> Quick view: Parliament passed the Scams (Countermeasures) and Other Matters Bill on Wednesday 9 September 2026. The police get three new orders they can send straight to your bank, telco or app: a Disclosure Order, an Account Disabling Order (up to 30 days, extendable once by another 30) and a Service Limitation Order (up to 3 years). Handing your bank or app account to someone else becomes a jailable, caneable offence, and the maximum fine for platforms that ignore the anti-scam codes of practice jumps from S$1 million to S$10 million. The commencement date has not been announced, so none of it is in force yet.
Most anti-scam laws in Singapore have aimed at the scammer or at the platform. This one also aims at the ordinary account holder who lets a stranger use their bank login, their SIM or their Carousell profile, usually for a few hundred dollars and usually without thinking of it as a crime. After the Scams (Countermeasures) and Other Matters Bill was passed on 9 September 2026, that is a criminal offence carrying jail and, in the worst cases, the cane.
The Bill had its First Reading on 4 August 2026. Its Second Reading opened in Parliament on 8 September 2026 with a speech by Mr Goh Pei Ming, Senior Minister of State for Home Affairs, and the Bill was passed the following day.
Here is what actually changes for you.
Three new police orders
The Bill gives the police three orders they can issue directly to a service provider. A service provider here means a bank, a telco, or an online service such as a messaging app or a marketplace.
| Order | What it does | How long |
|---|---|---|
| Disclosure Order (DO) | Requires a provider to hand over information on specified accounts and scam-related activity, where this is necessary or expedient to prevent a scam-related offence | No fixed duration |
| Account Disabling Order (ADO) | Requires a provider to disable a specific account where police suspect or have reason to believe it has been, or will be, used in furtherance of a scam-related offence | Up to 30 days, with one possible extension of up to 30 more |
| Service Limitation Order (SLO) | Requires a provider to restrict an identified person's access to specified services, where police suspect they will use the service to commit or facilitate a scam-related offence | Up to 3 years |
Note what is not in that table: a court. These are police orders, issued in advance of any charge. Non-compliance by the service provider is itself a criminal offence, and providers who act in good faith and with reasonable care get immunity from criminal and civil liability for doing so.
If it happens to you, you appeal to the police
There is an appeal route, and it runs inside the Force. A person affected by an ADO or an SLO may appeal to the Commissioner of Police, or to a designated officer of at least Superintendent rank. Mr Goh told Parliament that "no one wants to inadvertently affect or inconvenience persons who may not have been involved in scam activity", and that the appeal mechanism will be in place before the powers are operationalised. The Commissioner's decision is final.
Which services an SLO can cut off
The Service Limitation Order puts the existing mule restriction framework onto a statutory footing. Three categories of service can be restricted:
- Financial institutions, meaning bank accounts and payment services
- Telecommunications services, meaning mobile lines and SIM cards
- Singpass
The people this is aimed at are those who have been warned, offered a composition sum, prosecuted or convicted for mule-related offences, or who are under investigation for one and assessed to be at risk of facilitating further scams.
The framework is not theoretical. As at 30 June 2026, MHA says it had already restricted 1,423 money mules, 1,439 SIM card mules and 53 corporate mules.
The new offence that catches ordinary people
Four new offences cover the misuse of what the Bill calls a designated online account. In plain terms they make it a crime to:
- Provide your personal information so someone else can register an account
- Possess an account registered using someone else's information
- Supply an account to someone for criminal activity
- Receive or retain control of such an account for criminal activity
The penalties
| First conviction | Repeat conviction | |
|---|---|---|
| Fine | up to S$10,000 | up to S$20,000 |
| Jail | up to 3 years | up to 5 years |
| Both | Yes | Yes |
On top of that, caning of up to 12 strokes is available where the person knew or intended that the account would be used to facilitate scam offences. Companies and unincorporated associations face double the maximum fine.
