WhatsApp, Telegram and other messaging services face new anti-scam rules in Singapore

SINGAPORE: Online messaging services such as WhatsApp and Telegram will soon have to make it harder for unknown contacts to reach users as part of new anti-scam measures, the Singapore Police Force (SPF) said on Tuesday (Aug 18).The measures are part of new and enhanced codes of practice issued by the SPF's Online Criminal Harms Act (OCHA) Office to guard against scams and malicious cyber activities.The new rules will require providers of designated online services to put in place measures to proactively disrupt scams and malicious cyber activities affecting people in Singapore.Separate requirements will also apply to social media platforms Facebook, Instagram and TikTok, while existing safeguards for e-commerce services such as Carousell and Facebook Marketplace will be strengthened.NEW MESSAGING CODE In 2025, WhatsApp and Telegram alone accounted for about 23 per cent of all scam cases, SPF said.Investment scams are a key concern on messaging platforms, with scammers approaching victims through previously unknown accounts to offer lucrative investment products, SPF added.The messaging code will apply to seven online messaging and conferencing services assessed to pose the highest scam risk to users in Singapore.They are WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Message and Google Meet.Among the new requirements, the platforms will have to obtain a user's consent before they can be added to a chat group or channel by an unknown contact.They will also have to display contextual warnings or risk indicators when users receive messages or calls from an unknown or suspicious account. Such warnings could include the account's creation date and country of origin, allowing users to make more informed decisions about whether to engage or continue communicating with the account.In addition, the platforms will have to provide users with the option to silence, filter or block messages or calls from accounts or telephone numbers that are not in their contact lists.The seven services will have until Jan 31, 2027 to implement the measures needed to comply with the messaging code.Another key concern on messaging platforms is government official impersonation scams, with about 18 per cent of such cases occurring on WhatsApp in 2025, SPF said.It has also observed platforms such as Google Meet being used for phishing scams involving the impersonation of police officers.To address this, the messaging code will introduce requirements to prevent the spoofing of the Singapore Government through profile names or pictures.These requirements must be met by Sep 30, 2026, given the urgency of addressing such scams, SPF said.NEW SOCIAL MEDIA CODEThe OCHA Office will also introduce a new code for Facebook, Instagram and TikTok, which are assessed to pose the highest scam risk among social media services in Singapore.In 2025, these platforms accounted for about 30 per cent of total scam cases, with Facebook alone accounting for about 18 per cent.SPF said a key concern was the use of advertisements to target potential victims, adding that social media platforms profit from publishing advertisements and must ensure that their content is not used to further a crime.Under the social media code of practice, platforms will have to prevent advertisements from being published to Singapore users if there is a reason to suspect they are being used to further a scam.This includes checking for practices such as URL cloaking, which can be used to hide a destination website's address, as well as other suspicious content.They will also have to promptly remove suspected scam advertisements that are accessible to Singapore users, including those reported by users.In addition, the platforms need to verify the identities of advertisers by conducting checks against government-issued records before allowing them to publish advertisements targeting Singapore users on their platforms.They will also have to prevent advertisements offering financial services or products to Singapore users unless the advertiser is licensed to offer them in Singapore by the Monetary Authority of Singapore or another applicable authority.The three social media platforms must implement such measures to comply with the code by Jan 31, 2027.As the new messaging and social media codes incorporate relevant requirements from the existing Online Communication Services Code, the OCHA Office will rescind the existing code when the new ones take effect, SPF said.ENHANCED E-COMMERCE CODEAn enhanced code of practice will also apply to three e-commerce services, building on existing requirements for seller verification and payment protection introduced in June 2024.The services - Carousell, Facebook Marketplace and Facebook Business Pages - will be required to introduce stronger consent measures before allowing logins from new or unrecognised devices.The enhanced code will also adopt safeguards from the Social Media Code to protect users against the exploitation of online advertisements by scammers, SPF said.The three services must implement the required measures by Jan 31, 2027.ENFORCEMENTIf a designated online service fails to comply with an applicable requirement, the OCHA Office may issue a rectification notice requiring it to remedy the non-compliance with a specified period, SPF said.Under the current OCHA penalty framework, failing to comply with a rectification notice without reasonable excuse is an offence punishable by a fine of up to S$1 million (US$782,400).For a continuing offence, the platform may face a further fine of up to S$100,000 for every day or part of a day that the offence continues after conviction.The Ministry of Home Affairs has proposed legislative amendments in Parliament in August to strengthen the OCHA penalty framework.Under the proposed framework, the OCHA Office may impose a financial penalty of up to S$10 million for each instance of non-compliance with a code of practice or implementation directive.Alternatively, it may direct the platform to remedy the non-compliance through a rectification notice or compliance order.Failure to comply with a rectification notice or compliance order without a valid reason will be punishable with a fine of up to S$10 million.For a continuing offence, a further fine of up to S$300,000 could be imposed for every day or part of a day that the offence continues after conviction.More details will be shared at the second reading of the Scams (Countermeasures) and Other Matters Bill in September, said SPF."The Police urge members of the public to remain vigilant against online criminal harms," said SPF, adding that while the platforms are expected to do more to improve the safety of their services under the codes of practice, users should continue to take precautions when interacting and transacting online.