Scams Targeting Property Buyers: How to Avoid Phishing Attacks from 'HDB' and 'Property Agents'

It’s 9.42pm on a Wednesday. Your phone buzzes with a Telegram message from a channel called “VoucherSG”: “You are eligible for a S$300 government voucher. Verify your account before midnight to avoid forfeiture.” The logo looks official. The URL looks official. Your thumb hovers over the link.

Now imagine a different version of that same message. Instead of vouchers, it says: “Your HDB flat is ready for key collection. Click here to confirm your appointment.” Or: “IRAS has processed your property tax refund. Log in to receive S$1,240.” Or a WhatsApp text from a “property agent”: “The landlord has accepted your offer. Transfer the deposit now to lock in the unit.”

Scams targeting property buyers have exploded in sophistication over the past few years, and the recent Telegram voucher scam wave has revealed just how easily official-sounding messages slip past our guard. In 2024, the Singapore Police Force’s Annual Scams and Cybercrime Brief recorded 52,257 scam cases — a new high — with victims losing at least S$1.1 billion. Phishing consistently ranks among the top scam categories, and property-related lures are among its most lucrative variations.

This article breaks down how these scams work, why property buyers are such attractive targets, and — most importantly — how to spot a fake “HDB” message or a fraudulent “agent” before you hand over a single credential or dollar.

Why Property Buyers Are Prime Targets for Phishing Attacks

Let’s start with the big picture. According to the Singapore Police Force’s annual scam statistics, reported scam cases have climbed steeply in recent years.

The monetary damage tells an even more alarming story. Total losses crossed the billion-dollar mark in 2024.

For context, a resident population of roughly 5.9 million means about one reported scam case for every 113 people in a single year — and that’s only what gets reported. Scams are significantly under-reported.

So why are property buyers specifically in the crosshairs? Several factors make property transactions the perfect hunting ground:

• The sums are enormous. A rental deposit can be S$4,000–S$8,000. An option-to-purchase (OTP) fee can be S$5,000–S$20,000. A property purchase involves hundreds of thousands — sometimes millions — of dollars. One successful scam pays for a thousand failed ones.
• The process is unfamiliar. Most Singaporeans buy property once or twice in their lives. First-time BTO applicants and first-time renters don’t know the official workflow, so they’re easy to confuse with a “special priority scheme” or an “urgent verification step” that doesn’t actually exist.
• The emotions are high. Fear of losing a flat, excitement about a rental deal, or panic about a “forfeited” appointment short-circuits rational thinking.
• The ecosystem is crowded. HDB, IRAS, CPF Board, banks, lawyers, valuers, property agents, landlords, and sellers — that’s a lot of legitimate parties. Scammers only need to impersonate one of them convincingly.
• Property is identity-rich. Transactions pull together your NRIC, Singpass, CPF balances, bank accounts, and credit history. Getting a victim to hand over Singpass credentials unlocks all of those at once.

That last point matters more than most people realise. A compromised Singpass account isn’t just a “phished password” — it’s a master key to government portals, bank applications, and potentially your CPF savings.

The Telegram Voucher Scam and Its Property Twin

You might be wondering what a voucher scam has to do with property. The answer is: everything. The Telegram voucher scam — which authorities flagged repeatedly in recent months — taught scammers how to clone government portals, weaponise urgency, and harvest Singpass credentials at scale. Property phishing uses exactly the same playbook.

How the Original Voucher Scam Worked

The mechanics followed a familiar pattern. Scammers sent messages via Telegram, SMS, or WhatsApp claiming that recipients were eligible for a government voucher — sometimes styled after the CDC Vouchers scheme. The message contained a link to a website that cloned the official government voucher page almost pixel-perfectly. Victims who clicked and entered their Singpass credentials handed their identities directly to the scammers.

Here’s the attack flow in visual form:

Once the scammers had Singpass credentials, they could log into government portals, potentially reset banking credentials, or sell the data to other criminal syndicates. Some victims reported money siphoned from bank accounts within hours.

The Property Variant: Same Kit, Different Mask

The voucher scam’s real legacy isn’t the vouchers — it’s the template. Fraudsters quickly realised that the same infrastructure could impersonate property-related agencies for far larger payouts. Instead of “your voucher is expiring,” the message becomes:

• “Your BTO ballot has been successful. Confirm your selection within 24 hours.”
• “HDB requires an outstanding payment of S$4,500 for your flat upgrade. Settle via this link.”
• “IRAS has identified a property tax overpayment of S$1,240. Click here to refund.”
• “Your landlord accepted the rental offer. Pay the first month and deposit via PayNow to secure the unit.”

