The Singapore Police Force warned on 20 October 2026 that fake Facebook advertisements promoting senior activities, water fitness classes and recycling programmes have led at least 62 victims to install malware-laden Android packages, with reported losses of at least S$989,000 since April.
How the lure works
Victims encounter sponsored posts that look like community sign-ups. The ad instructs them to download an Android Application Package file outside the Google Play Store to register or arrange services. Once installed, the malware can monitor activity and enable remote access.
Follow-up calls typically come from impersonators posing as government officials or bank staff. Callers claim the victim's device or account was compromised, then push transfers, banking credentials, One-Time Passwords or even physical handovers of valuables for supposed investigations.
Why seniors are in the crosshairs
Scammers borrow the visual language of grassroots events—chair yoga, aqua aerobics, recycling drives—because those themes feel legitimate to retirees scrolling Facebook in the morning. The APK step is the pivot: it turns a social-engineering pitch into device takeover.
Police noted that in some cases fraudsters executed unauthorised transactions directly through the installed malware, meaning victims only discovered the crime when account alerts appeared.
Official guidance
Authorities reiterated that government officials will not ask for transfers, banking logins, gold collections or call transfers to other agencies. Install apps only from official stores, keep Google Play Protect enabled, and do not sideload packages from links in ads or chats.
ScamShield remains the recommended call-filter and SMS filtering tool; the 24-hour helpline is 1799 for callers who want to verify a suspicious conversation.
Platform and household response
Meta-facing advisories urge users to report suspicious ads through in-app tools, but takedown speeds vary. Households can reduce risk by moving banking to devices that never sideload software and by enabling bank money-lock features for dormant savings.
The advisory sits alongside a separate October warning on phishing ads for discounted goods that cost victims at least S$1.4 million since July. Together they show how malvertising—not just SMS links—now anchors major loss categories in Singapore's scam statistics.
If you already installed a package
Police say to stop using the device for banking, factory-reset after backing up only trusted photos, change passwords from a clean device, and file a report with transaction timestamps. Banks may dispute malware-led transfers faster when victims show prompt police reports.
Community centres and family WhatsApp groups have begun forwarding the SPF infographic; the operational lesson is to treat APK prompts in ads as red flags even when the creative looks like a People's Association poster.