Key Takeaways
- Singapore’s Cyber Security Agency (CSA) ran a six‑month National Simulated Scams Exercise that delivers government‑impersonation robocalls to volunteers, letting them experience a scam in a safe, controlled setting.
- The pilot includes AI‑enabled voice calls, reflecting the shift from suspicious links to real‑time, interactive social engineering that exploits authority, urgency and fear.
- In 2025 Singapore recorded 37,308 scam cases with losses of S$913.1 million; government impersonation scams more than doubled, pushing losses to S$242.9 million.
- Technical controls (e.g., SIM‑registration rules) cannot fully stop fraud because attackers continuously adapt; human vigilance remains the critical line of defence.
- Businesses can borrow the experiential‑learning principle: safe, repeated simulations of voice, video and messaging attacks build a reflex to pause, verify and use a second channel before acting.
- Effective simulations should go beyond email phishing and cover unexpected IT calls, executive impersonation via WhatsApp, regulator/law‑enforcement demands, and deep‑fake video or audio requests.
- Treating social‑engineering readiness like fire drills—regular, mandatory practice under pressure—helps translate knowledge into action when real threats appear.
Overview of Singapore’s Simulated Scam Exercise
Singapore’s Cyber Security Agency, with backing from the Ministry of Home Affairs, launched a six‑month National Simulated Scams Exercise on March 1 2025. Participation is voluntary, but enrollees do not know exactly when the simulated robocall will arrive. During the exercise they receive a call that mimics a Government Official Impersonation Scam (GOIS), complete with scripts that sound like a real authority figure. The goal is to let people feel the pressure and tactics of a scammer in a risk‑free environment so they can recognise and resist similar tricks outside the test.
Design of the Simulated Calls
The calls are not mere recordings; they are live, interactive robocalls that can adapt to the participant’s responses. CSA’s July update noted that the pilot now incorporates AI‑enabled government impersonation scam calls, which use voice synthesis and natural‑language processing to sound increasingly conversational. This evolution matters because modern scams rely less on obvious malicious links and more on real‑time voice‑based social engineering that can provoke immediate compliance before the victim has a chance to verify the claim.
Why Voice‑Based Social Engineering Is Especially Dangerous
Voice attacks exploit innate human tendencies to trust authority, act quickly under urgency, and avoid embarrassment. Scammers can pressure victims into approving multifactor‑authentication (MFA) requests, transferring funds, or revealing credentials within seconds. Researchers have observed phishing kits tailored for voice scammers that supply attackers with live data—such as recent transaction details—to make the deception more convincing. By experiencing a controlled version of this pressure, participants learn firsthand how quickly trust can be weaponised.
Scam Statistics Highlight the Stakes
According to the Singapore Police’s 2025 scam and cybercrime report, the nation logged 37,308 scam incidents last year, with victims losing approximately S$913.1 million. While both figures declined from 2024, the absolute loss remains staggering. More troubling, government impersonation scams moved in the opposite direction: GOIS cases more than doubled from 1,504 in 2024 to 3,363 in 2025, and associated losses rose from S$151.3 million to S$242.9 million. The upward trend underscores that even as overall scam volume eases, certain high‑impact vectors are growing sharper and more costly.
The Persistent Appeal of Government Impersonation
GOIS succeeds because it exploits a fundamental human bias: trust in institutions that appear legitimate. Scammers pose as banks, police, regulators, or other authoritative bodies, fabricating urgency—e.g., “your account will be frozen unless you act now”—to bypass rational verification. No software patch can fully erase this psychological vulnerability; attackers simply adjust their tactics when technical controls improve, as seen with SIM‑registration requirements that have not eliminated telecom‑enabled fraud.
Limitations of Purely Technical Defences
Technical safeguards—spam filters, MFA, endpoint protection—remain essential but insufficient on their own. As highlighted in TechRepublic’s analysis of Singapore’s S$913 million scam problem, even longstanding identity controls have been circumvented by attackers who adapt rather than concede. The human element, therefore, must be strengthened through training that mirrors the realism of actual threats, not just theoretical awareness.
Translating the Exercise to Corporate Settings
Organisations need not start prank‑calling staff, but Singapore’s approach offers a clear lesson: people retain safety behaviours better when they have safely experienced an attack than when they merely hear about it. Traditional phishing simulations already apply this idea to email, yet today’s threat surface extends far beyond the inbox. Employees may encounter a WhatsApp message from a “CEO,” a phone call from fake IT support, a video call with a deep‑faked executive, or a request to shift conversation to an unapproved channel.
Scenarios Worth Simulating in the Workplace
Security teams should consider drills that include:
- Unexpected calls from purported IT staff requesting credentials or MFA approval.
- Urgent messages from executives demanding immediate payment or sensitive data via WhatsApp or other messaging apps.
- Requests to move a discussion from an approved corporate channel to a personal messaging service.
- Communications self‑identified as from regulators or law‑enforcement insisting on instant action.
- Voice or video impersonations designed to override normal verification processes (e.g., a deep‑fake video call asking for a wire transfer).
The objective is not to embarrass employees who slip up, but to instil a reflex: pause, verify the request through an independent, trusted channel, and only then act.
Building a Fire‑Drill Mindset for Social Engineering
Just as organisations conduct regular fire drills, evacuation practices, and incident‑response rehearsals to ensure procedures are executed under pressure, social‑engineering readiness benefits from the same treatment. Knowing that a phishing email looks suspicious does not guarantee an employee will hesitate when a convincing voice call arrives in the middle of a busy day. Repeated, mandatory simulations—preferably unannounced to mimic real‑world unpredictability—help translate knowledge into instinctive behaviour.
Conclusion: Experiential Learning as a Defence Against AI‑Enabled Fraud
Singapore’s experiment shows that exposing people to a realistic, safe version of a scam can markedly improve their ability to detect and deflect the real thing. For businesses grappling with AI‑assisted impersonation, deepfakes, and increasingly personalised fraud, the takeaway is clear: security awareness must evolve from passive annual modules to active, repetitive practice that mirrors the exact channels and pressures attackers now use. By treating social‑engineering readiness like any other critical safety drill—conducted often, taken seriously, and evaluated for improvement—organisations can cultivate a workforce that instinctively stops, verifies, and says no before a scam has a chance to succeed.