Singapore’s banks spent the last two years fortifying one-time passwords, transaction limits and money-lock features, yet police disclosed that at least 246 social-media shopping advertisements since July led to phishing pages that stole more than S$1.4 million. The gap is not cryptography; it is distribution. Fraudulent ads can be micro-targeted to bargain hunters on Facebook, Instagram and TikTok before any bank fraud analyst sees a login attempt.
A Singapore lever
The Infocomm Media Development Authority already licenses certain digital services; extending advertiser verification to large platforms with significant Singapore ad revenue would at least create a domestic compliance hook while global negotiations continue. Parliament does not need a sermon on technology—just a requirement that platforms publish median takedown times the way banks publish service standards.
Where the victim journey starts
In the police-described variant, users click promoted listings for household goods or fashion, land on a cloned checkout, and hand over card numbers or approve digital tokens believing they secured a deal. Losses surface hours later as card-not-present charges or account transfers. ScamShield and the 1799 helpline help after the fact, but the ad auction already delivered the victim.
What platforms could do earlier
Verified advertiser programmes, upfront business registration checks and rapid takedown service-level agreements are standard talking points in every parliamentary question on scams. They are still voluntary industry measures. Requiring payment processors to match ad landing domains against known phishing feeds would shift some burden upstream, yet platforms resist delays that hurt small legitimate merchants.
Singapore cannot legislate Menlo Park or ByteDance into compliance alone, but it can align ASEAN digital economy dialogues around advertiser identity the same way anti-money-laundering rules harmonised bank know-your-customer standards. Domestic law should at least expose which platforms took more than 24 hours to pull reported ads, so consumers see a track record before clicking “Shop now.”
Household habits still matter
Until policy catches up, the boring advice stands: buy from official apps, not promoted links; use separate cards with low limits for online shopping; and talk with parents about ads that look like friends’ reposts. Banks should keep improving payee name checks, but they should stop pretending that another OTP screen closes a hole opened in the advertising stack.
A Singapore lever
The Infocomm Media Development Authority already licenses certain digital services; extending advertiser verification to large platforms with significant Singapore ad revenue would at least create a domestic compliance hook while global negotiations continue. Parliament does not need a sermon on technology—just a requirement that platforms publish median takedown times the way banks publish service standards.
Scam fighting became a national campaign because losses are measurable. The next metric should be ad takedown time, not just blocked transactions.