Online Security & Scam Advisory

Scams targeting investors are getting harder to spot, fake brokers, cloned websites, and even AI-generated voices and videos. This page explains the tactics currently in circulation and what to do if you encounter one.

See the scam types
If you’ve been scammed

Suspect a scam? Call 999 or visit ScamAlert.sg

Know the tactics

Tap each entry to see how it works, the warning signs, and what to do.

Investment scams

A stranger, often via a chat group or social media ad, offers a “guaranteed” high-return investment through a platform or broker you can’t independently verify. Early “withdrawals” are staged to build trust before the real money goes in.

Red flags

  • Returns promised regardless of market conditions
  • Pressure to act before a “window” closes
  • The firm isn’t on MAS’s register of licensed entities

What to do

  • Check the firm against the MAS Financial Institutions Directory
  • Never transfer funds to a personal bank account for an “investment”
  • Leave the chat group and block the contact
Job scams

A “part-time” or “task-based” job offer asks you to complete simple online tasks for pay, then asks you to top up your own funds first to “unlock” higher commissions — money you never get back.

Red flags

  • You’re asked to pay or transfer money before earning anything
  • Recruitment happens entirely over WhatsApp or Telegram
  • No formal interview, contract, or company registration details

What to do

  • A legitimate job never requires you to pay to be paid
  • Verify the company on ACRA’s business registry
  • Stop responding once payment is requested
Phishing emails

An email imitating your broker, bank, or a well-known institution warns of a problem with your account and links to a fake login page designed to capture your username and password.

Red flags

  • Sender address is a close but incorrect variation of the real domain
  • Urgent language: “account suspended,” “act within 24 hours”
  • Link text doesn’t match where it actually leads

What to do

  • Type the institution’s website address directly rather than clicking
  • Hover over links to check the real destination first
  • Report the email to your broker and delete it
Government & institution impersonation

Someone claiming to be from MAS, the police, or a government agency contacts you about a supposed investigation, frozen funds, or unpaid tax, and instructs you to move your money “for verification” or “safekeeping.”

Red flags

  • Government agencies do not ask you to transfer money by phone or SMS
  • Threats of arrest to pressure quick action
  • Instructions to keep the matter confidential from family or your bank

What to do

  • Hang up and call the agency back on its official listed number
  • No genuine agency asks for OTPs or fund transfers over the phone
  • Report the call to the police or via ScamAlert.sg
Fake CAPTCHA prompts

A pop-up styled as a routine “I’m not a robot” check instead instructs you to copy a command and run it on your computer — actually a script that installs malware giving scammers remote access to your device.

Red flags

  • A CAPTCHA that asks you to open “Run,” a terminal, or paste text
  • Appears after clicking a link from an unfamiliar ad or site
  • Genuine CAPTCHAs only ask you to click images or a checkbox

What to do

  • Close the browser tab immediately — never paste or run anything
  • If you already did, disconnect from the internet and run a malware scan
  • Change your passwords from a separate, trusted device
AI voice & video deepfakes

Short clips of a familiar public figure or fund manager, generated or altered with AI, appear to endorse an investment opportunity. A cloned voice of a relative or colleague may also be used in an urgent phone request for money.

Red flags

  • Slightly off lip-sync, blinking, or audio timing
  • The endorsement only exists on one obscure page or account
  • An urgent, out-of-character request for funds by voice or video call

What to do

  • Verify through a second channel — call the person back on a known number
  • Public figures rarely endorse specific trading platforms directly
  • Report the video or account to the platform it’s hosted on
Vishing (voice phishing)

A caller, sometimes with a spoofed number that shows your bank’s or broker’s real hotline, walks you through “verifying” your account and ends up talking you into reading out an OTP or installing remote-access software.

Red flags

  • Any request to read out an OTP over the phone
  • Caller ID can be spoofed — a familiar number isn’t proof of identity
  • Instructions to install screen-sharing or remote desktop apps

What to do

  • Hang up and call the institution back using the number on your card or statement
  • Never share an OTP with anyone, including “bank staff”
  • Uninstall any remote-access app you were guided to install
Device code phishing

You’re asked to enter a short code (originally meant to log a new TV, printer, or work device into your account) into a genuine login page. Entering it hands the scammer an active, logged-in session on your account — no password needed.

Red flags

  • Someone else sends you a device code and asks you to enter it
  • A message claims you need to “confirm” a device you didn’t set up
  • Request arrives with urgency, often paired with a fake support call

What to do

  • Never enter a device or authentication code someone else sent you
  • Only enter such codes for a sign-in you personally initiated
  • If you entered one by mistake, sign out of all sessions and change your password
Cloned government websites

A near-identical copy of a government or regulator website — often reached through a paid search ad or SMS link — collects your personal details or payment under the guise of a fine, tax refund, or licence renewal.

Red flags

  • Domain ends in .com or .net rather than .gov.sg
  • Reached via an ad or SMS link rather than typed in directly
  • Asks for card details for a “refund,” which government sites don’t do this way

What to do

  • Always navigate to .gov.sg sites by typing the address yourself
  • Check for the padlock and correct domain before entering any details
  • Report the fake site to SingCERT

Everyday habits that keep you safe

Most scams rely on you skipping one of these basics under pressure.

  • Never share your login password or OTP with anyone, including people claiming to be bank or government staff.
  • Enable app-based or hardware-token two-factor authentication instead of relying only on SMS.
  • Verify a broker or platform against the MAS Financial Institutions Directory before transferring funds.
  • Type website addresses directly rather than clicking links in emails, SMS, or ads.
  • Treat unsolicited investment tips from chat groups and social media with scepticism, however convincing.
  • Pause before acting on anything urgent, scams rely on rushing you past your own judgement.

If you think you’ve been scammed

Acting quickly in the first hour matters most.

  1. Stop all contact — End the call, close the chat, or leave the website. Do not send further money to “recover” what was already lost, that request itself is often part of the scam.
  2. Contact your bank and broker immediately — Ask about freezing the transaction or account. The sooner this happens, the higher the chance funds can be recalled.
  3. Lodge a police report — File a report with the Singapore Police Force, and submit details through ScamAlert.sg so the case can be tracked and linked to related reports.
  4. Tell your member firm — Let your broker or financial institution know, especially if login credentials or OTPs may have been exposed, so your account can be secured.

Report and verify

This page is for general public education and does not constitute investment advice. If in doubt about an investment opportunity, verify with MAS directly before proceeding.