Singpass is Singapore’s national digital identity. Myinfo is the related service that helps pre-fill selected personal details in online forms with your consent. These terms are connected but they do not mean the same thing. Singpass answers, “How can this service know it is really me?” Myinfo answers, “Which verified information may this particular service use to complete my request?”
If you searched for Singpass login, Myinfo, Digital IC, Singpass QR code, Singpass app, passkey, Face Verification or Singpass scam, you need to know not only the names but what each action does. An identity check, an approval prompt, a data-sharing consent screen and a digital signature can all appear on a phone. They have different consequences, and confusing them can make an otherwise convenient transaction unsafe.
Quick summary: Open the official service yourself; check the requested action before approving; never disclose Singpass passwords or one-time codes; treat Myinfo as selective consent-based data sharing; use Digital IC where accepted; and use the official Singpass help channels for recovery or accessibility support. This guide explains the words first, then how to make good decisions with them.
Singpass vs Myinfo: the simplest explanation
| Question | Singpass | Myinfo |
|---|---|---|
| What is it? | Digital identity and authentication ecosystem | Personal information prefill service |
| Main job | Confirm the person accessing a service | Supply specified personal details with consent |
| Common screen | Login or approval request | Consent and data-prefill request |
| What to check | Is this my intended login or action? | Which details am I sharing, with whom, and why? |
| Risk if misunderstood | Accidentally authorising an unwanted access | Consenting to more data than intended |
A person may use Singpass to enter a service without that service requesting every detail from Myinfo. A service that asks to retrieve Myinfo data presents a further decision about consent. This difference matters: identity is not the same as unrestricted permission. A secure login can be technically genuine, yet the person may still need to decline an unnecessary data request.
42 Singpass, Myinfo and digital identity vocabulary words
Read the middle column to learn the definition; read the final column to see why this word changes the next action. These are general explanations and do not replace official account-specific instructions.
| Term | Meaning in plain English | How to apply it |
|---|---|---|
| Singpass | Singapore Personal Access | The national digital identity used to access participating online services securely. |
| Digital identity | An electronic way to prove who you are | A verified identity is different from an email address or social-media profile. |
| Singpass app | Mobile application supporting Singpass functions | Supports login approvals, Digital IC, notifications and other features. |
| Login | Starting a secure session | Confirm the service and the request before approving. |
| Authentication | Proving you are the account holder | A password, passkey or biometric check is a way of authenticating. |
| Authorisation | Permission to do a particular action | Being logged in does not mean every data use or transaction is automatically authorised. |
| Myinfo | Consent-based personal data prefill | Lets a participating service use relevant government-sourced data with your consent. |
| Consent | Informed permission for a specified data use | Read which organisation requests which information and for what purpose. |
| Data prefill | Automatically filling form fields with saved data | Reduces typing errors but you should still review the form. |
| Digital IC | Identity credentials displayed in Singpass | May be accepted at participating counters and kiosks; a physical card is sometimes required. |
| NRIC | National Registration Identity Card | Sensitive identifier; share only when legitimate and necessary. |
| FIN | Foreign Identification Number | An identifier for eligible foreigners; not identical to NRIC. |
| QR login | Using a scannable code to start a login | Scan only a login code at a service you intentionally opened. |
| Passkey | A device-backed authentication method | Supports safer sign-in without needing to type a traditional password. |
| Biometric | Identity check using a bodily characteristic | A fingerprint or face check can help protect account access. |
| Face Verification | A Singpass identity-verification method | May be required for higher-risk access or security-sensitive actions. |
| 2FA | Two-factor authentication | Uses an additional security step beyond a single credential. |
| One-time password (OTP) | A short-lived verification code | Never give an OTP to a caller who asks for it. |
| App notification | Message displayed inside or by the app | An unexpected approval prompt is a warning, not something to accept automatically. |
| Session | A period of authenticated use | Logging out and avoiding shared devices reduces unintended access. |
| Digital signature | A way to sign certain documents electronically | Not interchangeable with merely typing your name in any field. |
| Singpass Sign | A function for eligible electronic signatures | Check the actual document and request before applying a signature. |
| Singpass Verify | Service for checking identity details | Used in eligible face-to-face identity-checking workflows. |
| Singpass transaction history | A record of selected account activity | Useful when reviewing suspected unauthorised use. |
| Third-party service | Organisation using Singpass login | A participating service is not necessarily itself a government agency. |
| Government service | Official public-sector transaction | Examples include accessing records or submitting a form to an agency. |
