Landing page banner

The Singapore Police Force (SPF) has issued the following Codes of Practice (COPs) for designated online services on 17 August 2026:

1. A new COP for Online Messaging and Conferencing Services ("Messaging Code"); 
   
2. A new COP for Social Media Services ("Social Media Code") which replaces the existing COP for Online Communication Services; and
3. An enhanced COP for E-Commerce Services ("E-Commerce Code").  These COPs strengthen our safeguards against scams by requiring providers of designated online services to put in place measures to proactively disrupt scams and malicious cyber activities affecting people in Singapore.
   

They build on the existing COPs introduced in June 2024 and reflect the Government’s continued partnership with industry to keep pace with the evolving online threat landscape. 

Existing COPs have helped reduce scams

In June 2024, the SPF’s Online Criminal Harms Act (OCHA) Office¹ issued two COPs – one for Online Communication Services² (“Online Communication Code”) and another for E-Commerce Services³ (“E-Commerce Code”). These took effect on 26 June 2024 and were applied to designated online services assessed to be at high risk of being used for scams. 

Scam cases reported on designated online services fell by about 37% between 2024 and 2025. While scam trends are affected by multiple factors, this reduction shows that upstream safeguards play an important role in making it harder for scammers to target Singapore users. SPF has assessed that the designated online services have complied with the requirements imposed under the existing COPs.

Strengthening Safeguards Against Evolving Scam Threats 

However, scammers have continued to adapt their tactics and exploit new technologies and platform features, including messaging applications, online advertisements and video conferencing. A recent survey conducted by the Ministry of Digital Development and Information (MDDI) showed that more than four in five (84%) Singapore residents reported encountering harmful content online, with content supporting illegal activity (e.g., scams) being the most frequently encountered type.

To address these risks, the OCHA Office has developed new and enhanced COPs following engagements with the designated online services. The designated online services were consulted to ensure that the COP requirements are effective in protecting Singapore users while being feasible for implementation.

The full list of requirements under each COP can be found at https://go.gov.sg/ocha. These requirements will be applied to designated online services in a calibrated manner, based on the assessed scam risk of each service. Designated online services may receive full or partial waivers from certain requirements where appropriate.

New Code of Practice for Online Messaging and Conferencing Services (“Messaging Code”)

In 2025, online messaging platforms such as WhatsApp and Telegram alone accounted for about 23% of total scam cases. To address this situation, the Messaging Code will be introduced and applied to the following designated online messaging and conferencing services that pose the highest risk of scams to users in Singapore:

1. WhatsApp
2. Telegram
3. WeChat
4. Apple iMessage 
5. Apple FaceTime 
6. Google Message 
7. Google Meet  

Investment scams are a key concern on online messaging platforms. In this variant, scammers approach victims using accounts not previously known to the victim (“unknown contact”) to offer lucrative investment products. To address this, the Messaging Code will require online messaging platforms to implement measures to make it more difficult for unknown contacts to engage users, or alert users to potential scam risk posed by unknown contacts. Some examples of these requirements are listed below:

1. Require the end-user’s consent before the end-user can be added into a chat group or channel by an unknown contact.
   
   
2. Display contextual warnings or risk indicators when receiving messages or calls from an unknown or suspicious account. For example, showing the account creation date and country of origin of an unknown or suspicious account to the end-user, so that they can make informed decisions on whether to engage or continue communication with such accounts.
   
   
3. Provide end-users with the option to silence, filter or block messages or calls originating from accounts or telephone numbers that are not present in the end-user’s contact list.

Government Officials Impersonation Scams (GOIS) is another key concern for online messaging platforms. In 2025, about 18% of GOIS cases took place on WhatsApp. SPF has also observed other messaging platforms such as Google Meet being used to perpetrate phishing scams involving the impersonation of Police Officers. To address this, the Messaging Code will introduce requirements to prevent the spoofing of the Singapore Government through profile names or pictures.

The seven designated online messaging and conferencing services will be required to implement the necessary systems, processes and measures to comply with the Messaging Code by 31 January 2027, with the exception of requirements relating to spoofing of the Singapore Government, which must be complied with by 30 September 2026 given the urgency of addressing GOIS cases.

