The Singapore Police Force warned on 2 October that at least 246 people have reported losses of S$1.4 million since July after clicking sponsored posts on Facebook, Instagram and TikTok that advertised steep discounts on groceries, fashion and household goods, then routed victims to phishing sites that harvested card numbers, internet-banking logins and one-time passwords.
How the scam works
Victims see polished product photography in their feeds—often mimicking brands Singapore shoppers already trust—and tap through to a checkout page that looks like a legitimate e-commerce portal. Some were asked to authorise digital tokens to “complete payment,” giving criminals live access to bank apps. Losses surfaced only when unauthorised charges appeared on statements or when balances dropped overnight. Police stressed that the advertisements themselves are fraudulent; the platforms may not have verified the merchant behind the creative.
This variant sits beside older scams: fake SPF pop-ups demanding fines, WhatsApp impersonation of students asking parents for PayNow course fees, and government-officer calls. The social-ad channel is notable because it meets victims in a leisure context where guard rails are lower than in email inboxes filtered by corporate gateways.
What banks and shoppers can do now
Police reiterated the ACT framework—add security features, check for scam signs, tell authorities. Practically, that means enabling transaction alerts, using hardware tokens where available, and calling the ScamShield helpline at 1799 before paying unknown merchants. If a deal price would not cover GST and shipping on a real storefront, treat the ad as hostile.
Mid-year statistics already showed scam dollars easing—S$410.6 million lost in the first half of 2026 versus S$500.2 million a year earlier—but case counts remain high at 16,821 reports. Social-ad phishing could reverse the dollar trend if each victim loses four-figure sums in a single checkout. Card issuers may tighten merchant category blocks on fresh domains, yet criminals rotate URLs faster than block lists update.
Platforms and the next enforcement beat
Meta and TikTok have global advertiser verification programmes, but victims seldom know whether a sponsored post passed those checks. SPF’s advisory does not name platform liability; it focuses on user hygiene. Parliament has separately debated scam accountability for telcos and banks; this wave pushes the same question to ad networks that profit from impressions even when the landing page is fake.
Until regulators publish new duties, the defensive playbook is local: screenshot suspicious ads, report through in-app tools, and avoid entering OTPs on any page opened from social feeds. Weekend shopping traffic makes October a high-risk window—exactly when hawker closures and holiday sales crowd timelines with legitimate promotions. Treat sponsored bargains as guilty until verified on the brand’s official site or app, not the other way around.