Don't Get Phished: The Scams Threatening Your Property Transaction

It's a Friday afternoon. Your offer on a resale flat has just been accepted, and your conveyancing lawyer's email arrives with the payment instructions for the option fee. The logo looks right. The signature looks right. The tone is professional. The only oddity is one line near the bottom: "Our bank account details have changed. Please remit the deposit to the account below."

Most people won't question that line. And that's exactly what the scammers are counting on.

Phishing scams targeting property transactions in Singapore have quietly become one of the most expensive threats in the digital economy. According to the Singapore Police Force's (SPF) annual scams briefing, total scam losses in Singapore crossed the S$1 billion mark for the first time in 2024 — S$1.1 billion lost to 52,355 reported cases. Phishing has consistently ranked among the top three scam types by case count. And while most people associate phishing with bank accounts and OTPs, property buyers and sellers are increasingly in the crosshairs — because nothing screams "target" quite like a six-figure deposit moving through a chain of emails and WhatsApp messages.

This article breaks down the tactics being used against property buyers and sellers in Singapore, the real incidents that have already happened, the defences being built around your money, and a 10-step verification process that could be the difference between closing your deal and losing your deposit.

The numbers behind Singapore's scam wave

Let's start with the big picture, because scale matters when you're deciding how paranoid to be.

The SPF's annual scams briefings show a staggering upward trajectory. In 2019, total scam losses stood at about S$206 million. By 2024, that figure had grown more than fivefold to S$1.1 billion.

A few things stand out from this chart:

• 2021 was the inflection point. Losses nearly tripled from S$268 million in 2020 to S$632 million in 2021, driven largely by the infamous OCBC SMS phishing wave in December of that year.
• 2022 and 2023 saw losses plateau — a sign that bank countermeasures and public awareness were having some effect.
• 2024 broke through the S$1 billion ceiling. The jump was driven primarily by investment scams, job scams, and a surge in "fake friend call" impersonation scams. But phishing didn't go away — it just multiplied in volume.

The volume of cases is growing even faster than the dollar figure. Between 2020 and 2024, the number of scam cases reported in Singapore more than tripled:

Why does this matter for property? Because the same phishing techniques that drain bank accounts — fake login pages, urgent SMS alerts, impersonated WhatsApp contacts — are being adapted for bigger, slower-moving prey. A credit card scam yields a few thousand dollars. A property scam yields a five- or six-figure deposit.

Why property transactions are prime targets for phishing scams

If you're buying or selling a home in Singapore, you're running one of the most money-intensive, document-heavy processes of your life. That makes you a perfect target. Here's why:

• The sums are enormous. Even the "small" option money on a private property is typically 1% of the purchase price — S$10,000 on a million-dollar home — and a further 4% on exercise. For HDB resale, the option fee and exercise fee together form a substantial downpayment. One successful phishing attempt on a property transaction can net a criminal more than 100 typical banking scams.
• The process has many moving parts. A single resale transaction can involve the buyer, the seller, two property agents, two law firms, a bank, and HDB or URA records. Every handoff — every email, every document, every "please confirm" — is an opportunity for a scammer to interject.
• The communication is almost entirely digital. Conveyancing is driven by email chains and WhatsApp messages. Scammers live in those channels.
• There is genuine time pressure. Option periods are short, deadlines are real, and parties are anxious to close. Urgency is phishing's favourite weapon.
• People defer to authority. When an email claims to be from your lawyer, your bank, or HDB, your instinct is to comply, not to verify.
• The payments are one-off and out-of-character. Your banking app's fraud detection is tuned to your normal spending patterns. A S$200,000 transfer to a "law firm" account doesn't look like your usual behaviour — but if it's a new payee you've just added in a hurry, it can slip through.

Phishing in property isn't usually about tricking you out of your password. It's about tricking you out of your judgment at the exact moment you're supposed to transfer a life-changing sum of money.

