call is local. +65 is the Singapore country code. When an incoming call shows "+65" in front of a local-looking number, the call came in through an overseas route. That does not always mean the number is spoofed. Singapore-based callers who are overseas and call home using mobile roaming, and overseas call centres of local businesses that hold local numbers for their hotlines, also show up as "+65". The ScamShield website explains how these calls are displayed, so check its current guidance.
A plus sign on its own doesn't prove a call is a scam, because friends and family call from abroad. It is a reason for care when the caller claims to be a local organisation and asks for anything that triggers the stop-and-check rule.
Phishing is the trick of getting you to hand over your login details by pretending to be someone you trust. The message is the bait, and the damage happens on the page behind the link. A phishing page copies the bank's login screen closely, with the same colours, logo and layout. The web address gives the page away. On a phone, though, the address is often cut short, or made to look like the real one by changing a letter or adding an extra word.
The sequence usually runs like this:
You enter your username and password on the fake page. The page tells you to wait. The scammer types your details into the real bank's website. The real bank thinks you are logging in, so it sends you a one-time password by SMS. The fake page asks you for that code. You enter the code, and the scammer is inside your account. The scammer adds themselves as a payee, raises the transfer limit and moves money out.
Daniel gets an SMS saying the bank account will be suspended unless the details are updated. The message contains a link, and the page it opens looks exactly like the bank's login. Daniel enters the password and then a one-time password. A few minutes later a second SMS arrives, this time from the real bank, saying a new payee has been added. That message has no link, and it is the genuine alert. It gives Daniel the chance to call the bank's hotline and freeze the account straight away.
If your bank sends you a linkless alert about a change you didn't make, such as a new payee, call the number on the back of your card at once.
Now go back to your SMS inbox. Look for messages that carry the Likely-SCAM label, and for messages that use a bank's name and contain a link.
Go through your SMS inbox. Delete or report any message labelled Likely-SCAM and any message with a link that uses a bank's name.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).