![\"Police](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/simba-top-up-scam-fake-google-search-ads-police-example.jpg\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA paid search result borrows SIMBA’s name<\/h3>\n
The SIMBA top-up scam places counterfeit recharge pages in sponsored Google search results. People looking for their mobile provider can land on a criminal’s payment form.<\/p>\n
This is confirmed phishing. Singapore Police reported at least 62 cases and S$83,000 in losses since March 2026 in their SIMBA impersonation warning<\/a>.<\/p>\n Those figures describe reports covered by that warning. They aren’t a price, a subscription charge, or an estimate of what every affected customer loses.<\/p>\n SIMBA is the provider being imitated. The fraudulent search result isn’t evidence that SIMBA operates the fake page or that Google itself was breached.<\/p>\n The fake website asks for information that seems normal during a top-up: a phone number and card details. Further prompts can request OTPs or digital-token approvals.<\/p>\n Police linked this process to unauthorized card transactions. The requested approval deserves as much attention as the page where you first entered your card.<\/p>\n A recharge may be a small purchase. The information and authorizations collected during the fake checkout can expose considerably more than the intended top-up amount.<\/p>\n The police screenshot above shows a fraudulent sponsored result above the genuine top-up result. Its annotations belong to the original police example.<\/p>\n In that example, the suspicious address is simba-sg[.]digital. The legitimate result displays topup.simba.sg, under the provider’s simba.sg domain.<\/p>\n Addresses used by criminals can change. Recognizing this one example helps, but a saved route to the genuine provider offers better protection than memorizing one bad domain.<\/p>\n You don’t need to receive an unexpected text or follow a stranger’s message. The scam can begin with a search you made yourself.<\/p>\n That changes how the link feels. You were already planning to recharge, so a result displaying the right provider’s name seems to answer your request.<\/p>\n The sponsored label means the result is an advertisement. It doesn’t establish that the business whose name appears in the ad controls the destination.<\/p>\n Placement matters, too. A result near the top is easy to tap when you’re busy, especially if you’re trying to restore mobile service quickly.<\/p>\n The police example demonstrates this ordering. It doesn’t mean every SIMBA search shows the same ad or that every sponsored result is fraudulent.<\/p>\n The imitation page follows the activity you expected to complete. A phone number identifies the service being recharged; a card appears to pay for it.<\/p>\n A phone number and card can belong in a genuine recharge. On the imitation page, you’re handing them to someone outside the provider’s payment process.<\/p>\n A logo, familiar color scheme, or provider name inside the page cannot settle that question. The same material can appear on an unrelated website.<\/p>\n Check the address bar before entering anything. Don’t use a reassuring heading inside the page as a substitute for checking where your browser actually is.<\/p>\n If the full address is hidden on a small screen, stop and expand it. A quick payment isn’t worth making the destination impossible to inspect.<\/p>\n Entering your card into the counterfeit form gives sensitive payment information to the people behind that page. A phone number may also help them target follow-up prompts.<\/p>\n The page may continue behaving like a checkout afterward. A loading screen, confirmation message, or another form doesn’t establish that a genuine recharge is being processed.<\/p>\n Don’t keep supplying information because you’ve already started. You can stop halfway through, even if the page says the payment is incomplete.<\/p>\n If you entered the card but closed the page before an approval, tell your bank exactly that. The bank needs your actual exposure, not your guess.<\/p>\n Police say victims were directed to provide OTPs or approve digital-token requests. These steps can move the fraud beyond collecting a card number.<\/p>\n Read the bank’s own message. Check the amount, merchant, and purpose wherever those details are shown, rather than following instructions on the supposed recharge page.<\/p>\n An approval requested during a top-up isn’t automatically an approval for that top-up. Treat a different merchant, unexpected amount, or unexplained authorization as a reason to stop.<\/p>\n Some requests may concern account or payment setup rather than an immediate purchase. If the purpose is unclear, decline it and ask your bank directly.<\/p>\n Never pass an OTP to a caller or chat contact who offers to finish the recharge. That moves the approval outside the trusted payment interface.<\/p>\n A repeated request doesn’t make the previous one harmless. Several codes or approvals can represent several attempts, so report each one you remember completing.