SINGAPORE: The Singapore Police Force has issued three new or enhanced Codes of Practice under the Online Criminal Harms Act (OCHA) targeting the platforms most commonly exploited by scammers, with WhatsApp, Telegram, Facebook, Instagram, TikTok, and four other services now required to implement specific anti-scam measures by January 2027.
The Codes of Practice (COP), which include a new Messaging Code, a new Social Media Code, and an enhanced E-Commerce Code, build on two COPs issued in June 2024. The previous COPs have already contributed to a 37% reduction in scam cases reported on designated online services between 2024 and 2025.
Messaging Code
Online messaging platforms accounted for approximately 23% of total scam cases in 2025, with investment scams conducted via unknown contacts a primary concern. The Messaging Code will apply to seven designated services: WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Message, and Google Meet.
Key requirements include obtaining user consent before unknown contacts can add them to group chats or channels, displaying contextual warnings and risk indicators, such as account creation date and country of origin, when receiving messages from unknown accounts, and providing users with options to silence, filter, or block messages from numbers not in their contact list.
The Code also addresses Government Officials Impersonation Scams (GOIS), with approximately 18% of GOIS cases in 2025 taking place on WhatsApp and Google Meet observed being used for police impersonation phishing. Platforms must prevent spoofing of the Singapore Government through profile names or pictures. This requirement must be implemented by September 30, 2026, given its urgency, while other Messaging Code requirements must be met by January 31, 2027.
Social Media Code
Social media platforms accounted for approximately 30% of total scam cases in 2025, with Facebook alone responsible for about 18%. The Social Media Code applies to Facebook, Instagram, and TikTok.
A key focus is targeting scam advertising. Platforms will be required to prevent the publication of advertisements that are suspected to be in furtherance of scams, including those using URL cloaking. This may help promptly remove suspected scam advertisements reported by users.
Advertisers targeting Singapore users must have their identities verified against government-issued records before being permitted to publish. Financial services advertisements will only be allowed if the advertiser is licensed by the Monetary Authority of Singapore (MAS) or another applicable Singapore authority.
E-Commerce Code
Carousell, Facebook Marketplace, and Facebook Business Pages remain the designated e-commerce platforms. The enhanced Code introduces stronger consent measures for logins from new or unrecognised devices and adopts the social media advertising safeguards to protect users from scam actors exploiting online advertisements.
All three platforms must comply by January 31, 2027.
Significantly higher penalties proposed
The current penalty framework allows fines of up to S$1 million for non-compliance with a Rectification Notice.
Under proposed legislative amendments put to Parliament in August 2026, the OCHA Office would be empowered to issue financial penalties of up to S$10 million per instance of non-compliance, or direct platforms to rectify through a Rectification Notice or Compliance Order, with criminal liability of up to S$10 million for failure to comply, plus up to S$300,000 per day for continuing offences.
Further details will be released at the Second Reading of the Scams (Countermeasures) and Other Matters Bill in September 2026.
The Police reminded the public that while platforms are now required to do more, users should still continue to exercise caution when interacting and transacting online.
