--- title: "OCBC Phishing Scam: Singapore Bank’s Crisis of $240 Million Additional Capital Requirement | Phish Protection" description: "Here is a close look into the details of the OCBC phishing scam, how it happened, the damage it caused, how OCBC handled it, and the masterminds behind it." image: "https://phishprotection.com/og/blog/ocbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement.png" canonical: "https://phishprotection.com/blog/ocbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement/" --- Quick Answer Here is a close look into the details of the OCBC \[phishing\](/resources/what-is-phishing) scam, how it happened, the damage it caused, how OCBC handled it, and the \*\*masterminds\*\* behind it. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Focbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=OCBC%20Phishing%20Scam%3A%20Singapore%20Bank%E2%80%99s%20Crisis%20of%20%24240%20Million%20Additional%20Capital%20Requirement&url=https%3A%2F%2Fphishprotection.com%2Fblog%2Focbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fphishprotection.com%2Fblog%2Focbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Focbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement%2F&title=OCBC%20Phishing%20Scam%3A%20Singapore%20Bank%E2%80%99s%20Crisis%20of%20%24240%20Million%20Additional%20Capital%20Requirement "Share on Reddit") [ ](mailto:?subject=OCBC%20Phishing%20Scam%3A%20Singapore%20Bank%E2%80%99s%20Crisis%20of%20%24240%20Million%20Additional%20Capital%20Requirement&body=Check out this article: https%3A%2F%2Fphishprotection.com%2Fblog%2Focbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement%2F "Share via Email") ![Phish Protection blog post image](https://media.mailhop.org/phishprotection/images/2023/05/anti-phishing-solutions-7452.jpg) Here is a close look into the details of the OCBC [phishing](/resources/what-is-phishing) scam, how it happened, the damage it caused, how OCBC handled it, and the **masterminds** behind it. Singapore’s central bank[asked](https://www.reuters.com/legal/transactional/singapore-bank-ocbc-hit-by-240-mln-extra-capital-requirement-phishing-scam-2022-05-26/)OCBC (Overseas Chinese Banking Corporation Ltd.) in May 2022 to keep an extra $240 million in the capital following the infamous **OCBC phishing scam** in December 2021\. OCBC, the **second largest lender** in Singapore, reported losses from the OCBC phishing scam and reportedly made goodwill payouts of the total amount to all the 790 phishing scam victims . Here are the details of the OCBC phishing scam and how it happened. ### The Aftermath of OCBC Phishing Scam Singapore’s central bank[asked](https://www.reuters.com/legal/transactional/singapore-bank-ocbc-hit-by-240-mln-extra-capital-requirement-phishing-scam-2022-05-26/)OCBC to keep an extra $240 million with the MAS (Monetary Authority of Singapore) stating, “OCBC is required to apply a multiplier of 1.3 times to its **risk-weighted assets** for operational risk. It translates to an additional amount of approximately **S$330 million** in regulatory capital.” > Helen Wong, the Group’s CEO, said, “The SMS phishing attacks impersonating OCBC in December 2021 was unprecedented in that the tactics reached a **level of realism** not seen in previous phishing scams. While we took various actions in December to stem the scam, we should have responded faster and better to **early signs** of the attacks.” ### OCBC Phishing Scam Targets Victims: What Actually Happened? Singapore police announced on December 30, 2021, about a massive [SMS phishing](https://www.hackread.com/sms-phishing-scam-dupes-zendesk-staff/) campaign where SMS **impersonating the OCBC Bank** were sent to innocent individuals, duping and stealing S$13.7 million from them. The [threat actors](/phishing-awareness/threat-actors-breach-reddit-and-access-internal-documents-code-and-business-systems) sent phishing messages to customers of OCBC. The messages contained information regarding multiple problems the customers were facing in their accounts and lured them via **malicious embedded URLs** to fake portals purportedly to solve the problem. The counterfeit messages were also accompanied by the **bank’s header**, creating a bubble of legitimacy, affecting 790 OCBC users. These [malicious links](https://news.abplive.com/technology/gadgets/beware-hackers-sending-malicious-links-and-exploiting-google-docs-slides-1504827) redirected OCBC customers to a **fake OCBC Bank website** where they followed the login procedure of entering their credentials, followed by PINs and OTPs, all of which were recorded by the threat actor who used these accounts to make transactions. ### When Did the OCBC Phishing Scam Occur? The OCBC phishing scam hit its customers in December 2021 and **went on for a month**. Multiple attacks \[occurred between December 8 and 17 , 2021\]() , where 26 customers lost $103,492\. The attack volume surged a week later when nearly $2 million was lost by 186 customers between December 24 and 26\. Initially, it was reported by the OCBC in a January 30 th update that[$8.5 million](https://www.channelnewsasia.com/singapore/ocbc-phishing-sms-scam-do-not-click-bitly-url-link-2407796)were stolen by the threat actors. However, the **number rose** to[$13.7 million](https://www.reuters.com/legal/transactional/singapore-bank-ocbc-hit-by-240-mln-extra-capital-requirement-phishing-scam-2022-05-26/)afterward. The difference in figures was based on the victims who reported the incident to the authorities and those who did not. Nearly \[80 % of the phishing scam\]() amount was stolen between **December 23 and 30**, with the number of affected OCBC customers rising from[469 to 790](https://www.channelnewsasia.com/singapore/ocbc-phishing-scam-more-losses-victims-reported-2469086). ### What did OCBC Do to Stop the Phishing Scam? December 2021 was devastating for OCBC Bank as it hunted down nearly 45 **phishing websites** and identified [scammers](/resources/phishing-identity-theft) that spoofed the bank’s messages using its name and shortcode. OCBC[released](https://www.ocbc.com/group/media/release/2021/ocbc-sms-phishing-scams.page?)a **public notice** to inform its customers about the phishing scam campaign and worked with the Singapore police’s anti-scam center. ![Anti phishing solutions](https://media.mailhop.org/phishprotection/images/2023/05/anti-phishing-solutions-7452.jpg) On \[January 19\]() , OCBC announced that it would reimburse all affected customers. Calling the initiative the **“full goodwill payout,”** the bank started reimbursing all affected customers whose balances were wiped from their accounts.