<\/p>\n The intended purchase is mobile credit. The reported harm is unauthorized card spending, which may be visible in your bank account instead of your SIMBA account.<\/p>\n A failed recharge can distract you from that difference. Before retrying the payment, check your bank through its genuine app or another trusted route.<\/p>\n Don’t assume your information is safe because the mobile balance stayed unchanged. A counterfeit checkout can collect information without delivering any recharge.<\/p>\n Likewise, a charge you don’t recognize needs prompt attention even if the fake page eventually displayed a success message.<\/p>\n If the page appears broken, trying another card is an understandable response. On a phishing site, it gives the same criminals another payment credential.<\/p>\n Switching browsers or refreshing the counterfeit page doesn’t change who runs it. Leave the session and start again from the provider’s established route.<\/p>\n A message asking you to resolve a failed top-up should receive the same scrutiny. Verify the original transaction before entering any replacement payment details.<\/p>\n This warning concerns the documented search-ad phishing process. It doesn’t establish a filter-refill subscription, a recurring mobile plan, or a specific malware download.<\/p>\n Use the provider’s official SIMBA website<\/a> or an existing trusted app to find its recharge options. Avoid building your payment route from a new advertisement.<\/p>\n The genuine top-up address in the police example is a subdomain of simba.sg. The dot before that domain matters more than a familiar word elsewhere.<\/p>\n For example, adding SIMBA to an unrelated domain’s name doesn’t place that site under the provider’s control. Read the hostname, not just the search-result heading.<\/p>\n The padlock is also limited. It concerns the connection to the website you opened; it doesn’t certify that the website belongs to your phone provider.<\/p>\n A genuine provider page can change its appearance. An unfamiliar design alone isn’t proof of fraud, just as an accurate imitation isn’t proof of legitimacy.<\/p>\n If you can’t confidently identify the destination, contact SIMBA through its official site before paying. You don’t need to complete the transaction while that uncertainty remains.<\/p>\n Once you’ve established the correct route, save it for future use. That removes the need to judge a fresh collection of search ads every time.<\/p>\n Contact your bank immediately.<\/strong> Use its genuine app, the number on your card, or another independently established channel. Say you entered details on a fake SIMBA page.<\/p>\n Ask about blocking or replacing the exposed card and stopping suspicious transactions. Explain whether you supplied card details, an OTP, a token approval, or several of these.<\/p>\n If a payment is pending, report it now. Waiting for it to finish can reduce the time available for the bank to respond.<\/p>\n<\/li>\n Review what you actually approved.<\/strong> Check recent transactions and bank notifications. Note amounts, merchants, timestamps, and any setup or authorization messages associated with the incident.<\/p>\n Tell the bank about repeated approvals or additional cards you tried. Don’t minimize an action because the fake website described it as verification or a retry.<\/p>\n Ask the bank whether any payment credentials or authorizations need revoking. Follow its instructions rather than assuming a password change covers every card-related risk.<\/p>\n<\/li>\n Keep the evidence without reopening the payment process.<\/strong> Save the URL, search-ad screenshot if available, bank messages, transaction references, and the approximate time you visited.<\/p>\n A browser-history entry can help identify the destination. Don’t return to the form to reproduce the scam or submit more information for a better screenshot.<\/p>\n Keep unredacted evidence for your bank and police. Before sharing a warning publicly, hide card numbers, phone numbers, OTPs, account information, and personal identifiers.<\/p>\n<\/li>\n Check whether the genuine recharge happened.<\/strong> Open SIMBA through a trusted route and review your balance or transaction history. Ask its support team about an uncertain recharge.<\/p>\n This separates the legitimate service question from the card-fraud report. A mobile provider and a bank may need to investigate different parts of the incident.<\/p>\n If you still need mobile credit, make the replacement purchase only after establishing the genuine destination and arranging a safe payment method with your bank.<\/p>\n<\/li>\nThe dangerous part comes after the familiar branding<\/h3>\n
What identifies this particular scam<\/h3>\n
\n
How the SIMBA Top-Up Scam Works<\/h2>\n
Step 1: Your search brings the fake page to you<\/h3>\n
Step 2: The website makes a card request seem ordinary<\/h3>\n
Step 3: Your payment details leave the normal top-up process<\/h3>\n
Step 4: An OTP or token prompt raises the stakes<\/h3>\n
Step 5: The loss appears somewhere other than your phone balance<\/h3>\n
Step 6: Another attempt can create more exposure<\/h3>\n
How to Reach the Real SIMBA Top-Up Page<\/h2>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
\n