Singapore tightens scam rules for social media, messaging and eCommerce platforms

Singapore is tightening safeguards against scams across social media, messaging and eCommerce platforms, with new rules requiring services including Facebook, Instagram, TikTok, WhatsApp and Telegram to strengthen protections for users in the country.

The Singapore Police Force (SPF) issued three Codes of Practice (COPs) under the Online Criminal Harms Act (OCHA) this week, comprising a new code for online messaging and conferencing services, a new social media code and an enhanced e-commerce code.

The measures will require designated platforms to proactively disrupt scams and malicious cyber activity, including by strengthening advertiser verification, preventing suspected scam advertisements and introducing greater protections against unsolicited messages and calls.

Don't miss: Singapore orders Meta to curb Facebook scams or face S$1m fines   

According to SPF, scam cases reported on designated online services fell by about 37% between 2024 and 2025 following the introduction of its first COPs in June 2024. While it acknowledged that scam trends are influenced by multiple factors, the police said upstream safeguards have played a role in making it harder for scammers to target users in Singapore.

The tougher rules come as scammers increasingly turn to messaging applications, online advertisements and video conferencing. A recent Ministry of Digital Development and Information survey found that 84% of Singapore residents had encountered harmful content online, with content supporting illegal activities such as scams the most commonly encountered type.

Messaging platforms face new safeguards

Under the new Messaging Code, WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Messages and Google Meet have been designated as services posing the highest scam risk to users in Singapore.

Online messaging platforms such as WhatsApp and Telegram accounted for about 23% of total scam cases in 2025, according to SPF, with investment scams among the key areas of concern.

The code will require platforms to introduce measures that make it harder for unknown contacts to reach users or alert users to potential risks. These include requiring consent before an unknown contact can add a user to a group or channel, and displaying contextual warnings or risk indicators for messages and calls from unknown or suspicious accounts.

Platforms may also be required to show information such as an account's creation date and country of origin, as well as give users options to silence, filter or block messages and calls from numbers or accounts outside their contact lists.

The rules will also target Government Officials Impersonation Scams (GOIS). About 18% of GOIS cases in 2025 took place on WhatsApp, while SPF has observed other services, including Google Meet, being used in phishing scams involving the impersonation of police officers.

As a result, designated messaging and conferencing platforms will have to introduce safeguards against the spoofing of the Singapore Government through profile names or images by 30 September 2026. Other requirements under the Messaging Code must be implemented by 31 January 2027.

Social platforms put on notice over scam ads

Meanwhile, Facebook, Instagram and TikTok will fall under the new Social Media Code after social platforms accounted for about 30% of total scam cases in 2025. Facebook alone accounted for about 18% of total cases.

A key focus of the code is advertising. Platforms will be required to prevent advertisements accessible to Singapore users from being published where there is reason to suspect they are being used to further a scam.

This includes assessing whether advertisers are using techniques such as URL cloaking to conceal destination websites or whether an advertisement contains other suspicious content. Platforms will also be required to promptly remove suspected scam advertisements, including those flagged by users.

Advertisers targeting Singapore users will have to undergo identity checks against government-issued records before being permitted to publish ads. Platforms must also prevent advertisements for financial services or products from reaching Singapore users unless the advertiser is appropriately licensed by the Monetary Authority of Singapore or another relevant authority.

Facebook, Instagram and TikTok will have until 31 January 2027 to put the required systems and processes in place.

SPF is also strengthening its eCommerce code, which continues to cover Carousell, Facebook Marketplace and Facebook Business Pages. The platforms will face stronger consent requirements for logins from new or unrecognised devices, alongside advertising safeguards introduced under the Social Media Code.

The enhanced eCommerce requirements must similarly be implemented by 31 January 2027. The existing Online Communication Services Code will be rescinded when the new codes take effect, with relevant requirements incorporated into the new frameworks.

Platforms that fail to comply with applicable requirements can currently be issued a Rectification Notice. Failure to comply without reasonable excuse carries a maximum fine of SG$1 million, with continuing offences attracting further fines of up to SG$100,000 for each day after conviction.

The Ministry of Home Affairs has proposed amendments to strengthen the penalty framework, which were tabled in Parliament in August. Under the proposed changes, the OCHA Office could impose a financial penalty of up to SG$10 million for each instance of non-compliance with a COP or Implementation Directive.

Platforms could alternatively be directed to rectify breaches through a Rectification Notice or Compliance Order. Failure to comply without reasonable excuse could carry a fine of up to SG$10 million, alongside further fines of up to S$300,000 for each day a continuing offence persists after conviction.

The tougher safeguards come as technology platforms have also been stepping up efforts to disrupt scam networks across the region. In June, Meta, Microsoft and Coinbase led a coordinated takedown of scam infrastructure across Southeast Asia, targeting fraud operations across different parts of the attack chain. Meta disabled more than 1.4 million accounts, pages and groups across Facebook and Instagram linked to scam networks, while Microsoft suspended around 20,000 fraudulent accounts.

Coinbase also froze more than US$3 million in cryptocurrency assets linked to criminal networks as part of the operation. Meta said at the time that it had worked alongside other industry players on the coordinated effort.

Related articles: 
Meta and YouTube lose key battle in social media addiction trial  
Meta launches paid subscriptions across Facebook, Instagram and WhatsApp   
TikTok cuts trust and safety jobs in latest global restructuring