The underlying code — fake landing page, credential harvest, urgency trigger — is identical. The only change is the costume.

What makes the property version more dangerous is the higher emotional stakes. A voucher is a nice-to-have. A BTO flat is a life event. When a message threatens to “forfeit” your flat selection or “lose” your rental deposit, even cautious people click first and think later.

Five Common Property Phishing Lures (and What They Really Want)

Let’s look at the specific forms these scams take in Singapore’s property market. These are the lures you’re most likely to encounter — either directly or through friends who forward “warnings” about them.

Lure 1: Fake BTO and HDB Notices

This is the most effective because HDB forms the literal foundation of Singapore’s property dream. Scammers send messages claiming that the recipient has been balloted for a flat, that key collection rescheduling is needed, or that an “outstanding payment” blocks the transaction.

The message always contains a link. The link always leads to a fake HDB portal. The fake portal always asks for Singpass or NRIC and banking details. HDB has repeatedly reminded the public that it does not send payment links or credential requests via SMS, WhatsApp, or Telegram. Official alerts appear in your MyHDBPage inbox when you log into the actual HDB portal.

Lure 2: Rental Deposit Scams

Rental scams hit younger Singaporeans hardest — precisely the audience that’s new to renting and most desperately hunting for a unit. The typical pattern: a listing with gorgeous photos and a below-market price. The “agent” or “landlord” is conveniently overseas. They offer a “video tour.” Then the pressure begins: “There are three other applicants. The landlord will only hold the unit if you transfer the deposit now.”

The deposit is usually S$3,000–S$7,000 for a common room or one-bedder. Once the PayNow transfer lands in a personal account, the “agent” disappears and the listing is deleted.

The red flags are consistent: no in-person viewing, a landlord who “cannot meet,” payments to an individual’s bank account rather than a company or stakeholder account, and a deadline measured in hours.

Lure 3: Impersonated Property Agents

One of the nastier trends is identity theft of real, registered property agents. Scammers scrape an agent’s name, photo, and listing history from public platforms like PropertyGuru, then set up WhatsApp or Telegram accounts using those details. They contact potential buyers or tenants, build rapport, and eventually ask for a “holding fee” or option money to be transferred.

According to the Council for Estate Agencies (CEA), every legitimate property agent in Singapore is registered and searchable on the CEA Public Register. Agents are required to show their CEA registration number. If the person you’re dealing with can’t produce one — or produces one that doesn’t match when you check — you’re almost certainly talking to a scammer.

Worse, recent reports have highlighted the use of voice-cloning and deepfake video to make impersonation more convincing. An agent’s real face and real voice can now be simulated well enough to fool a distracted buyer on a short call. The defence is the same: verify through official channels, not through the person who contacted you.

Lure 4: IRAS Property Tax Phishing

Property tax is one of those things every owner pays but few fully understand — which makes it ideal for phishing. Scammers send emails styled as IRAS correspondence: “You are entitled to a property tax refund of S$1,240. Click here to claim.” Or: “Your property tax payment has failed. Click here to update your payment method.”

The landing page mimics the IRAS portal, complete with logos and tax jargon. But IRAS explicitly states that it will never ask for your credit card or banking details via email links, and official correspondence is delivered through mytax.iras.gov.sg or physical mail. Genuine IRAS refunds are credited directly to bank accounts or paid by cheque — there is no “claim” step that requires you to log in through an emailed link.

Lure 5: Fake Payment Portals

The most technically sophisticated scam involves lookalike payment pages. During a resale purchase, legitimate fees include the option fee, the exercise fee, and stamp duty. Scammers insert themselves into the process by sending an invoice or payment link that impersonates one of these steps.

A common version: a fake “HDB Resale Payment Portal” or “e-Stamping” page that accepts PayNow or card payments. The victim believes they’re paying stamp duty; in reality, the money goes straight to a money mule. Genuine stamp duty is paid through the IRAS e-stamping system, usually managed by your conveyancing lawyer, and option fees are typically paid via cheque or Cashier’s Order to the seller’s solicitor — not a PayNow link.

