Singapore police warn of SIMBA phishing sites in sponsored Google results

The Singapore Police Force has warned that phishing sites impersonating the telecommunications provider SIMBA are appearing as sponsored Google search results, resulting in at least S$83,000 in losses across 62 cases since March 2026 ^[1].

The scam highlights the risk of relying on search engine advertisements to find sensitive financial or account services. By paying for top visibility, attackers exploit the common belief that the first results on a search page are legitimate ^[1].

Police Warn of SIMBA-Impersonating Phishing Sites on Google Search

The Singapore Police Force (SPF) issued an advisory detailing a campaign that targets customers searching Google for SIMBA top-up services ^[1]. According to the SPF, at least 62 people have fallen victim to the scam since March 2026, with combined losses reaching at least S$83,000 ^[1].

The attackers use Google's sponsored results—advertisements that the search engine places at the top of search pages—to position fraudulent websites where users are most likely to see them ^[1]. This positioning allows the phishing sites to appear as the official SIMBA portal to users who do not verify the destination URL before clicking ^[1].

The SPF noted that this method specifically exploits a widely held but incorrect assumption: that websites appearing at the top of search results, particularly as sponsored advertisements, are legitimate ^[1]. Scammers pay for these sponsored positions precisely because of the trust users place in top results ^[1].

How the Fraudulent Sites Steal Financial Data

Once users land on the fake websites, the sites prompt them to provide sensitive personal and banking information ^[1]. This includes requests for mobile numbers, card details, and the submission of digital token approvals or one-time passwords (OTPs), which are temporary codes used to verify a user's identity during a transaction ^[1].

The SPF noted that victims typically only discover the fraud after noticing unauthorized transactions on their bank cards ^[1]. To deceive users and mimic the legitimate brand, the scammers use domain extensions that differ from SIMBA's official domain ^[1].

These deceptive URLs employ slight spelling variations, the addition of extra words, or the use of incorrect domain suffixes ^[1]. By altering these technical identifiers, the attackers create a visual facsimile of the official site to trick users into submitting their credentials and payment data ^[1].

SPF Guidance for Avoiding Search-Engine Phishing

To prevent further losses, the SPF advises the public to stop using search engines to find brand websites ^[1]. Instead, the police recommend typing known web addresses directly into the browser or using previously saved bookmarks ^[1].

For those who must use search results, the SPF urges users to check the exact URL carefully before entering any financial or personal data ^[1]. This check is critical given the scammers' use of slight spelling variations and incorrect suffixes to mislead users ^[1].

Additionally, the SPF recommends that the public enable two-factor authentication (2FA) and multi-factor authentication (MFA)—security processes that require users to provide two or more verification factors to gain access to a resource—to provide an extra layer of security against account takeovers ^[1].

What we don't know

• Which specific fake domain names were used in the SIMBA phishing scam?
• Has Google taken any action to remove these specific sponsored ads?
• Whether the attackers used any specific phishing kits to automate the collection of OTPs and token approvals.