Every week, Singapore businesses receive thousands of phishing emails. Most look legitimate. Some are frighteningly convincing. And the hard truth is this: if your team is relying on passwords and standard one-time passcodes to keep attackers out, you are already one well-crafted email away from a breach. This is not fearmongering. It is the current threat landscape — and Singapore's own regulators have responded to it with binding requirements. The question for IT managers and business leaders at SMEs is no longer whether to upgrade authentication. It is how quickly you can do it.

What Traditional MFA Gets Wrong

Multi-factor authentication was a genuine step forward. Requiring a second factor — a text message code, an email OTP, an authenticator app notification — made it significantly harder for attackers to use stolen passwords alone.

The problem is that attackers adapted.

Today's phishing attacks do not just steal your password. They steal your session. A technique called adversary-in-the-middle (AiTM) attack intercepts both your password and your OTP simultaneously, the moment you enter them. The attacker does not need to guess anything. They relay your credentials straight through to the real site, log in as you, and you never notice.

Push notification bombing — also known as MFA fatigue — is another well-documented method. Attackers trigger repeated approval requests until a frustrated or distracted employee taps "approve" just to make the notifications stop.

The Cyber Security Agency of Singapore (CSA) has published a dedicated advisory on exactly these attack patterns. Their guidance is clear: traditional MFA can be bypassed, and additional measures are essential.

Traditional MFA is better than nothing. But it is no longer enough.

What Phishing-Resistant MFA Actually Means

Phishing-resistant MFA eliminates these attacks — not by making OTPs harder to steal, but by removing the shared secret entirely.

Instead of a code that travels between your device and a server, phishing-resistant MFA uses public key cryptography. When you authenticate, your device generates a cryptographic signature that is mathematically tied to the specific website or application you are logging into. Even if an attacker intercepts this exchange, what they receive is worthless. It cannot be replayed. It cannot be redirected. It cannot be used on any other site.

CSA's own authentication advisory confirms this directly, noting that FIDO2 and strong MFA offer the most robust protection against account compromise — particularly for organisations where security outweighs convenience concerns.

The two main standards that make phishing-resistant MFA work in practice are:

FIDO2 / WebAuthn — the global open standard for cryptographic authentication, supported natively by all major browsers and operating systems. This is what powers passkeys on iPhones and Windows Hello on laptops.

Certificate-based Authentication (CBA) — uses digital certificates stored on hardware security keys or smart cards, common in government agencies and financial institutions.

Both share the same core property: the private key never leaves your device. There is nothing for a phishing site to capture, because nothing transmittable is ever sent.

Why Singapore Specifically Needs to Move Now

MAS Cyber Hygiene Notice (Effective May 2024)

In May 2024, the Monetary Authority of Singapore issued its Notice on Cyber Hygiene, which is legally binding for all MAS-regulated financial institutions. The Notice explicitly requires MFA on all administrative accounts and any accounts used to access customer information over the internet.

This matters to Singapore SMEs in two ways.

First, if your organisation operates in or adjacent to financial services — fintech, insurance technology, payment processing, accounting software — you are likely in scope or will be expected to meet equivalent standards by the institutions you serve.

Second, MAS regulation consistently sets the bar that other sectors adopt over time. Today's mandatory requirement for finance is tomorrow's expectation for professional services, healthcare, and technology vendors across Singapore.

CSA's Cyber Essentials — The SME Benchmark

For SMEs outside the financial sector, CSA's Cyber Essentials certification provides the practical benchmark. It is specifically designed for organisations with limited IT resources and prioritises baseline cybersecurity measures — including strong authentication — to protect against the most common attacks.

Notably, CSA is currently assessing whether Cyber Essentials Certification will become a prerequisite for organisations handling sensitive data or bidding for government contracts. For SMEs looking to work with larger enterprises or public sector clients, this is a signal worth paying attention to now, not later.

The Singapore Cyber Landscape in 2024

CSA's Singapore Cyber Landscape 2024/2025 report documents the ongoing rise of ransomware and infected infrastructure locally — with phishing remaining the primary initial access vector for attackers targeting Singapore organisations. The report also notes that many infections involved old malware strains, underlining that basic security hygiene gaps are still being actively exploited. attention to now, not later.

What Phishing-Resistant MFA Looks Like in Practice

Deploying phishing-resistant MFA does not require a full IT overhaul. For most SMEs, the path looks like this:

Step 1 — Identify your highest-risk access points. Start with email, VPN, cloud applications, and any system containing customer or financial data. These are where attackers focus, and where your effort delivers the highest return.

Step 2 — Choose your authenticator type. For most SME teams, FIDO2-compatible platform authenticators — built into modern laptops and smartphones — are the fastest path to deployment. For higher-risk roles such as finance or system administrators, hardware security keys offer the strongest protection.

Step 3 — Deploy through your IAM layer. Phishing-resistant MFA works best when integrated into a broader Identity and Access Management platform. This lets you enforce consistent policies across all applications — cloud and on-premises — from a single control point.

Step 4 — Train your team. Technology without awareness does not close the gap. Even a thirty-minute session on how AiTM and MFA fatigue attacks work — and what to do when something looks suspicious — is a material part of your defence.

The Honest Bottom Line

MAS Cyber Hygiene Notice (Effective May 2024)

Singapore SMEs are not too small to be targeted. If anything, attackers specifically focus on businesses in the 50–500 employee range because they handle valuable data but often lack enterprise-grade security controls.

Phishing-resistant MFA is the single highest-impact authentication upgrade available today. The technology is mature, the standards are open, and the cost of implementation is a fraction of the cost of a breach — financial, operational, and reputational.

MAS has set the compliance requirement. CSA has published the guidance. The tools exist and are deployable today.

The question is not whether your organisation needs phishing-resistant MFA. The question is whether you move before an attacker forces your hand.

Kaira Global partners with miniOrange to deliver phishing-resistant MFA and IAM solutions for Singapore SMEs. Get in touch with our team to discuss what the right authentication upgrade looks like for your organisation.