\_ An independent consultant reviewed the case and concluded that OCBC **did not suffer an attack** on its IT systems. \_ ### The Masterminds Behind the OCBC Phishing Scam Police investigations revealed that[Peh and Tan Shu Kai](https://www.channelnewsasia.com/singapore/ocbc-phishing-scams-money-laundering-leong-jun-xian-court-2635506)received the OCBC phishing scam funds and conducted raids, **arresting 16 people**. Multiple threat actors were identified and were linked to the OCBC phishing scam. These[included](https://www.straitstimes.com/singapore/courts-crime/phishing-scams-involving-ocbc-customers-teen-reoffended-while-on-probation)Brayden Cheng Ming Yan, a 19-year-old, 32-year-old Mark Teo Sin Yan, and 21-year-old Leong Jun Xian. \[Two 20-year-olds\]() , Kong Jia Quan and Muhammad Khairuddin Eskandariah, were also found guilty. The group shared the details of 16 bank accounts to syndicates in **Telegram group chats** between December and February, receiving nearly $600,000 from multiple ruses, including the phishing scams involving OCBC customers. > The court documents by Deputy Public Prosecutors Ronnie Ang and Jason Chua stated, “The accused and co-accused persons had **worked together** as a group to provide money-laundering services to various unknown persons believed to be linked to overseas syndicates by sourcing for and providing control of bank accounts to these **unknown persons**.” ### Final Words With such an **advanced and sophisticated** phishing scam campaign at such a time, the story of OCBC is among the top [online scams](https://cybernews.com/editorial/online-scams-march-madness-basketball/), like phishing scams, shopping scams, crypto phishing scams, and more. Even though OCBC **reimbursed** the customers, all organizations might not do so, which is why individuals need to stay vigilant against the latest threats and implement proper [phishing protection](/) measures. ## Topics [ Phishing ](/tags/phishing/) ![Brad Slavin](https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead across DuoCircle's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Protect your inbox from phishing attacks Real-time email security with 60-day free trial. No credit card required. [Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection) [View Pricing](/pricing/) ## Related Articles [ Foundational 5m 0ktapus, Okta Breach Helps Attackers Launch Sophisticated Supply Chain Attacks Sep 5, 2022 ](/blog/0ktapus-okta-breach-helps-attackers-launch-sophisticated-supply-chain-attacks/)[ Foundational 4m 13 Spear Phishing Attacks Examples To Justify Investment For Phishing Prevention Solutions In Your Organization Aug 1, 2019 ](/blog/13-spear-phishing-attacks-examples-to-justify-investment-for-phishing-prevention-solutions-in-your-organization/)[ Foundational 4m All 14 centers of Kettering Health were affected by a massive ransomware attack, Major outage in the Ohio medical center May 23, 2025 ](/blog/14-centers-of-kettering-health-were-affected-by-massive-ransomware-attack-in-ohio-medical-center/)[ Foundational 4m 2021 Phishing Trends You Need To Be Wary Of Aug 2, 2021 ](/blog/2021-phishing-trends-to-be-wary-of/) ```json {"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"OCBC Phishing Scam: Singapore Bank’s Crisis of $240 Million Additional Capital Requirement","description":"Here is a close look into the details of the OCBC phishing scam, how it happened, the damage it caused, how OCBC handled it, and the masterminds behind it.","url":"https://phishprotection.com/blog/ocbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement/","datePublished":"2023-05-23T07:59:22.000Z","dateModified":"2026-04-17T15:43:10.000Z","dateCreated":"2023-05-23T07:59:22.000Z","author":{"@type":"Person","@id":"https://phishprotection.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://phishprotection.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://phishprotection.com/blog/ocbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement/"},"articleSection":"foundational","keywords":"Phishing","wordCount":894,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/2023/05/anti-phishing-solutions-7452.jpg","caption":"Phish Protection blog post image","width":1200,"height":630},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"OCBC Phishing Scam Targets Victims: What Actually Happened?","acceptedAnswer":{"@type":"Answer","text":"Singapore police announced on December 30, 2021, about a massive [SMS phishing](https://www.hackread.com/sms-phishing-scam-dupes-zendesk-staff/) campaign where SMS **impersonating the OCBC Bank** were sent to innocent individuals, duping and stealing S$13.7 million from them."}},{"@type":"Question","name":"When Did the OCBC Phishing Scam Occur?","acceptedAnswer":{"@type":"Answer","text":"The OCBC phishing scam hit its customers in December 2021 and **went on for a month**. Multiple attacks"}},{"@type":"Question","name":"What did OCBC Do to Stop the Phishing Scam?","acceptedAnswer":{"@type":"Answer","text":"December 2021 was devastating for OCBC Bank as it hunted down nearly 45 **phishing websites** and identified [scammers](/resources/phishing-identity-theft) that"}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://phishprotection.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://phishprotection.com/foundational/"},{"@type":"ListItem","position":4,"name":"OCBC Phishing Scam: Singapore Bank’s Crisis of $240 Million Additional Capital Requirement","item":"https://phishprotection.com/blog/ocbc-phishing-scam-singapore-banks-crisis-of-240-million-additional-capital-requirement/"}]} ```