| Business service | Private provider integrated with identity functions | Even if login uses Singpass, read the provider’s purpose and privacy notice. |
| Data sharing | Disclosure of specified information | Permission to prefill one form is not general permission to share everything. |
| Data minimisation | Sharing only what is needed | Ask whether an organisation needs the data it requests. |
| Personal data | Information about an identifiable person | Addresses and identity numbers deserve careful handling. |
| Privacy notice | Explanation of how information is handled | Review purpose, recipients and retention where provided. |
| Phishing | Tricking people into revealing secrets | Fake login sites may copy official fonts and logos. |
| Smishing | Phishing by SMS | An SMS link labelled ‘Singpass’ can still be malicious. |
| Impersonation | Pretending to represent a trusted body | An urgent call claiming to be an officer is not proof of authority. |
| Domain name | The website address’s registered name | Check singpass.gov.sg for Singpass and the intended official service address. |
| Account takeover | Someone else gaining account control | It can happen if credentials or approvals are compromised. |
| Device security | Protecting the phone or computer you use | Use device locks, keep software updated and remove unknown access. |
| Accessibility | Ability to use a service despite disability or barriers | An assisted route matters for people who cannot use a smartphone independently. |
| Service counter | In-person help or transaction point | Sometimes an appropriate alternative to a digital channel. |
| Helpdesk | Official support channel | Use the contact information on the official Singpass website, not a caller-supplied number. |
| Password reset | Restoring access after losing a credential | Follow the official recovery process rather than a link from a stranger. |
| Account recovery | Regaining access to your identity service | May require stronger identity verification to protect the account. |
What happens when you use Singpass?
Stage 1: You choose the real destination
A legitimate transaction starts when you know why you are visiting a service: perhaps to review CPF information, access a health service, or complete a government application. The destination should be one you intentionally opened or verified. Recognising the domain name means looking beyond the logo at the actual address. A social-media advert or urgent text message is a poor substitute for a bookmarked official site.
Stage 2: The service asks for authentication
Authentication proves that the person starting the session has the required credentials or identity verification. This may involve the Singpass app, a passkey, biometric confirmation or another supported method. These are different technical paths to verifying identity, not five unrelated ‘accounts’. Singpass’s official website now promotes passkeys as a safer, faster login method. An unexpected login approval notification should not be approved merely because it appears in the genuine app.
Stage 3: You review the requested action
The critical question is not simply whether the button says ‘Approve’. Ask what the approval actually does. Does it sign you in, consent to sharing personal data, verify a high-risk transaction or apply an electronic signature? The visible screen and the transaction you intended to start should agree. A mismatch is a reason to stop and check with the relevant authority.
Stage 4: You check the result
After completing the transaction, check the confirmation issued by the original service. Keep a reference number when appropriate, review account notifications and log out of shared devices. When a request relates to sensitive records, unnecessary screenshots and public sharing can create additional privacy exposure.
What does Myinfo consent actually mean?
Myinfo can reduce repetitive form filling by retrieving selected personal information from participating sources, including government data. But a data field being prefilled is not evidence that you have read all the surrounding terms. For example, if a bank onboarding form asks to retrieve identity and address information, the correct step is to review the requesting organisation, the data items and the stated purpose. If the information is irrelevant, ask why it is needed instead of agreeing reflexively.
A useful mental model is a gate between two systems. On one side are records held by participating data sources; on the other is the service you are trying to use. Consent is a specific permission for the transfer or access shown. It is not a promise that every possible organisation should get every record forever. Re-reading a consent screen is one of the easiest ways to turn a vague word, ‘privacy’, into a practical decision.
Digital IC: what you can show, and what you should not
The Singpass app’s Digital IC can help verify identity for a range of participating services. On the app, the full identifier is masked by default and requires further verification to display. Singpass says there remain some situations in which a physical identity card or long-term pass is specifically required. Therefore, ‘Digital IC is an alternative’ is more accurate than ‘Digital IC replaces the physical card in every situation’.
If a receptionist needs a legitimate identity check, showing the relevant live Digital IC function may be appropriate. Sending a screenshot of your identity number to a stranger on a messaging app is a different act: it creates a transferable copy of sensitive information outside the original verification context. That is why the terms display, verify, copy and share should not be used interchangeably.
