Police disclosure that 246 shoppers lost at least S$1.4 million to fake social media advertisements since July exposes a gap banks cannot close with one-time passwords alone: victims willingly type card numbers into phishing sites that mimic Shopee-style checkout pages promoted in sponsored posts.
Total scam losses fell to S$410.6 million in the first half of 2026 from S$500.2 million a year earlier, and case counts dropped about 14 per cent. Progress on aggregate numbers should not obscure how cheap-goods ads weaponize trust in familiar e-commerce layouts. Victims click because the price looks plausible, not because they are uninformed.
Why OTP limits fail here
Banks tightened authentication after malware and SMS hijacks, but many phishing flows capture card data and one-time codes on a cloned page before legitimate merchants see the transaction. By the time SMS alerts fire, mule accounts have absorbed PayNow or card settlements. The mid-year scam brief shows thousands of lines and websites taken down, yet ad platforms rotate faster than takedowns.
Meta and other networks have brand-safety rules, but enforcement is reactive — triggered after user reports and police referrals. ScamShield blocks known numbers; it does not scan sponsored catalogues for pixel-perfect checkout clones.
What should change
Platforms should treat payment-page URLs in ads with the same suspicion banks apply to new payees — delaying settlement until domain age and merchant credentials clear enhanced checks. Advertisers promoting electronics and groceries below market price ought to trigger manual review, not automated approval. Banks can shorten reaction times when multiple customers pay the same fresh URL, but prevention starts before credentials leave the phone.
Households still need the ACT habits police promote. Institutions must stop pretending card controls alone end social-commerce fraud. Until ad marketplaces bear friction costs for fraudulent checkout domains, the S$1.4 million figure will be a floor, not a ceiling.
Shared responsibility beyond banks
Card networks can flag merchant category codes, but phishing sites mimic legitimate electronics merchants long enough to clear one batch of transactions. Payment service providers that onboard small e-commerce merchants in hours enable scammers to rotate URLs faster than fraud teams blacklist them. A model that socializes losses onto banks alone will keep producing mid-year briefs with nine-figure totals.
Education campaigns help, yet the demographic spread of the 246 victims since July shows educated shoppers are not immune when prices undercut malls by 30 per cent. The bargain is the hook; the fake checkout is the trap. Teaching users to open retailer apps directly instead of clicking ad links is more effective than another poster in the MRT.
Parliament’s scrutiny of scam offences has already introduced caning for some runners. The next lever is upstream: ad transparency registers that show who paid for a sponsored deal and delayed payout to new domains. Without that, police will keep announcing million-dollar losses one press release at a time while platforms classify the problem as user error.