The Message Looked Real. That Was the Point.
A café owner in Singapore received a WhatsApp message about his upcoming hotel booking. It had the right hotel name, the right dates, the right amount. It asked him to verify his card within 12 hours or the reservation would be cancelled.
He clicked. He entered his card details. Within 30 minutes, five transactions had gone through — progressively larger, each one approved before he understood what was happening. He lost nearly S$2,000. Money he had saved from café earnings to relocate his business.
The message wasn't suspicious. That was by design.
This is what modern phishing looks like
We are used to warning employees about obvious scams. Bad grammar. Unfamiliar senders. Urgent requests from unknown numbers.
But two things have shifted, and businesses in Singapore need to understand both.
The first is the SMS blaster. Earlier this month, a man was sentenced to one year and nine months in jail after driving around Singapore with a device in his car that sent more than 10,500 phishing messages to nearby mobile phones. The device mimicked a mobile network to push messages to phones within its range — no suspicious number to block, no sender to trace. The messages directed people to a fake webpage asking for their WhatsApp login details. The goal was WhatsApp account takeover: once scammers have access to your account, they can impersonate you to everyone in your contact list.
The second is WhatsApp phishing using real data. The café owner's case wasn't a lucky guess. Scammers are increasingly combining data from third-party platforms — booking systems, delivery apps, e-commerce accounts — to personalise messages. When a message contains your actual reservation details, your instinct that it must be legitimate is doing the scammer's work for them.
Both methods are designed to defeat the advice we normally give.
Why this is a business problem, not just a personal one
It's easy to frame phishing as something that happens to individuals. And it does. But the same messages are landing in your employees' phones. And your employees are handling things that matter to your business — vendor payments, client records, system credentials, HR data.
Consider what happens when a staff member's WhatsApp account is taken over. Scammers don't just sit on the account. They use it immediately — messaging colleagues, clients and vendors pretending to be your employee, asking for payments or sensitive information. Everyone who receives that message sees a familiar name and profile photo. There is no obvious reason to be suspicious.
A finance executive asked to approve an urgent transfer by someone appearing to be a colleague is a scenario that has caused real losses in Singapore companies. The channel has changed — from email to WhatsApp — but the method is the same.
Under the PDPA, a data breach caused by a phishing incident is still a breach. If personal data belonging to your customers or employees is compromised because someone in your organisation clicked something they shouldn't have, the question isn't just what happened. It's whether your organisation had reasonable measures in place to prevent it.
"Reasonable measures" doesn't mean your staff need to be cybersecurity experts. It means they should know what to look for, know what to do when something feels wrong, and have somewhere to report it without feeling embarrassed.
Right now, most SMEs in Singapore don't have that.
What your business should have in place
You don't need to overhaul everything. You need a few things that actually work in practice.
A clear rule about links in messages. If a message — whether SMS or WhatsApp — contains a link and asks for login credentials, payment details or card verification, the rule is simple: don't use the link. Go to the official site or app directly. This one rule, if staff actually follow it, defeats most SMS and WhatsApp phishing.
A way to report without embarrassment. Most phishing incidents inside companies go unreported because the person who clicked is too embarrassed to say anything. By the time someone notices something is wrong, the window to act has passed. Your team needs to know that reporting quickly matters more than appearing competent.
A named person who handles it. When something happens, who does your staff call? If the answer is "not sure," that's the gap. Someone in your organisation — your DPO, your IT lead, your manager — needs to be the clear first point of contact for anything that looks suspicious.
Basic awareness, not annual checkbox training. A 20-minute annual e-learning module does not change behaviour. A short conversation with real examples — like the SMS blaster case, or the café owner story — does. People remember stories. They don't remember slide decks.
One more thing worth noting
The CSA advises that if you have clicked a suspicious link or entered your details somewhere you're now unsure about, you should change your passwords immediately, alert your bank, and report to the police. The same applies inside an organisation. Act fast, tell your DPO, and document what happened.
The threat is real and it's getting more sophisticated. But the response doesn't have to be complicated.
If your team doesn't know what to do when a message looks wrong, that's something we can help with. Veritos works with organisations to put practical data protection measures in place — including the staff awareness that turns a potential breach into a near-miss.
References: Mothership — Café owner scammed via WhatsApp · CNA — SMS blaster sentencing · CSA — Spot signs of phishing