Common security terms and the mistake they prevent
| Term or phrase | What the person might assume | What it really tells you |
|---|---|---|
| Official-looking website | It must be the real site | Appearance can be copied; check the domain and navigation |
| QR code | Any QR carrying a familiar logo is safe | A QR can route to any destination; scan only when you intended that service |
| Login approval | An approval is harmless if the app is genuine | Approving an unexpected request can authorise someone else’s action |
| Face Verification | Someone else can ask me to perform it over a video call | Use only the genuine authorised workflow and never follow a stranger’s instructions |
| OTP | It is just a number, so sharing it is safe | An OTP can be part of gaining account access |
| Myinfo | It means the service already knows everything about me | It requests specified consent-based information in an eligible transaction |
| Helpdesk | The caller claims to work for Singpass | Use contact details independently obtained from the official website |
A fictional example: the message that creates urgency
Suppose a text claims that your Singpass account will be suspended within 30 minutes unless you scan a QR code. It shows a convincing logo and calls itself ‘urgent security verification’. The right vocabulary questions are: Who is the sender? What domain will this open? Why would I be required to approve an unexpected login or reveal a secret? Singpass’s official security advice says it does not send website links or QR codes through SMS or WhatsApp. Do not follow the text. Independently open Singpass’s official site or app to check and seek help if necessary.
A fictional example: the helpful prefilled form
A person intentionally opens a service they know and chooses its Singpass login option. Once authenticated, the service displays a Myinfo consent request for selected fields. They review the fields, agree only if they understand the purpose, then check the prefilled form for accuracy. The same person can protect their identity while benefiting from not typing their address repeatedly. A useful vocabulary system does not teach people to fear every digital action; it teaches them to distinguish a legitimate action from an unexpected one.
How to use Singpass without losing control
- Know the destination. Open an official site yourself and inspect the URL before using the login button.
- Understand the action. A login, Myinfo consent, digital signature and Face Verification are not equivalent.
- Verify unexpected prompts. If you did not initiate the transaction, reject the request and check your account by the official route.
- Keep secrets private. Never tell anyone a Singpass password, passcode or one-time verification code.
- Protect the phone. Lock the device and keep only your own authorised biometric access configured.
- Review after the event. Look for confirmation and relevant account activity; get support if something appears wrong.
- Use an inclusive route. People who cannot use the app independently should find official assisted options rather than handing control to a stranger.
Frequently searched Singpass and Myinfo questions
What is the difference between Singpass and Myinfo?
Singpass is the digital identity used to authenticate a person. Myinfo helps consenting users prefill selected personal data in participating services. A Myinfo consent request has a different purpose from merely logging in.
Can I use Singpass without the app?
Singpass offers supported authentication and recovery routes beyond a single phone workflow. Which alternative is available depends on your circumstances and the service. Refer to Singpass’s current official instructions rather than a generic workaround.
Is Digital IC accepted everywhere in Singapore?
No. Singpass explains that Digital IC can be used for many identity checks, but a physical card remains required in some circumstances. Ask the counter or service what it accepts.
What is a Singpass passkey?
A passkey is a device-based authentication credential intended to support safer logins. The official Singpass site describes its current passkey setup process within the app.
What should I do if I receive an unexpected Singpass approval request?
Do not approve it. Independently check the official Singpass app and site, review relevant activity and use official help or security reporting guidance if you suspect someone is trying to access your account.
Do I have to share my bank password to use Myinfo?
No. Myinfo data sharing and a bank’s own credentials are different things. Do not provide banking passwords to an unsolicited caller or webpage asking to ‘confirm Myinfo’.
What is Singpass Face Verification?
It is a stronger identity-verification method that may be required for security-sensitive or higher-risk transactions. The official Singpass guidance explains why it forms part of the security framework.
Where can I get official Singpass help?
Use the official website, its contact page or the Singpass help centre. Do not use a telephone number supplied only in a suspicious message.
Four practical learning exercises
| Exercise | Do this | Result |
|---|---|---|
| 1. Sort | Put login, Myinfo and Digital IC into identity / data / display roles | You can tell which service does what |
| 2. Read | Review a fictional prefill consent page | You can name the requester, the information and purpose |
| 3. Detect | Examine a fictional urgent SMS that asks for a code | You identify the unverified domain and unsolicited request |
| 4. Transfer | Explain the same risks to a relative using everyday language | The relative knows which button not to press and where to seek help |
Continue learning in the eduKateSG network
- Singapore Vocabulary | Digital Government and Inclusive Online Access — using services across language and accessibility barriers.
- Singapore Vocabulary | CDC Vouchers and Government Support — an example of Singpass-based claiming.
- Master Vocabulary — move from a word to context, judgment and action.
- Vocabulary Articles & Knowledge — more topic-based vocabulary chapters.
Official sources and safety checks
- Singpass official website — digital identity, passkeys and security notices.
- Singpass security — protecting login credentials and spotting scams.
- Singpass: What is Myinfo? — consent-based form prefill.
- Singpass: How to access the Digital IC — using the in-app feature.
- Singpass: Face Verification — why stronger checks exist.
Reviewed 3 November 2026. This guide is explanatory, not a substitute for the official Singpass security and eligibility instructions. Service features, consent screens and supported methods may change. A real request must always be evaluated on the actual service screen.