Fake SIMBA websites used in phishing scams; at least 62 cases since March

SINGAPORE: At least 62 cases of phishing scams involving fake SIMBA websites have been reported since March, with losses amounting to at least S$83,000 (US$64,900), the police said on Wednesday (Oct 21).

In an advisory, the police alerted the public to an increase in scams involving websites impersonating the telecommunications provider that appear in search engine results.

Victims searching for SIMBA top-up services on Google clicked on fake websites that appeared among the top sponsored results.

They were then prompted to enter personal and banking details, including their mobile numbers and banking card information, as well as to provide digital token approval or one-time passwords on the phishing website.

“Victims realised that they had been scammed when they discovered unauthorised card transactions,” the police said.

The police warned that websites appearing at the top of search engine results or as sponsored advertisements can be phishing websites impersonating popular brands.

“To stay safe, check the website address carefully, use a previously saved bookmark or type the known address directly instead of using search engines,” the police advised.

Phishing websites use domain extensions different from SIMBA’s legitimate domain, the police said.

Some examples of websites that impersonated SIMBA’s website include: simba-sg.asia, simba.sg-fastrecharge.shop, simba.sg-topup.icu and simba.sg-recharge.life.

Members of the public are advised to check webpage addresses carefully for any discrepancies and verify the authenticity of any links before clicking on them.

They should also add security features such as two-factor or multifactor authentication for banks and online accounts, the police said.

Individuals should also set transaction limits for internet banking transactions and install a money lock to further secure a portion of their bank savings from scams, the police advised. 

Users should not disclose their personal information, bank or card details and one-time passwords to anyone. 

Those who suspect they have fallen victim to a scam should contact their bank immediately to report and block fraudulent transactions, and lodge a police report.