The part to read twice: the presumptions
This is where an otherwise ordinary person gets caught. Under the Bill, you are presumed to have known the account would be used unlawfully if any of the following is true:
- You supplied or provided the account for any gain
- You did not take reasonable steps to verify the recipient's identity or location
- You did not ascertain what the recipient wanted the account for
For the receiving offence, taking control of an account for any gain likewise raises a presumption of unlawful intent.
The defence written into the Bill is that you had reasonable grounds to believe the purpose was lawful. But the burden has shifted: "I did not ask" is no longer a neutral fact. It is one of the things that puts the presumption on you.
Which accounts count
The offences apply to online services designated under the Online Criminal Harms Act (OCHA). As things stand that list is:
Facebook, Instagram, WhatsApp, Telegram, WeChat, TikTok, Carousell, Google and Apple.
So a "just lend me your Carousell account for a bit" request from someone offering S$300 now sits squarely inside a criminal provision.
Platform fines go up tenfold
The Bill rewrites the penalty regime under OCHA for platforms that ignore a code of practice or an implementation direction.
| Before | After | |
|---|---|---|
| Maximum penalty for non-compliance | S$1 million | S$10 million per instance |
| Daily penalty for a continuing offence | S$100,000 | S$300,000 per day |
Mr Goh described the S$10 million figure as the highest fixed quantum financial penalty in Singapore's statute book. The Competent Authority may also issue a rectification notice or compliance order instead of going straight to a penalty, and a provider gets at least 7 days to make written representations before a penalty is imposed. Appeals go to the Minister for Home Affairs, whose decision is final.
One quieter amendment: OCHA directions may now be issued using a computer program, so takedown directions can be pushed out at machine speed rather than one at a time.
Two other Acts amended
- Protection from Scams Act: officers gain powers to request information about account holders affected by Restriction Orders.
- Police Force Act: allows the appointment of Civilian Specialist Officers with investigative powers similar to those of Commercial Affairs Officers, which is how the Force intends to add investigators without adding warrant officers.
The numbers behind the Bill
Scams are falling in Singapore, and the Government still moved. Both things are true.
- First half of 2026: reported cases fell 14.4% to about 16,800, and losses fell 17.9% to about S$411 million, both against the same period in 2025.
- Even so, the police still receive about 90 reported scam cases a day, involving about S$2 million lost every day.
- One case cited in the Second Reading: a single victim lost S$4.9 million to an impersonation of senior government officials.
- The UN Office on Drugs and Crime estimates scam losses across East and Southeast Asia, Australia and New Zealand roughly tripled between 2023 and 2025.
Nothing is in force yet
The Bill was passed on 9 September 2026, but a Bill takes effect on its commencement date, and that date has not been announced. Mr Goh's speech tied operationalisation to the appeal mechanisms being ready. Until commencement, the existing law applies.
What this means for you
Never let anyone else use your account. Not your bank account, not your SIM, not your Singpass, not your Carousell or WhatsApp. The old excuse, that a friend needed to receive a payment and you did not ask why, is exactly the fact pattern the presumptions are built around. If money changed hands, you start on the back foot.
Be careful with the "part-time job" offers. Listings that pay you to receive transfers, to register accounts, or to hand over a verification code are recruiting mules. The person who gets restricted from Singpass and their bank for up to 3 years, and possibly caned, is the account holder, not the person who paid them.
If your account is suddenly disabled, there is a process. An ADO runs up to 30 days and can be extended once. Contact your bank or provider, and note that the appeal goes to the Commissioner of Police rather than to the provider.
Do not expect scam reporting to change. If you are a victim, the route is unchanged: call the ScamShield helpline on 1799, use the ScamShield app, make a police report, and tell your bank immediately.
Fine print
- This is a summary of an official announcement and of a Bill's Second Reading, not legal advice. Confirm your own position with the Ministry of Home Affairs, the Singapore Police Force or your own lawyer before acting on any of it.
- The Bill was passed on 9 September 2026. The commencement date has not been announced, so none of these powers, offences or penalties apply yet.
- Section numbers, penalty figures and the designated-service list come from MHA's press release of 4 August 2026 and the Second Reading speech by Senior Minister of State Goh Pei Ming delivered on 8 September 2026.