How to Spot the Phish: A Red-Flag Checklist

Scammers don’t need to be perfect — they just need you to be hurried. The good news is that virtually every phishing attack leaves fingerprints. Train yourself to look for them.

The 10 Red Flags Checklist

1. Urgency is the number-one weapon. Words like “immediate,” “before midnight,” “forfeit,” “penalty,” and “final notice” exist to bypass your reasoning. Legitimate agencies rarely impose a 24-hour deadline on payments — and never via a text message.
2. The domain is wrong. A genuine government website ends in .gov.sg. Official government links use the go.gov.sg shortener. If a link claims to be HDB but the URL reads hdb-info.sg, hdb-gov.sg or anything with hyphens or extra words — stop.
3. The sender is weird. Official government SMS in Singapore now comes from the gov.sg Sender ID. Messages from personal numbers, overseas numbers, or “HDB” as an alphanumeric sender outside the registry deserve suspicion.
4. They ask for your Singpass OTP. No one — not HDB, not IRAS, not the police, not your bank — is allowed to ask for your Singpass OTP. Anyone who does is a scammer, categorically.
5. The payment method smells. PayNow to a personal name, requests for cryptocurrency, gift cards, or “deposits” before any in-person step — all classic money-mule patterns.
6. The grammar is subtly off. Scam messages often have awkward phrasing, inconsistent punctuation, or British-American spelling mixes. Malware and jailbroken ChatGPT prompts produce tell-tale oddities.
7. The offer is too good. A 3-room rental at S$1,200 a month in District 10, a “confirm BTO success” without ballot, or an agent promising above-market resale profits in days — if it sounds too good to be true, it’s a lure.
8. They want you off-platform. Scammers push you from official channels to Telegram or WhatsApp, where messages are less monitored and harder to trace.
9. The contact details vanish. Check if there’s a real office address, a landline, or a searchable CEA registration. If the only way to reach the “agent” is a mobile number with no digital footprint, walk away.
10. Your gut is screaming. If the message makes you feel anxious or rushed, that’s the intended effect. The correct response to manufactured urgency is to stop, not accelerate.

Here’s a simple mental decision tree to run whenever a “property message” lands in your inbox:

The “Call-Back” Rule

The single most effective habit you can build is the call-back rule: never take the contact details from the message you received. If an SMS claims to be from HDB, look up the official HDB hotline on hdb.gov.sg and call that number. If a WhatsApp message claims to be from your agent, call the agent’s number from your saved contacts — not the number in the message.

This one habit neutralises every impersonation scam in existence, because it breaks the control channel. The scammer controls the message; they don’t control the phone book.

A Transaction Safety Checklist for Every Property Stage

Different moments in the property journey come with different vulnerabilities. Here’s a stage-by-stage guide to transacting safely.

BTO Stage

• Expect the process to be slow and bureaucratic. Genuine HDB communication runs through official letters and your MyHDBPage portal. If a message says your balloting is “confirmed” outside these channels, it’s fake.
• No fees outside official channels. HDB charges application fees during the formal application process — not via PayNow links sent to your phone.
• Ignore “priority scheme” offers. No third party can guarantee you a BTO flat. Anyone who claims they can — for a fee — is running a scam.
• Use the official HDB portal directly. Type hdb.gov.sg into your browser. Don’t click search results that appear after typing “HDB login” — ad-scams impersonating HDB have appeared at the top of search results.

Resale Stage

• Verify your agent with CEA. Check the Council for Estate Agencies’ public register to confirm your agent’s registration number and licence status. A legitimate agent will not be offended — they’ll respect your diligence.
• Check the property, not just the listing. Use the official property title search to confirm the owner’s identity and check for encumbrances. Cross-reference the listing photos against the actual unit during a physical viewing.
• Option money goes through formal channels. When you exercise the OTP, the option fee is typically paid by cheque or Cashier’s Order to the seller’s solicitors. Be extremely suspicious of any request to transfer option money via PayNow or into a personal bank account.
• Your lawyer is your safety net. In a resale transaction, your conveyancing lawyer handles the money flow. If anything about the payment process feels unusual, ask your lawyer before paying, not after.

