> Quick view: On 17 August 2026 the Singapore Police Force issued three Codes of Practice under the Online Criminal Harms Act. The headline change: seven messaging apps must get your consent before an unknown contact can add you to a group chat or channel, and must warn you about suspicious accounts and let you block non-contacts. Most requirements are due by 31 January 2027; anti-government-impersonation measures by 30 September 2026. Nothing changes on your phone today.
If you have ever been dumped into a "stock tips" Telegram channel by a number you have never seen, that specific move is now on the way out.
On 17 August 2026, the Singapore Police Force (SPF) — through its Online Criminal Harms Act (OCHA) Office — issued three Codes of Practice for designated online services: a new Messaging Code, a new Social Media Code (which replaces the existing Code for Online Communication Services), and an enhanced E-Commerce Code.
These build on the first two Codes introduced in June 2024. The police say scam cases reported on designated online services fell by about 37% between 2024 and 2025, and that the designated services have complied with the existing requirements.
1. The Messaging Code — the part you will actually notice
In 2025, messaging platforms such as WhatsApp and Telegram alone accounted for about 23% of total scam cases. So seven services are now designated:
- Telegram
- Apple iMessage
- Apple FaceTime
- Google Messages
- Google Meet
The target is the "unknown contact" tactic — a scammer who is not in your contacts messages you out of the blue with a lucrative investment. Examples of what these apps must do:
- Get your consent before you can be added into a chat group or channel.
- Show contextual warnings or risk indicators on messages and calls from unknown or suspicious accounts — for example the account creation date and country of origin, so you can decide whether to engage.
- Let you silence, filter or block messages or calls from accounts or phone numbers not in your contact list.
- Prevent spoofing of the Singapore Government through profile names or pictures.
That last one has its own, earlier deadline. In 2025, about 18% of Government Officials Impersonation Scam (GOIS) cases took place on WhatsApp, and the police have also seen Google Meet used for phishing calls impersonating police officers.
2. The Social Media Code — going after scam ads
Facebook, Instagram and TikTok accounted for about 30% of total scam cases in 2025, with Facebook alone at about 18%. The new Social Media Code applies to Facebook, Instagram and TikTok, and requires them to:
- Not publish an ad accessible to Singapore users where there is reason to suspect it is in furtherance of a scam — including checking for URL cloaking that hides the destination website.
- Promptly remove suspected scam ads, including those reported by users.
- Verify advertiser identities against Government-issued records before letting them advertise to Singapore users.
- Disallow financial-services ads unless the advertiser is licensed by MAS or another applicable Singapore authority.
3. The E-Commerce Code — stronger login checks
The designated platforms are unchanged: Carousell, Facebook Marketplace and Facebook Business Pages. On top of the existing seller-verification and payment-protection rules, they must now introduce stronger consent measures before permitting logins from new or unrecognised devices, and adopt the Social Media Code's advertising safeguards.
The dates that matter
| Requirement | Deadline |
|---|---|
| Anti-spoofing of the Singapore Government (messaging apps) | 30 September 2026 |
| Everything else under the Messaging Code | 31 January 2027 |
| Social Media Code (Facebook, Instagram, TikTok) | 31 January 2027 |
| E-Commerce Code (Carousell, FB Marketplace, FB Business Pages) | 31 January 2027 |
The fine print
- Nothing changes on your phone today. These are compliance deadlines for the platforms, not features already switched on.
- It is calibrated, not uniform. Requirements are applied based on each service's assessed scam risk, and services may receive full or partial waivers from certain requirements — so the seven messaging apps will not necessarily behave identically.
- The old Code goes away. The existing Online Communication Services Code will be rescinded when the two new Codes come into force.
- Penalties are set to rise. Today, failing to comply with a Rectification Notice without reasonable excuse carries a maximum fine of S$1 million, plus up to S$100,000 a day for a continuing offence. MHA has proposed raising this to a financial penalty of up to S$10 million (and up to S$300,000 a day for continuing offences). More details are due at the Second Reading of the Scams (Countermeasures) and Other Matters Bill in September 2026.
What it means for you
- The group-add loophole closes — eventually. Until the platforms ship it, keep treating any unsolicited group or channel add as a red flag, and leave first, ask never.
- Use the block tools you already have. WhatsApp and Telegram already let you restrict who can add you to groups, in Privacy settings. You do not have to wait for 2027.
- A verified-looking ad is still not a licensed adviser. Even once advertiser checks are in place, confirm any investment or financial-services offer against MAS's own Financial Institutions Directory and Investor Alert List before you send anyone money.
- Government agencies still will not ask for money or bank logins over chat. The anti-spoofing rules make impersonation harder, not impossible.
A survey by the Ministry of Digital Development and Information (MDDI) found more than four in five (84%) Singapore residents had encountered harmful content online, with content supporting illegal activity such as scams the most frequently encountered type — which is why the police still ask users to stay vigilant rather than rely on the platforms alone.
This is a summary of the official SPF announcement of 17 August 2026, not legal advice. The full list of requirements under each Code is published by the police — check police.gov.sg for the authoritative version.
Source: Singapore Police Force, "Issuance Of Codes Of Practice Under The Online Criminal Harms Act", 17 August 2026. Cover: MissLobang designed graphic (no agency campaign artwork was issued for this announcement).
