In December 2021, nearly 790 OCBC customers lost S$13.7 million to one of the most sophisticated phishing campaigns Singapore had ever seen, a wave of spoofed SMS messages so convincing that the fake texts appeared in the same message threads as genuine communications from the bank. The scammers manipulated SMS sender-ID details to push out messages warning customers of problems with their accounts and urging them to click embedded links. Victims were redirected to phishing websites that mimicked OCBC's online banking portal, where they keyed in their usernames, PINs and one-time passwords, handing the criminals everything needed to drain their accounts.
The attacks intensified with frightening speed. OCBC tried to fight back by getting phishing websites taken down and warning customers through its platforms and the media, but the scammers kept finding new mule accounts and the stolen funds were automatically remitted overseas once foreign payees were added. Over the Christmas weekend of December 24 to 26 alone, 186 customers lost US$2.7 million. Chief executive Helen Wong later described the assault as fast and furious and well strategised, noting that the bank had deployed more than 100 staff to combat the scams but had been outmanoeuvred at every turn.
In January 2022, OCBC announced it would make full goodwill payouts to all affected customers, the first time a Singapore bank had fully compensated scam victims. But the Monetary Authority of Singapore was not satisfied with the bank's response. In May 2022, MAS imposed an additional S$330 million capital requirement on OCBC, applying a 1.3-times multiplier to its risk-weighted assets for operational risk, after an independent review found deficiencies in the bank's mitigation of identified risks, pre- and post-transaction controls, incident management and complaints handling, which had delayed containment and customer response.
The scandal became a catalyst for system-wide reform. MAS mandated that banks remove clickable links from emails and text messages to retail customers, implement a 12-hour delay before activating new mobile software tokens, set default funds-transfer notification thresholds at S$100 or lower, and notify customers of changes to contact details. The Infocomm Media Development Authority moved toward an SMS sender-ID registry to make spoofing harder. The OCBC episode remains the benchmark for phishing in Singapore: proof that even financially literate, tech-savvy customers could be fooled, and that the country's defences had to be rebuilt from the ground up.
The political response reflected the scale of the alarm. Then-Finance Minister Lawrence Wong, who was also deputy chairman of MAS, described the incident in a ministerial statement to parliament as the country's most serious phishing scam involving spoofed SMSes impersonating banks, and announced a package of safeguards spanning banks, telecommunications companies, law enforcement and consumer education. The Infocomm Media Development Authority began examining a petition calling for mandatory pre-registration of SMS sender IDs, so that only verified organisations could send messages under their names. For ordinary Singaporeans, the episode was a brutal education in how thread-hijacking worked: many victims had no reason to doubt messages that arrived in the same conversation as years of legitimate bank communications. The OCBC scam permanently changed how the country thought about digital trust, and every subsequent anti-scam campaign has been built on the lessons of that December.