Book a demo

Singapore

Singapore scam and impersonation rules, explained.

Singapore makes banks and telcos share the losses from phishing scams that impersonate businesses, and makes platforms follow scam codes. Here's what that means when fakes use your name, and how Unphish finds them, takes them down and keeps the evidence.

Book a demoRequest a takedown
Legislation briefSG

Shared Responsibility Framework and the Online Criminal Harms Act

In forceScam ad rules for Facebook, Instagram and TikTok apply from 31 January 2027
Applies to
Banks, payment firms and telcos (SRF). Social media, messaging and marketplace platforms (OCHA)
Regulators
MAS and IMDA for the SRF, and the police OCHA Office for online platforms
Phishing losses
For phishing that impersonates a business, the bank pays if it missed its duties, then the telco. Otherwise the customer bears the loss
Platforms
Must follow scam codes and act on police directions to remove scam content
Max penalty
Up to S$1m per breach for platforms today, rising to S$10m under a law passed in September 2026

Summary as of October 2026, not legal advice.

What the rules cover

Six ways Singapore's rules reach impersonation.

What each one covers, in plain words, and what Unphish does for it.

Police directions

Police can direct platforms to remove scam content and accounts.

We find fake accounts and pages using your name and report them to the platform.

Scam ad codes

From 31 Jan 2027, Facebook, Instagram and TikTok must verify advertisers and remove scam ads.

We report scam ads using your name and track what happens to each one.

Shared responsibility

Banks and telcos share phishing losses if they miss their duties.

We take down phishing sites posing as you, often before customers reach them.

Telco filters

Telcos block unauthorised Sender ID texts and texts with known scam links.

We find the scam links used against you and get the sites behind them removed.

Account restrictions

A law passed in September 2026 lets police disable accounts, lines and domains used for scams.

We give you case packets you can pass to the police.

Bank evidence

Banks must investigate phishing claims within 21 to 45 business days.

Every case keeps its evidence, timestamps and outcome, ready for a claim.

Based on the Shared Responsibility Framework, the Online Criminal Harms Act and its codes of practice. Summary as of October 2026.

Key dates

Where Singapore’s rules are up to.

  1. 1 Feb 2024Online Criminal Harms Act

    Police can direct platforms to act on scams

    Done
  2. 16 Dec 2024Shared Responsibility Framework

    Banks and telcos share phishing losses

    Done
  3. 17 Aug 2026New scam codes issued

    For social media, messaging and marketplaces

    Done
  4. 9 Sep 2026Scams Countermeasures Bill passed

    Higher fines, power to disable scam accounts

    Done
  5. 31 Jan 2027Scam ad rules apply

    Advertiser checks and scam ad removal

    Next
  6. Date to be setNew law comes into force

    Fines for platforms rise to S$10m

    Coming

Dates from MAS, the Singapore Police Force and Parliament. Later steps may change.

Who it covers

Who Singapore's rules reach.

Banks pay first, telcos second, and platforms answer to the police. Brands being copied don't have a direct duty.

BanksMAS

Must offer cooling-off periods, real-time alerts, a kill switch and fraud checks. They pay first if they miss these duties.

01
TelcosIMDA

Must block unauthorised Sender ID texts and filter known scam links. They pay second if they miss these duties.

02
PlatformsOCHA

Social media, messaging and marketplaces must follow scam codes and act on police directions.

03
BrandsNo direct duty

The SRF covers phishing that impersonates businesses, but finding fakes using your name is still up to you.

+
S$913mlost to scams and cybercrime in 2025
41,974scam and cybercrime cases in 2025
82%of cases saw victims send the money themselves

Source: Singapore Police Force, Annual Scam and Cybercrime Brief 2025.

Check your business

What do Singapore’s rules mean for you?

Singapore splits scam duties between banks, telcos and platforms. Pick the business closest to yours.

What to do now

    A general guide, not legal advice. Check your position with your legal team.

    What’s at stake

    Why getting this right matters.

    Scam lossesS$913m

    Lost to scams and cybercrime in Singapore in 2025, down from S$1.1bn in 2024, according to the police.

    Self-sent82%

    Of cases saw victims transfer the money themselves, after being tricked.

    Max fineS$10m

    Per breach of a scam code for platforms, under the law passed in September 2026.

    What we take down, across all clients

    98%of scam websites99%of phishing sites99%of impersonation accounts92%of fake apps

    Loss figures from the Singapore Police Force; fine level from the Scams (Countermeasures) and Other Matters Bill. Our results cover all Unphish clients, January to June 2026, rounded.

    Who’s accountable

    Who owns impersonation in your business.

    Dealing with fakes spreads across teams. Here’s a typical split, and where Unphish fits.

    TeamMonitorEvidenceTakedownReportLegalCustomers
    Fraud and financial crimeMonitorEvidenceTakedownReportLegalCustomers
    SecurityMonitorEvidenceTakedownReportLegalCustomers
    Legal and complianceMonitorEvidenceTakedownReportLegalCustomers
    Marketing and socialMonitorEvidenceTakedownReportLegalCustomers
    Customer careMonitorEvidenceTakedownReportLegalCustomers
    UnphishMonitorEvidenceTakedownReportLegalCustomers
    LeadsSupportsA typical split. Yours may differ.

