The Singapore Police Force warned on 2 October 2026 that bargain product advertisements on Facebook, Instagram and TikTok have steered shoppers to phishing pages since July, with 246 reported cases and losses above $1.4 million.
How the lures work
Victims tap sponsored posts promising steep discounts on electronics, sneakers and skincare. The links open cloned storefronts that ask for card numbers and one-time passwords as if checkout were genuine. Once credentials are captured, criminals drain accounts or place unauthorised orders before banks freeze cards.
Investigators said many ads use stolen product photos and fake countdown timers to pressure quick payment. Because the posts live inside familiar apps, users lower their guard compared with cold emails.
Platforms and reporting
Police advised shoppers to buy only from merchant pages with long track records and to avoid entering card details on sites reached solely through ads. Meta and TikTok have reporting flows, but takedown speeds vary, leaving windows where new ads spin up under fresh accounts.
The advisory tells victims to call their banks immediately, file a police report, and preserve screenshots of the advertisement and phishing URL. Early reporting improves recovery odds when transfers are still traceable.
Protecting households
Families running shared devices should enable payment-app alerts so unusual charges ping every user. Elderly parents attracted to gadget deals are over-represented in case summaries, prompting community centres to rerun anti-phishing talks tied to the October advisory.
Hardware token users should never enter OTP codes on pages that appear after an ad click, even if the page copies bank branding. Legitimate issuers send OTP prompts only for transactions you initiated inside official apps.
What comes next
Police said operations continue with platform partners to trace ad buyers, but they stressed consumer verification remains the first line of defence. Shoppers should treat too-good-to-be-true prices in social feeds as a stop sign, not a shortcut, until merchants are verified through official marketplaces or brand sites.
Bank and wallet safeguards
Major retail banks reminded customers on 2 October that they will not ask for OTPs through chat apps, a message repeated after the advisory because criminals imitate bank logos on phishing pages. Digital wallet providers said they are tightening velocity limits on new payees linked from social redirects.
Community centres in the heartlands plan weekend clinics where volunteers walk residents through ScamShield reporting steps. Case officers said many losses topped five figures when victims entered OTPs multiple times, thinking they were confirming delivery fees rather than authorising transfers.
Because ads rotate quickly, SPF urged shoppers to screenshot the sponsor name and product URL the moment an offer appears, giving investigators a trail even if the post disappears overnight. Losses above $1.4 million across 246 cases since July show the scale is more than a nuisance for household balance sheets.
Meta and TikTok have been asked to tighten advertiser verification for discount-heavy campaigns, though police did not name specific enforcement actions in the 2 October release. Cyber Security Agency partners are distributing checklists to small businesses that run their own social shops so they do not unknowingly mirror criminal ad templates.
Retailers with legitimate flash sales advised customers to type official domains manually instead of tapping shortened links embedded in stories, a habit that blocks many phishing redirects while still allowing genuine promotions.
Case summaries since July show losses clustering around electronics and limited-edition sneakers, categories where fake discounts of 70% or more are common lures. SPF said victims who paid through bank transfers rather than cards face longer recovery timelines, another reason to stick to card protections that allow chargebacks when goods never arrive.
Instagram and Facebook parent Meta told advertisers in Singapore that it is testing stricter landing-page previews for shopping ads, though the 2 October advisory did not tie those tests to a launch date.
SPF’s 2 October release is the reference point for the 246-case tally and $1.4 million loss figure; anyone approached through a bargain ad this weekend should file reports through the police e-services portal so investigators can link new incidents to the same campaign patterns.