Rental Stage

• View before you pay. Rule of thumb: if you haven’t seen the unit in person — or at least had a live video walkthrough with the actual landlord or agent on camera — you don’t pay a cent.
• Beware the overseas landlord. “I’m in London and can’t meet” is the most common justification in rental scams. Legitimate landlords have property managers or agents in Singapore. There is no valid reason a deposit must be paid to a stranger before you’ve seen the unit.
• Cross-check price sanity. If the rent is 20–30% below comparable listings in the same condo, that discount is the bait. Check Hiva or other data platforms for the actual rental range in the project and district.
• Get a written tenancy agreement. Use the CEA’s prescribed tenancy agreement terms or a lawyer-drafted agreement. A scammer will pressure you to skip the paperwork — a legitimate landlord wants the paperwork.

Payment and Post-Purchase Stage

• Stamp duty is paid via IRAS e-stamping. This is handled through the official IRAS system, usually by your lawyer, and the payment reference goes to IRAS — never to an individual.
• Ignore “refund” emails. IRAS does not email individuals about property tax refunds with a clickable claim link. Refunds are credited automatically or sent by cheque.
• Property tax letters arrive by mail or via mytax.iras.gov.sg. If an email asks you to “verify” your property tax details urgently, call IRAS on their official hotline and ask.

The Universal Safety Net

Every stage benefits from the same set of hygiene practices:

• Install the ScamShield app and enable notifications — it filters known scam messages and lets you report suspicious ones.
• Turn on two-factor authentication for Singpass and your bank accounts. If your Singpass is linked to more accounts than you realise, that second factor is a literal wall between criminals and your money.
• Never share your Singpass OTP — ever. Not with “HDB officers”, not with “banks”, not with anyone.
• Talk to someone you trust. Before making any significant property payment, describe the situation to a friend, family member, or your lawyer. Scammers rely on secrecy and speed; a second opinion defeats both.

Here’s the verification workflow applied to a typical suspicious message:

What to Do If You’ve Already Fallen for It

If you’ve clicked a phishing link, entered your Singpass credentials, or transferred money, time is your only true asset. Act in this order:

1. Call your bank immediately to freeze accounts and attempt a stop-payment or recovery. Most banks in Singapore have a 24/7 hotline for suspicious transactions.
2. Call the ScamShield Helpline at 1799 (if outside Singapore, +65 1800 722 6688) for coordinated assistance.
3. Report the scam to the police via the i-Witness portal or at a neighbourhood police post, and alert the platform where the scammer contacted you (Telegram, WhatsApp, Carousell, etc.).
4. Cancel and reissue your Singpass credentials immediately. You can do this on the Singpass portal or by visiting an appointed Singpass counter.
5. Preserve evidence — screenshots of the message, the URL, the PayNow reference number, and the account name. This information helps banks and police trace the money mule network.

Your bank and the police have recovery teams that act far faster when you contact them within minutes rather than days. Do not feel shame — scams are sophisticated, and reporting helps prevent the next victim.

Food for Thought

Before you close this article, here are a few questions worth sitting with — because awareness fades, but habits stick:

1. When was the last time you actually read a URL before typing your password? Not glanced at it — read it, character by character? The answer for most people is “never,” and that’s the gap scammers exploit.
2. Do you know your own property agent’s CEA registration number? If you couldn’t verify your agent’s identity in under two minutes, you’re exposed to impersonation scams.
3. How would you react to a message saying your BTO flat selection would be forfeited in 24 hours? Would you verify first, or panic and click? Be honest — the way you answer reveals your real vulnerability.
4. Is a below-market rental price worth skipping the physical viewing? For many young renters, the answer is “yes, just this once.” Scammers count on exactly that one time.
5. What would you do if a message from “HDB” asked for your Singpass OTP? If you hesitated even slightly — all of us should rehearse the answer now: refuse, report, verify via the official hotline.

Conclusion: The Best Defense Is Data

The property market is emotional enough without the threat of phishing; the transaction itself carries enough stress, paperwork, and financial weight. What separates scam victims from scam survivors is not intelligence — it’s process. Survivors verify before they click, they confirm before they pay, and they treat every unsolicited message as guilty until proven innocent.

The Singapore property market runs on trust: trust in HDB, trust in licensed agents, trust in the legal system. Scammers are, at their core, arbitrageurs of that trust. They borrow the credibility of institutions and agencies to manufacture a false sense of safety. The only reliable countermeasure is to stop taking trust on loan and start verifying it yourself — through official phone numbers, official portals, and official registries.