Singapore Police: fake SIMBA top-up sites like simba-sg.asia appear as sponsored Google results, 62 cases
The Singapore Police Force warned on 21 October 2026 of an uptick in phishing scams impersonating telco SIMBA that appear among top sponsored results when people search Google for SIMBA top-up services. Since March 20…
- First reported
- Reports
- 1
Source: police.gov.sg · published
What happened
The Singapore Police Force warned on 21 October 2026 of an uptick in phishing scams impersonating telco SIMBA that appear among top sponsored results when people search Google for SIMBA top-up services. Since March 2026 at least 62 cases have been reported, with losses of at least $83,000. Victims who clicked the fake sites were asked for personal and banking details such as mobile numbers and card information, and to give digital token approval or one-time passwords, and later found unauthorised card transactions. Police listed example fake addresses: simba-sg.asia, simba.sg-fastrecharge.shop, simba.sg-topup.icu, simba.sg-recharge.life, simba.sg-recharge.cfd and simba.sg-recharge.cyou. The genuine address is topup.simba.sg. Police advise checking web addresses carefully, using saved bookmarks or typing the known address, and calling the ScamShield Helpline at 1799 if in doubt.
How the scam works
Police say the scam relies on search ads: when someone searches for SIMBA top-up services, fake sites appear at or near the top of the results as sponsored listings, above the genuine site. The fake pages copy the look of SIMBA's online recharge page, so a victim who taps the first result may not notice the different address. After entering a mobile number, the victim is asked for card details and then to approve a digital token request or enter a one-time password, which lets the criminals authorise card transactions. Victims only realise what happened when unauthorised charges appear.
The fake addresses use domain extensions different from SIMBA's legitimate domain, such as .asia, .shop, .icu, .life, .cfd and .cyou. Police urge the public to add security features such as two-factor authentication, set transaction limits and use Money Lock to protect part of their savings, and never to disclose card details or OTPs to anyone. SIMBA is impersonated and is not involved.
Source
Singapore Police Force, "Police Advisory On Phishing Websites Impersonating Simba In Search Engine Results" (published 21 October 2026).
Red flags
- A sponsored search result for a top-up or payment page.
- A web address that isn't SIMBA's genuine domain, such as simba-sg.asia or simba.sg-recharge.life.
- A top-up page that asks you to approve a digital token request or enter an OTP.
- A request for full card details on a site you reached through an ad.
If you were targeted
- 1Use a saved bookmark or type the known address (topup.simba.sg) rather than clicking search ads.
- 2Check the web address carefully for misspellings, extra words or wrong domain endings.
- 3Never share card details, digital token approvals or OTPs on a page you haven't verified.
- 4If you entered card details, contact your bank immediately to block the card and report fraudulent transactions.
- 5Lodge a police report, and call the 24/7 ScamShield Helpline at 1799 if unsure.