New Code of Practice for Social Media Services (“Social Media Code”)

The OCHA Office will also introduce a new Social Media Code for Social Media platforms. In 2025, social media platforms such as Facebook, Instagram and TikTok accounted for about 30% of total scam cases. Facebook alone accounted for about 18% of total scam cases. The new Social Media Code will be applied to the following Social Media services which pose the highest scam risk to users in Singapore:

1. Facebook
2. Instagram
3. TikTok

A key concern on Social Media platforms is the use of advertisements to target potential victims. Social Media platforms profit from the publication of advertisements and must ensure that the content in the advertisement is not in furtherance of a crime. To address this, the Social Media Code will include requirements to:

1. Prevent the publication of any advertisement that is accessible to Singapore users if there is reason to suspect that the advertisement is in furtherance of a scam. This includes assessing whether the advertisement has adopted URL cloaking to hide a destination website’s URL, or otherwise has suspicious content.
   
   
2. Promptly remove suspected scam advertisements that are accessible to Singapore users, including those reported by users.
   
   
3. Verify advertisers’ identities by conducting checks against Government-issued records before advertisers targeting Singapore users are permitted to publish any advertisement on their platforms. 
   
   
4. Disallow the publication of advertisements offering financial services and/or products to Singapore users unless the advertisers are licensed by the Monetary Authority of Singapore (MAS) or other applicable Singapore authorities or a licensed authority to do so in Singapore.

The three Social Media services will be required to implement the appropriate systems, processes or measures to comply with the Social Media Code by 31 January 2027.

Enhanced Code of Practice for e-Commerce Services (“E-Commerce Code”)

The following designated e-commerce platforms under the E-Commerce Code remain unchanged:  

1. Carousell
2. Facebook Marketplace
3. Facebook Business Pages

The enhanced E-Commerce Code builds upon existing requirements for seller verification and payment protection. Designated e-commerce platforms will be required to introduce stronger consent measures before permitting logins from new or unrecognised devices. The enhanced E-Commerce Code also adopts the safeguards introduced in the Social Media Code to protect end-users against the exploitation of online advertisements by scam actors.

The designated e-commerce platforms will be required to implement the appropriate systems, processes or measures to comply with the E-Commerce Code by 31 January 2027.

Rescinding the Online Communication Services Code

The two new COPs incorporate relevant requirements from the existing Online Communication Services Code. The OCHA Office will therefore rescind the existing Online Communication Services Code when the new Codes come into force.

Enforcement

Where the OCHA Office assesses that a provider of a designated online service has not complied with an applicable requirement, it may issue a Rectification Notice requiring the designated online service to remedy the non-compliance within a specified period. Under the current OCHA penalty framework, failure to comply with a Rectification Notice without reasonable excuse is an offence under s51(3) of OCHA, which carries a maximum fine of $1 million. In the case of a continuing offence, the designated online service may be liable for a further fine not exceeding $100,000 for every day or part of a day during which the offence continues after conviction.

MHA has proposed legislative amendments in Parliament in August 2026 to strengthen the OCHA penalty framework. Under the proposed framework, for each instance of non-compliance with a Code of Practice or Implementation Directive, the OCHA Office may:

1. Issue a financial penalty not exceeding S$10 million; or 
   
   
2. Direct the online platform to rectify the non-compliance through a Rectification Notice (RN) or a Compliance Order (CO). Failure to comply with an RN or CO without reasonable excuse is a criminal offence, punishable with a fine not exceeding S$10 million and, in the case of a continuing offence, to a further fine not exceeding S$300,000 for every day or part of day during which the offence continues after conviction. 

More details will be shared at the Second Reading of the Scams (Countermeasures) and Other Matters Bill in September 2026.

The Police urge members of the public to remain vigilant against online criminal harms. While designated online service providers are expected to do more to enhance safety of their services under the COPs, users should continue to take precautions when interacting and transacting online.

¹The SPF’s OCHA Office is the Competent Authority under the Online Criminal Harms Act.

²The Online Communication Code was applicable to designated online communication services that present the highest risk of scams to Singapore users, namely Facebook, WhatsApp, Instagram, Telegram, and WeChat. Following a 240% increase in scam cases on TikTok in 2024 compared to 2023, OCHA Office designated

TikTok under the Online Communication Code on 1 September 2025. TikTok has since implemented the required measures and has also been assessed to be

compliant with observations.

³The E-Commerce Code was applicable to designated online services that facilitate e-commerce activities and pose significant risks of e-commerce scams, namely Carousell, Facebook Marketplace, Facebook Advertisements, and Facebook Pages.