Here's how a typical property phishing scam flows:

How phishing scams target property buyers in Singapore

Let's go through the actual playbook. These are the tactics that have been documented in Singapore, based on police advisories, Law Society warnings, and the Council for Estate Agencies' (CEA) public notices.

1. Fake listings and phantom landlords

Rental scams are the most visible property scams in Singapore. The pattern is consistent: a listing appears on Carousell, Facebook Marketplace, Telegram, or even a cloned property portal — priced 15% to 30% below market to trigger your fear of missing out. The "landlord" is overseas, or the "agent" is too busy for a physical viewing. When you express interest, the urgency kicks in: "Three other applicants want this unit. Pay a deposit to hold it and it's yours."

The payment is almost always via PayNow to a personal account, or a bank transfer to someone who is definitely not the registered owner of the property.

Worse still, police have warned about a variant where scammers legally rent a unit on a short-term basis (or borrow a friend's unit), then advertise it as a long-term rental, collect deposits from multiple victims, and vanish before the real tenant returns.

Red flags: below-market rent, refusal to allow viewings, a "landlord" who communicates only on WhatsApp, and any request to transfer money before a signed tenancy agreement and proof of ownership.

2. The hacked "lawyer" email (payment redirection fraud)

This one is scarier because you've done everything right — you engaged a real law firm, you received legitimate documents, and the email sitting in your inbox is indistinguishable from the correspondence you've been getting for weeks.

Here's how payment redirection works: scammers compromise (or spoof) the email account of a law firm, a property agency, or a buyer, and monitor the conversation. At the critical moment — right before your option fee or balance payment is due — they send a message that looks like an update from your lawyer: "Our bank account details have changed. Please transfer to the following account."

In some documented cases, scammers have intercepted invoices and replaced the bank account number embedded in the PDF. In others, they've hijacked the actual email thread and continued it, so the entire context looks legitimate.

The Law Society of Singapore has repeatedly warned about this. The key detail to understand: legitimate conveyancing money must be paid into a conveyancing account — a specially designated account held in the law firm's name under Law Society rules. A genuine law firm will not suddenly shift your payment to a personal savings account or a different company's account mid-transaction.

The scam usually looks like this, compared with the legitimate flow:

3. SMS phishing: the OCBC playbook, repurposed for property

In December 2021, fraudsters sent SMS messages that appeared to come from OCBC, directing customers to fake login pages that looked identical to the bank's website. By the time it was over, at least 790 customers had lost about S$13.7 million. It remains the most costly phishing incident in Singapore's history, and it changed banking regulation permanently.

That same playbook has since been repurposed for property-adjacent targets:

• Fake CPF Board SMS messages claiming your CPF refund or housing grant is pending, with a link to a fake login page.
• Fake HDB emails about grant eligibility, BTO appointment changes, or resale application fees.
• Fake bank alerts during the conveyancing window: "A large transaction was detected on your account. Verify now." — followed by a link to a phishing site that harvests your internet banking credentials and OTP.
• Fake Singpass login pages, used to steal your digital identity entirely. A compromised Singpass can be used to apply for credit cards, redirect government correspondence, and even facilitate money laundering through your name.

What makes these effective is the context. If you're in the middle of a property purchase, you ARE expecting an HDB letter, a bank alert, and a Singpass login. A scammer doesn't need to be lucky — they just need to fire the same generic phishing templates at thousands of addresses until one lands on someone in an active transaction.

4. Cloned agency websites and fake new-launch portals

Property scams don't always start in your inbox. Sometimes they start with a Google search.

Scammers have been known to clone the websites of real property agencies — copying logos, layouts, and even agent profiles — and run them as "off-market" or "direct developer" portals. Their listings are priced below the developer's official price list, and the sales pitch is simple: "Register with us for priority allocation" or "Pay a booking fee to secure the unit."

