WhatsApp, Telegram & others need user's consent before they are added by unknown contact to chat group or channel

Social media platforms and online messaging services will be required to implement anti-scam safeguards by Jan. 31, 2027.

The Singapore Police Force (SPF) introduced three new codes of practice (COP) for online services on Aug. 17, an Aug. 18 press release said.

SPF announced a new COP for online messaging and conferencing services, a new COP for social media services that replaces the existing COP for online communication services, and an enhanced COP for e-commerce services.

Messaging code

The messaging code will require online messaging platforms to implement measures that make it harder for unknown contacts to engage users, or to alert users to potential scam risks posed by unknown contacts.

The designated online messaging and conferencing services that pose the highest risk of scams to users in Singapore are WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Message, Google Meet.

They will be required to adhere to the new code.

Examples of the requirements include requiring the end-user’s consent before an unknown contact can add them to a chat group or channel.

These platforms are also required to display contextual warnings or risk indicators when receiving messages or calls from an unknown or suspicious account.

This includes showing the account creation date and country of origin of an unknown or suspicious account to the end-user, so that they can make informed decisions on whether to engage or continue communication with such accounts.

Additionally, these platforms are required to provide end-users with the option to silence, filter or block messages or calls originating from accounts or telephone numbers that are not present in the end-user’s contact list.

The code will also introduce requirements to prevent the spoofing of the Singapore government through profile names or pictures.

In 2025, online messaging platforms such as WhatsApp and Telegram alone accounted for about 23 per cent of total scam cases.

Investment scams are a key concern on online messaging platforms.

In this variant, scammers approach victims using accounts the victim does not know, appearing as "unknown contact”, to offer lucrative investment products.

Government officials impersonation scams are another key concern for online messaging platforms.

In 2025, about 18 per cent of such cases took place on WhatsApp.

SPF also observed that other messaging platforms, such as Google Meet, were used to perpetrate phishing scams involving the impersonation of police officers.

Due to the urgency of government officials impersonation scams cases, requirements relating to spoofing of the Singapore government must be complied with by Sep. 30, 2026.

Social media code

The newly introduced social media code will require social media platforms to ensure that content in advertisements on their platforms does not further a crime.

Social media services Facebook, Instagram, and TikTok pose the highest scam risk to users in Singapore and are required to adhere to the code.

The code requires preventing the publication of any advertisement accessible to Singapore users if there is reason to suspect it furthers a scam.

This includes assessing whether the advertisement uses URL cloaking to hide a destination website’s URL or otherwise contains suspicious content.

Social media platforms are required to promptly remove suspected scam advertisements that are accessible to Singapore users, including those reported by users.

Advertisers’ identities must be verified by checking government-issued records before advertisers targeting Singapore users are permitted to publish any advertisement on their platforms.

Additionally, social media platforms must disallow the publication of advertisements offering financial services and/ or products to Singapore users, unless the advertisers are licensed by the Monetary Authority of Singapore (MAS) or other applicable Singapore authorities, or a licensed authority, to do so in Singapore.

In 2025, social media platforms such as Facebook, Instagram and TikTok accounted for about 30 per cent of total scam cases.

Facebook alone accounted for about 18 per cent of total scam cases.

Designated social media services are required to implement appropriate systems, processes, or measures to comply with the social media code by Jan. 31, 2027.

E-commerce code

The enhanced e-commerce code builds upon existing requirements for seller verification and payment protection.

E-commerce platforms, Carousell, Facebook Marketplace and Facebook Business Pages, will be required to introduce stronger consent measures before permitting logins from new or unrecognised devices.

The enhanced e-commerce code also adopts the safeguards introduced in the social media code to protect end-users against the exploitation of online advertisements by scam actors.

Designated e-commerce platforms will be required to implement the appropriate systems, processes or measures to comply with the e-commerce code by Jan. 31, 2027.

Enforcement

Where the Online Criminal Harms Act (OCHA) Office assesses that a provider of a designated online service has not complied with an applicable requirement, it may issue a rectification notice requiring the designated online service to remedy the non-compliance within a specified period.

Under the current OCHA penalty framework, failure to comply with a rectification notice without reasonable excuse is an offence that carries a maximum fine of S$1 million.

In the case of a continuing offence, the designated online service may be liable for a further fine of up to S$100,000 for each day, or part of a day, the offence continues after conviction.

The Ministry of Home Affairs (MHA) has proposed legislative amendments in parliament in August 2026 to strengthen the OCHA penalty framework.

Under the proposed framework, for each instance of non-compliance with a code of practice or implementation directive, the OCHA Office may either issue a financial penalty not exceeding S$10 million, or direct the online platform to rectify the non-compliance through a rectification notice or a compliance order.

Failure to comply with a rectification notice or a compliance order without reasonable excuse is a criminal offence, punishable with a fine up to S$10 million.

In the case of a continuing offence, to a further fine of up to S$300,000 for every day or part of a day during which the offence continues after conviction.

The police urged members of the public to remain vigilant against online criminal harms.

While designated online service providers are expected to do more to enhance the safety of their services under the COPs, users should continue to take precautions when interacting and transacting online, the police said.