The Singapore Police Force (SPF) has disrupted more than 30,000 Apple iMessage accounts linked to a scam campaign that has caused about S$2.2 million ($1.7 million) in losses.
In a statement on Thursday, the force said its Cyber Command has been detecting and disrupting the accounts since June 2026. The loss figure is up from the S$1.2 million reported on August 5.
In the scam, fraudsters send iMessages impersonating courier companies such as NinjaVan, J&T Express and SPX Express, as well as government agencies and financial institutions, the police said. The messages direct recipients to spoofed websites resembling those of legitimate organizations, where victims are asked to make a small payment or pay a fine by entering card or banking details.
The police said some victims who entered one-time passwords later found their cards added to mobile wallets, their bank security tokens registered on unfamiliar devices, or unauthorized logins to their accounts. The victims typically realized they had been scammed only after seeing unauthorized transactions.
The police noted that iMessage, which runs on Apple’s own system, is not covered by the network-level filters and the sender ID registry that apply to text messages in Singapore. Government agencies and courier companies do not use iMessage to communicate with the public, the police added.
Prior to the announcement, on August 17, the police issued new Codes of Practice under the Online Criminal Harms Act. It applies to seven services assessed as posing the highest scam risk, namely WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Message, and Google Meet.
The services must comply by January 31, 2027, with the anti-impersonation measures due by September 30, 2026.
The police said messaging platforms such as WhatsApp and Telegram accounted for about 23 percent of scam cases in 2025.
New code targets scam advertisements on Facebook, Instagram and TikTok
Earlier on Tuesday, the police force announced a separate Social Media Code will apply to Facebook, Instagram and TikTok, which together accounted for about 30 percent of scam cases in 2025, with Facebook alone making up about 18 percent.
The code targets the use of advertisements to reach victims. Platforms will be required to block and promptly remove suspected scam advertisements, to verify advertisers’ identities against government records, and to bar advertisements offering financial products or services unless the advertiser is licensed by the Monetary Authority of Singapore.
An enhanced E-Commerce Code covering Carousell, Facebook Marketplace and Facebook Business Pages will add stronger controls on logins from unrecognized devices.
Scam cases on services already covered by earlier codes fell by about 37 percent between 2024 and 2025, the police said. The government has proposed raising the maximum penalty for non-compliance to S$10 million (US$7.8 million) per breach, with further details to be given when the Scams (Countermeasures) and Other Matters Bill is debated in Parliament in September.