In new-launch scenarios, fake websites mimicking official developer sales portals have appeared before major project launches, offering e-brochures, virtual viewings, and "early bird discounts" in exchange for your contact details — and sometimes a booking fee. The moment you pay, the site disappears.

Genuine property transactions in Singapore do not require you to pay application fees, priority fees, or booking fees to random third-party websites. Authorised agents are registered with CEA, and developer sales are conducted through licensed agencies.

5. Government official impersonation with a property twist

Government official impersonation scams are among the most-reported scam types in Singapore. In the property context, the script usually goes like this: a caller claims to be from HDB, IRAS, or the CPF Board, and tells you that your housing grant has been suspended, a stamp duty payment has failed, or your BTO flat is at risk. You are directed to "verify" your details by logging into a website — which is fake.

The psychology is brutal. You've spent years waiting for that BTO. The threat of losing it short-circuits rational thought, and the next thing you know, you've handed over your NRIC number, your banking credentials, or an OTP.

The most important rule for any government-related message: HDB, CPF Board, and IRAS will never send you a login link via SMS or email. When in doubt, go directly to the official website by typing the address yourself, and never click the link in the message.

Real incidents: from the OCBC phishing wave to fake "lawyer" emails

Let's look at the incidents that have already happened in Singapore — because they show exactly how quickly these scams go from "clever" to "catastrophic."

The OCBC SMS phishing wave (December 2021)

This is the case that woke Singapore up. Over several weeks in December 2021, scammers sent out large volumes of SMS messages designed to look like OCBC fraud alerts. The messages contained links to fake OCBC websites. Customers who clicked and logged in — entering their username, password, and OTP — found their accounts drained within minutes.

By the time OCBC acknowledged the scale of the attack, about 790 customers had lost around S$13.7 million. The bank later said it would fully compensate the affected customers, and the Monetary Authority of Singapore (MAS) responded by ordering banks to implement a suite of measures, including a "kill switch" that lets customers freeze their own accounts remotely, delays before first-time transfers to new payees, and default daily transfer limits.

The lesson for property buyers: these attacks worked not because the fake websites were perfect, but because the SMS arrived at a moment when the victim was primed to act. A message that says "We detected a suspicious transaction — click here to secure your account" creates panic. Panic is the first step of the scam.

The Singpass phishing crackdown

In 2022, the police arrested more than 130 people in a nationwide crackdown on phishing scams linked to fake Singpass websites. The scammers had created phishing pages that harvested Singpass credentials, then used stolen identities to open bank accounts, apply for credit cards, and reroute loans. These "money mule" accounts are then used to receive stolen property deposits and rental payments, making recovery almost impossible because the money has been laundered through layers of accounts by the time anyone realises.

Rental scam advisories

The police have issued repeated advisories about rental scams, which they describe as a persistent problem on e-commerce and social media platforms. In a typical case, a victim finds a listing for a flat at an attractive rent, deals with a self-described "agent," and pays a deposit to secure the unit. The agent stops responding. The victim later discovers the flat was never for rent — or was never even in the "agent's" possession.

Payment redirection in conveyancing

The Law Society of Singapore has warned law firms and their clients repeatedly about email account compromise and payment redirection. The mechanism is simple: a buyer receives an email that appears to come from their lawyer's email address, containing "revised" bank details. The buyer transfers the option fee or the balance payment — often a five- or six-figure sum — and only realises the mistake days later, when the lawyer asks why the payment hasn't arrived.

By then, the money has typically been moved out of the scammer's account within hours. This is why the 10-step verification process below is not optional paranoia — it's a direct response to a documented threat.

The defences being built around your money

The good news: Singapore has been building a serious defence ecosystem around scams. The bad news: it has limits, and you are expected to play your part.