    Around the world

    How Singapore compares.

    WhereMain rulesWho it coversImpersonationPenalties
    Australia Main rulesScams Prevention Framework (SPF)Duties from 31 Mar 2027 Who it coversBanks, telcos and digital platforms ImpersonationDraft codes: protect official channels, monitor, request removal PenaltiesUp to $50m, 3x the benefit or 30% of turnover View → United States Main rulesFTC Impersonation RuleIn force since Apr 2024 Who it coversAnyone impersonating a government agency or business ImpersonationImpersonating a business is unlawful. FTC asking about platform ad tools PenaltiesUp to $53,088 per violation, plus refunds to consumers View → United Kingdom Main rulesOnline Safety Act and APP fraud reimbursementScam ad codes in draft Who it coversOnline platforms, search services and payment firms ImpersonationPlatforms must tackle fraud. Draft codes add scam ad takedown PenaltiesUp to £18m or 10% of worldwide revenue View → European Union Main rulesDigital Services Act and Payment Services RegulationPSR not yet applying Who it coversOnline platforms and payment service providers ImpersonationNotice and action on illegal content. PSR adds impersonation fraud refunds PenaltiesUp to 6% of global turnover (DSA) View →
    Singapore Main rulesShared Responsibility FrameworkIn force since Dec 2024 Who it coversBanks and telcos ImpersonationCovers phishing scams impersonating legitimate businesses PenaltiesBanks and telcos that miss their duties cover losses You’re here

    A simplified summary as of October 2026, not legal advice. Rules and dates change, so check the source for your obligations.

    Get ready

    Your Singapore impersonation checklist.

    A starting point for dealing with fakes using your name in Singapore. One list to get set up, and one for every month after that.

    Singapore impersonation checklistBrand impersonation

    Get set up

    • List your official channels: domains, accounts, apps, numbers and sender IDs.
    • Set up monitoring for lookalikes and impersonation.
    • Agree how fakes are reported and removed, and by whom.
    • Know where to report: the police, ScamShield, and each platform’s own tools.
    • Decide what you’ll record and who signs off.

    A starting point, not legal advice.

    Checklist
    Singapore impersonation checklistBrand impersonation

    Every month

    1. Review the new impersonation found.
    2. Check what was taken down and what’s still live.
    3. Keep evidence and timestamps for every case.
    4. Report repeat offenders to platforms and the police.
    5. Update your list of official channels.

    Keep records for as long as your legal team advises.

    Checklist

    Read the source

    MAS and IMDAShared Responsibility Framework Singapore Police ForceScam codes for platforms (August 2026) Singapore Police ForceScam and cybercrime figures 2025 Ministry of Home AffairsFighting scams: plans for 2026

    FAQ

    Singapore scam rules questions, answered.

    What is the Shared Responsibility Framework?

    A framework from MAS and IMDA, in place since 16 December 2024. It sets anti-scam duties for banks and telcos, and decides who pays when someone loses money to a phishing scam: the bank first if it missed its duties, then the telco, and otherwise the customer.

    Which scams does it cover?

    Phishing scams with a Singapore link, where a scammer impersonates a legitimate business through texts, email or messaging apps, and the victim enters their details on a fake site. Scams where people send money themselves, such as investment or job scams, aren't covered.

    What do the new platform codes require?

    From 31 January 2027, Facebook, Instagram and TikTok must verify advertisers, block suspected scam ads and remove reported ones, and only allow financial ads from licensed firms. Messaging apps must also warn users about unknown contacts and stop government spoofing.

    What changed in September 2026?

    Parliament passed the Scams (Countermeasures) and Other Matters Bill on 9 September 2026. Once it starts, police can restrict or disable bank accounts, phone lines, online accounts and domains used for scams, and fines for platforms that break a scam code rise to S$10 million.

    How does Unphish help?

    We monitor for impersonation of your business 24/7, take down the phishing sites, fake accounts and scam ads we find, and keep the evidence, timeline and outcome of every case, ready for a claim, a platform or the police.

    What are the penalties?

    Banks and telcos that miss their duties cover phishing losses, with no cap. Platforms that break a scam code can be fined up to S$1 million today, rising to S$10 million per breach once the new law starts.

    Is this page legal advice?

    No. This page is a general guide to Singapore's scam and impersonation rules and how Unphish can help. Check your obligations with your legal team.

    Solutions for Singapore impersonation

    The tools behind your record.

    01Threat MonitoringFind fakes using your name, 24/7.Learn more →02TakedownGet scam sites, accounts and ads removed.Learn more →03Threat IntelligenceLink campaigns and share what you find.Learn more →04Domain ProtectionCatch lookalike domains early.Learn more →

    Industries most affected

    See all solutions →

    Try it

    True or false?

    Five quick statements about Singapore’s scam rules. Which are true?

    The rules share phishing losses, but someone still has to find the fakes using your name. We can help.

    Talk to us →

    See your impersonation record.

    Book a demo and we'll show you how Unphish finds the fakes using your name, takes them down and keeps the evidence.

    Book a demoRequest a takedown