How to verify a message from IRAS or the CPF Board

How to verify a message from IRAS or the CPF Board

"IRAS: you have a pending tax refund of S$342.18. Confirm your bank details here." Or the opposite: "Your CPF account has been flagged for suspicious activity. Verify your Singpass details now to avoid a suspension." Government agencies make an excellent disguise for fraud: everyone knows them, nobody wants trouble with them, and their real procedures are unfamiliar enough that a fake message looks plausible.

These campaigns come in waves and repeat the same skeleton as the fake traffic-fine SMS and the fake parcel SMS: a well-known name + money pending (in your favour or against you) + urgency + a link. Learn to check one and you can check them all.

The key rule: deal with government agencies on their official portals, not through links

Remember three things:

1. IRAS and the CPF Board handle your affairs on their own portals. Your tax matters are dealt with on myTax Portal and your CPF account on the CPF website, and YOU log in to both with Singpass. Treat any message that asks for your bank details, passwords or a payment through a link as a scam.
2. A genuine refund does not depend on you "confirming your details" through a link. If you think IRAS owes you money, log in to myTax Portal yourself and check; nobody needs your card number by SMS to pay you.
3. Government SMS should come from the "gov.sg" sender ID. According to the IRAS scam advisory, SMS from the government should come from "gov.sg" (the exceptions are National Service call-ups and emergency services). A "tax" or "CPF" SMS from an ordinary mobile number or from any other sender is a warning sign.

Any message that pushes you to tap a link to collect, pay or "settle" something with a government agency is suspicious by default. Not because these agencies never contact you, but because your affairs with them are handled on their official portals, which you can always reach yourself. The same IRAS advisory also lists what government officials will never do over a phone call: ask you to transfer money, ask for your bank log-in details, ask you to install apps from unofficial app stores, or transfer your call to the Police.

What the fake message looks like

• The refund. The most effective hook around tax filing season: "you have a pending refund", with a specific, believable amount. It takes you to a fake site imitating myTax Portal or Singpass, where you enter your personal and bank details.
• The overdue payment or the frozen account. "Final reminder before legal action", "your CPF account will be suspended". It plays on fear instead of hope, but the destination is the same: your details and your card.
• The appointment or the update. Variants asking you to "confirm your appointment" or "update your particulars" through a link. Less urgent in appearance, equally fake.
• Lookalike domains. Links containing "iras", "mytax", "cpf" or "singpass" plus hyphens and extra words, on domains that are not the official ones. The real sites end in gov.sg (iras.gov.sg, cpf.gov.sg).
• The wrong channel. According to the CPF Board, it calls only from 6227 1188 and never calls via WhatsApp, its SMS always come from "gov.sg", its WhatsApp accounts are verified with a blue tick, and its emails end in @cpf.gov.sg or @e.cpf.gov.sg. Treat anything else that claims to be the CPF Board as fake. And because caller ID can be spoofed, even a call that seems to come from the right number is no reason to give out your details.

How to check whether anything is real

The method is the usual one: close the message and go to the official channel yourself. With government agencies it is even clearer, because the official channels are unique and well known:

1. Do not tap the link. Close it.
2. Go to the official site yourself. Type the address into your browser (www.iras.gov.sg for IRAS and myTax Portal, www.cpf.gov.sg for the CPF Board) or open the official app you have already installed. Do not arrive through the link in the message or a hasty search.
3. Log in with Singpass and check. If there is a refund, a payment due, a case or a notice, it will be there. If nothing shows up, the message was fake.
4. If you are not comfortable with the online portals, call the official helplines (looked up by you on the official website, not in the message; the IRAS hotline is 1800 356 8300) or get help from the agency in person.

If something real exists, you deal with it inside the official portal, never through a link in a message. It is exactly the same habit we recommend for checking a call or SMS from your bank, which you will find among our guides.

What to do if you have already tapped or given details

• You only tapped and closed it: almost certainly nothing happened. Block the sender, delete the message and move on.
• You entered card details: call your bank now, block the card and ask for a new one. If your account may be at risk, use your bank's emergency "kill switch" to freeze it. Watch your statements over the coming weeks.
• You entered your Singpass details: change your Singpass password straight away through the official Singpass website (singpass.gov.sg) or app, and check your IRAS and CPF accounts for anything you do not recognise. If you also use Singpass with your bank, tell your bank too. Never approve a Singpass login you did not start yourself. The CPF Board's account safeguards, such as the CPF Withdrawal Lock, a daily limit on online withdrawals and a 12-hour cooling period for changes to key details, add another layer of protection; review them.
• Make a police report online through SPF e-services, with screenshots of the message and the link. If you are unsure, the ScamShield Helpline (1799) is available 24/7.
• Report the sender's number in the spam numbers directory.

Quick questions

Does IRAS ever really send SMS? Yes, government agencies do send SMS, and according to IRAS they should come from the "gov.sg" sender ID. Even so, the safe way to act on any tax message is to log in to myTax Portal yourself with Singpass, not to use the message itself. When in doubt, treat it as unverified and check on the portal.

And the CPF Board? The same: genuine messages, yes; handling your account through a link in an unexpected message, no. Check on the CPF website after logging in with Singpass, and remember that the CPF Board never calls via WhatsApp.

Are these scams more dangerous during tax filing season? Yes, because the context helps the scammer: everyone is thinking about their taxes, and a "pending refund" fits right in. During tax filing season, be doubly suspicious of any tax message with a link.

Is an email with the official logo more trustworthy than an SMS? No. A logo can be copied in a minute and a sender name can be imitated. Genuine CPF Board emails come from addresses ending in @cpf.gov.sg or @e.cpf.gov.sg, but the safe rule is the same: no links from the message; go to the official site yourself.

If you have received one of these messages, report it in the NoCall spam numbers directory: these campaigns change their disguise with the season, and your report helps the next person recognise the pattern in time.