What the banks are doing

After the OCBC incident, MAS directed banks to implement several safeguards:

• A "kill switch" that lets customers freeze their accounts instantly if they suspect fraud.
• Delays before first transfers to new payees, giving customers and banks time to spot anomalies.
• Default transfer limits for digital-token users, which customers can raise but must consciously opt into.
• Real-time transaction alerts so that every transfer is confirmed to your own device.

These measures have made it harder for scammers to drain an account in one clean sweep. But here's the catch: a phishing attack during a property transaction doesn't drain your account — it convinces you to make a transfer yourself. The bank sees an authorised login, an authorised OTP, and an authorised instruction. The safeguards that protect you from an attacker taking over your account don't protect you from an attacker convincing you to hand over the money.

The Shared Responsibility Framework

In December 2024, a major new policy took effect: the Shared Responsibility Framework (SRF) for phishing scams. Under the SRF, developed by MAS and the Infocomm Media Development Authority (IMDA), banks and telecoms companies must compensate consumers who lose money to phishing scams when the institutions failed to meet their duties.

For banks, these duties include monitoring for tell-tale signs of fraud — such as a first-time transfer to a new payee that is out of character — sending real-time transaction alerts, and acting quickly on fraud notifications. For telcos, the key duty is blocking SMS messages from unregistered sender IDs, preventing scammers from spoofing official names like "OCBC" or "HDB."

The framework is a genuine safety net, but it is not a free pass. If you ignore a bank's fraud alert, or fail to respond to verification requests, you may be held responsible for part of the loss. The system assumes that you, the consumer, are an active participant in your own protection.

Community and police tools

• ScamShield app: Blocks known scam numbers and reports suspicious messages.
• ScamShield Helpline (1799): Operated by the National Crime Prevention Council, staffed by trained anti-scam professionals.
• Anti-Scam Centre (ASC): The police unit that works with banks to freeze accounts and recover funds.
• Protection from Scams Act (2025): A new law empowering the police to issue restriction orders on bank accounts of suspected scam victims, preventing them from making large transfers while they are being investigated.

All of these are useful. None of them protect you as effectively as a simple 15-minute verification habit before every large transfer.

The 10-step verification process to keep your deposit safe

This is the section worth bookmarking. Run through this checklist before you transfer any money — the option fee, the exercise fee, the stamp duty, the balance, or even a rental deposit. It takes about 15 minutes. Scammers hate it.

Step 1: Verify the law firm independently

Don't verify the law firm by Googling the name that appears in the email — that could also be part of the scam. Go directly to the Law Society of Singapore's website and search their directory of law practice entities. Confirm that the firm exists, is in good standing, and that the lawyer's name matches the one on your engagement letter.

Step 2: Use contact details from the directory, not the email

It doesn't matter how beautiful the email signature is. Scammers can replicate logos, signatures, and disclaimers in minutes. Look up the firm's official phone number and email address from the Law Society directory or the firm's official website — and open that website yourself rather than clicking any link provided in an email.

Step 3: Call the lawyer to confirm payment details

Before any significant transfer, call your lawyer using the number you found in Step 2, and verbally confirm the payment instructions. Specifically ask: "Is the bank account in your latest email the correct conveyancing account?" A genuine lawyer will be happy to confirm. A scammer's illusion collapses the moment the real lawyer answers the phone.

Step 4: Check the account name carefully

In Singapore, conveyancing money must be paid into the law firm's conveyancing account, held in the firm's name. When you key in the payee details in your banking app, the account name must match the law firm's name exactly. If you're asked to transfer to a personal account, a different company's account, or an account in someone else's name, stop immediately. This is the single strongest red flag in any property transaction.

Step 5: Inspect the sender's email domain

Typo-squatting is a scammer's favourite trick. Look at the domain behind the sender's name:

• Is it one character off from the real domain? (1awfirm.com vs lawfirm.com)
• Is it a free email service like Gmail or Yahoo instead of the firm's domain?
• Is the "reply-to" address different from the "from" address?

When in doubt, forward the suspicious email to your lawyer's known official address and ask, "Did you send this?"

