GovTech switched CorpPass SMS one-time passwords to plain text without hyperlinks on Thursday, a small formatting change aimed at a large fraud problem: scammers mimicking government login pages through shortened URLs embedded in fake alerts.
What users will notice
Business owners and corporate administrators who log into government portals will still receive six-digit codes on registered mobile numbers, but messages will state explicitly that GovTech never sends links and that codes expire in minutes. Login screens at IRAS, MOM, and ACRA now display the same warning banner in four languages. Helpdesk call volumes spiked briefly as users accustomed to tapping links hesitated; GovTech posted a pictorial guide on its support site within hours.
Why links matter to scammers
Police advisories documented government-official impersonation scams where victims first clicked SMS links to counterfeit CorpPass pages, entered credentials, and then approved fraudulent GIRO changes. Removing links does not stop voice-call scams, but it eliminates one hop that malware-laden domains exploited. Cyber Security Agency analysts said Singapore follows Hong Kong and Estonia in pushing OTP delivery to non-interactive SMS or app push only.
Integration with ScamShield
IMDA and GovTech are testing whether ScamShield-labelled sender IDs can appear on CorpPass SMS headers, though iOS and Android display rules differ. Banks were briefed to align their own OTP SMS templates, reducing situations where customers learn to trust linked messages from one institution but not another. No change applies to email OTP fallbacks; those channels still require users to type URLs manually into browsers.
Corporate admin workload
Small firms with rotating staff must update internal wiki instructions so new hires do not hunt for links that no longer exist. Corporate secretaries filing annual returns this week should brief directors before board meetings where live logins are demonstrated. MSPs supporting charities welcomed the clarity, having spent 2025 cleaning malware from laptops after phishing SMS campaigns.
Limits of the fix
Plain SMS OTPs can still be intercepted if phones are compromised or if users surrender codes to callers claiming to be helpdesk staff. Multi-factor hardware tokens remain optional for high-risk entities. GovTech said passkey pilots continue for selected agencies later in 2026. For now, the policy shift is narrow but meaningful: one less trained reflex to tap a link that was never legitimate government infrastructure.
Rollout checklist for firms
Accounting firms with hundreds of CorpPass delegates should audit which mobile numbers receive OTPs, because staff who left last quarter may still be registered. Rotating numbers requires in-person verification at selected SingPost counters, a friction point small businesses gripe about but that reduces account takeover risk. GovTech’s FAQ now lists sample SMS text so IT teams can add mail-filter rules that flag messages containing URLs purporting to be CorpPass, even though authentic messages will never include them again after Thursday’s switch.