If your bank account gets hacked in Singapore, can you actually get your money back? The answer is: Sometimes, but only if you act fast and understand your rights.
Here’s a clear guide on what counts as getting hacked, what happens next, and what you can realistically do to recover your money.
What counts as getting hacked?
Hacking can occur in several ways, and each affects your chances of recovery differently. In Singapore, the most common forms include:
1. Phishing scams (Fake bank, SingPass or PayNow messages)
Scammers impersonate banks, SingPass or government agencies and send links via SMS, WhatsApp or email. Once you log in through these fake links, they capture your credentials.
Examples include:
- Fake PayNow “failed transfer” requests
- Fake SingPass login alerts
2. Malware, keyloggers and remote access tools
Malicious apps or files allow scammers to access your device, including your bank app, SMS OTPs and passwords. Singapore authorities have warned about malware-enabled scams targeting banking credentials.
3. Fake QR codes and investment scams
Scammers may replace genuine merchant QR codes or send fake investment group links that direct you to scam wallets or fraudulent apps.
When any of these happen, your loss falls into one of two categories:
- Unauthorised transaction caused by a scammer who transferred money without your consent.
- Authorised but manipulated transaction where you entered details or approved transfers after being tricked.
This classification influences whether you can recover your funds.
Read more: How To Spot and Avoid 6 Biggest Financial Scams
What to do immediately after you’re hacked
Time is the most important factor. The quicker you react, the higher your chance of recovery.
Step 1: Freeze your account and contact your bank immediately
Use your bank’s emergency hotline or in-app kill switch to lock your account. This prevents further unauthorised transfers while the bank investigates.
Step 2: Report the incident to the authorities
- File a police report with the Singapore Police Force.
- Submit the scam details through the ScamShield app or hotline.
Step 3: Document every detail of the scam
Screenshot messages, links, amounts and transaction timestamps. Keep records of any communication with the scammer. These details help the bank and police assess whether the transaction was unauthorised.
Step 4: Monitor your accounts and stop further losses
Check for ongoing transactions or new suspicious activity. If funds continue to move out, contact your bank to freeze additional functions or block transfers.
Pro tip: You don’t need to follow these steps in exact order. The right sequence may vary depending on the situation, the bank involved and how quickly you detect the scam. The most important thing is to act fast and secure your accounts as soon as possible.
Can you get your money back?
This depends on how the hack occurred, your behaviour, and which regulations apply.
Bank liability under the E-payments User Protection Guidelines (EUPG)
For unauthorised transactions, Singapore’s EUPG requires banks to investigate.
You are typically not liable if:
- You did not act recklessly.
- You did not share OTPs, banking PINs or login credentials.
- You reported the incident quickly.
If the bank finds you negligent, it may refuse reimbursement.
Shared Responsibility Framework (SRF)
MAS and IMDA introduced the SRF for digital phishing scams. Under the SRF, banks and telcos may be required to compensate victims if they fail to meet duties such as:
- Implementing cooling-off periods.
- Showing clear scam warnings.
- Blocking suspicious links.
- Detecting abnormal device activity.
However, the SRF does not cover:
- Malware scams
- Remote access scams
- Investment scams
- Transactions you authorised while being deceived
Recovery is possible, but not guaranteed
You may recover funds if:
- The bank determines you were not negligent.
- Funds remain in the scammer’s account.
- The bank or police freezes funds in time.
- A goodwill payout is issued (as seen in some past cases).
- If you authorised the transfer yourself, even if tricked, recovery becomes very difficult because funds often move overseas.
What if the hack involves a Fintech app or an e-wallet?
The same principles apply, but with additional considerations:
- Licensed e-wallet providers must comply with MAS requirements.
- The SRF applies to “Protected Accounts” at banks and licensed payment institutions.
- Recovery takes longer if payments move through overseas or crypto channels.
- Your behaviour matters, dismissing in-app warnings can weaken your case.
Government and legal support channels in Singapore
Here are the key agencies and tools available:
- Singapore Police Force (SPF): File scam reports.
- ScamShield App / Helpline (1799): Blocks scam SMS/calls and reports scam links.
- Financial Industry Disputes Resolution Centre (FIDReC): Helps resolve disputes with banks or payment providers.
- MAS & IMDA: Provide regulatory guidelines such as EUPG and SRF.
- Ministry of Home Affairs (MHA): Oversees scam-related law enforcement and anti-scam initiatives.
Tips to improve your chances of money recovery
Once you’ve secured your accounts and reported the incident, the next phase is improving the likelihood of getting your money back. These tips focus on follow-up actions and ongoing steps, not the urgent measures you take right after discovering the hack.
- Act quickly and continue following up: Even after freezing your account, keep in regular contact with your bank to check the investigation status and ask whether the transfer qualifies as “unauthorised”.
- Keep all records organised: Store your screenshots, chat logs, scam links, timestamps and police reports in one folder so you can provide them promptly when investigators ask.
- Update your bank and authorities with new information: If you discover additional details or suspicious activity later, report it immediately to strengthen your case.
- Review the reimbursement policy of your e-wallet or fintech app: Different providers handle scam-related losses differently, especially if overseas or crypto platforms were involved.
- Seek legal advice for large losses: A lawyer can explain options such as civil recovery or assisting in claims with financial institutions.
- Ignore “fund recovery agents”: Anyone offering to recover your funds for a fee is almost always running another scam.
- Stay informed on scam trends: Use ScamShield and official advisories to stay updated so you don’t fall victim again.
Pro tip: These tips help after you’ve completed the urgent steps like freezing your account and reporting the scam. They are meant to improve your chances during the investigation phase, not replace immediate emergency actions.
How to protect yourself in the future
Prevention remains the strongest defence. Adopt these habits:
- Always avoid clicking suspicious links, especially those claiming issues with PayNow, SingPass or your bank, and verify all messages directly through your official banking or government app.
- Make sure you scan only official QR codes when making payments and avoid any QR codes sent through chats or social platforms.
- Keep your devices secure by installing software updates promptly and avoiding apps downloaded from unverified or unknown sources.
- Enable banking alerts, two-factor authentication and other security features so you receive instant notifications of any unusual or large transactions.
- Freeze your account immediately through your bank’s app or hotline if you notice suspicious activity or unauthorised transfers.
- Use fintech and e-wallet apps only from reputable, licensed providers and activate all available security settings such as biometrics or PIN locks.
- Take time to educate elderly family members or less tech-savvy individuals about common scam tactics, as they are often frequent targets.
- Consider keeping only small, daily-use amounts in accounts linked to transfers, while storing larger savings in separate accounts that have fewer external exposure points.
Read more: Tips To Protect Your Personal and Financial Information
Final thoughts
Getting hacked is stressful and frightening, but you are not powerless. The faster you act, the better your chances of stopping losses and recovering your money. Understanding your rights under the EUPG and SRF helps you navigate the process confidently.
Most importantly, stay vigilant. Treat every unexpected financial message, login request or “failed transfer” alert with scepticism. In Singapore’s increasingly digital banking landscape, awareness and caution remain your best protection.
Read more: How To Prevent Credit Card Fraud in Singapore