Step 6: Treat any last-minute bank change as a red flag

Legitimate law firms and property agencies do not change their bank details mid-transaction. If you receive an "updated payment instructions" email — especially late on a Friday or during a deadline — consider it a phishing attempt until proven otherwise. The classic "Friday afternoon fraud" is a documented pattern because scammers know professionals are less reachable over the weekend.

Step 7: Verify the agent and the property

If you're dealing with a property agent, check their registration on the CEA Public Register — it's freely accessible on the CEA's website. Confirm the agent's name, contact number, and that they're attached to the agency they claim to represent. Likewise, verify the property itself: check the transaction history and recent transacted prices using property data platforms, and confirm ownership records with the relevant authorities before paying any deposit.

Step 8: Never PayNow a deposit to a personal account

This rule applies to rentals especially. A genuine landlord or licensed agent has no reason to collect a security deposit via PayNow to a personal mobile number. For sales, option money is paid via legal conveyancing channels, not as a casual transfer to a WhatsApp contact. If someone you've met only online insists on PayNow or a transfer to a personal account, walk away.

Step 9: Turn on your bank's safeguards

Before your property journey begins, take 10 minutes inside your banking app:

• Set a transaction limit that makes sense for your risk tolerance.
• Enable real-time alerts for every transfer.
• Don't save phishing-prone details — like OTP codes written in your notes app.
• Consider using a dedicated account for large property payments, so your normal daily balance is always protected.

And when your bank sends you a fraud alert — even if it's inconvenient — do not dismiss it. The SRF exists, but ignoring an alert is precisely the behaviour that transfers liability back to you.

Step 10: When in doubt, pause

Every successful property scam has one thing in common: the victim felt they couldn't pause. The deadline was tomorrow. The agent was waiting. The seller was threatening to walk. Here's the truth: no legitimate transaction collapses because you spent 15 minutes verifying payment details. A genuine lawyer, agent, or seller will understand. A scammer will pressure you, guilt you, and rush you — because they know exactly what happens if you slow down.

If something feels off, take these actions in order:

1. Stop — do not transfer, click, or reply.
2. Call your lawyer or the official agency directly on a known number.
3. Call the ScamShield Helpline at 1799.
4. Contact your bank immediately if you've already transferred money, so they can attempt to freeze the receiving account.
5. Make a police report at the Anti-Scam Centre.

Food for thought

A little reflection can be the best defence. Ask yourself these questions — ideally before you're in the middle of a transaction, not during it:

1. If your lawyer's "updated payment instructions" arrived at 5pm on a Friday with a Monday deadline, would you transfer or would you verify? Be honest — most people would transfer. That's precisely why this scam works.

2. A listing is 20% below every comparable transaction in the same district. Is it a desperate seller or a trap? How would you find out before parting with a deposit? Property data platforms exist precisely to answer this.

3. How much of your property-buying process is running through WhatsApp? If your WhatsApp account were taken over tomorrow, could a scammer convincingly continue the conversation with your agent, your lawyer, and your bank — and would anyone notice before the money moved?

4. Under the Shared Responsibility Framework, do you know what your bank's fraud alerts look like and how to properly respond to one? If you ignore a legitimate alert and then lose money, the compensation may not be there.

5. When did you last verify a professional's credentials? Whether it's a property agent on the CEA Public Register or a law firm on the Law Society directory, official verification takes two minutes. Would you rather spend two minutes now or chase a six-figure refund later?

The bigger picture

Property scams exploit one fundamental weakness: the gap between what you think you know and what you can actually verify. A fake listing looks like a real listing. A cloned website looks like the developer's official portal. A phishing email looks like your lawyer. The only way to close that gap is to build verification into the process — to check the law firm, check the agent, check the account name, check the price.

In a market where a single wrong click can cost you a deposit, data discipline isn't just an analytical skill. It's a survival skill.