When a brand impersonation scam in Singapore uses your name, your customers decide in seconds whether a message is really from you. Your job is to make that decision easy. Warn fast, in plain words, through channels customers already trust. Name your real channels so precisely that anything else looks wrong. Then repeat the warning until the wave passes, and tell people where to report. The scam is not your fault, but how quickly and clearly you speak will shape whether customers and the press see you as a victim, a bystander or the weak link.
This guide is for corporate affairs, communications, customer experience and regulatory leads at Singapore banks, payment firms, telcos, retailers, delivery and logistics firms, and any brand whose name scammers can borrow. It covers the customer warning, the channel truth, the media line and the follow-through. Fraud operations, takedowns and law enforcement liaison sit with your security and legal teams. If the scam uses a fake ad with a celebrity or executive face, see our separate guide to AI-likeness ads and verification lines.
Why impersonation is a communications problem, not only a fraud problem
Singapore has built more anti-scam rules than most markets, and they change what your customers expect from you.
Scams are still a large, visible harm. The Singapore Police Force's Annual Scam and Cybercrime Brief 2025 recorded 37,308 scam cases in 2025, down 27.6% from 51,501 in 2024, with about S$913.1 million lost. SPF's own summary of the brief notes that government official impersonation scams ranked second among scam types by amount lost. Impersonation works because it borrows trust someone else built. When it is your trust being borrowed, customers look to you first.
Your SMS name is a registered asset. Since 31 January 2023, organisations that send SMS with alphanumeric Sender IDs to Singapore mobile users must register them with the SMS Sender ID Registry run by SGNIC, an IMDA subsidiary, and use participating aggregators. Unregistered Sender IDs are marked "Likely-SCAM", according to ScamShield's guide. That gives you a precise line to use: "Our SMS only ever come from [registered Sender ID]."
Banks and telcos carry defined duties. Under the Shared Responsibility Framework from MAS and IMDA, in force since 16 December 2024, responsible financial institutions must, among other duties, impose a cooling-off period of at least 12 hours on new-device token activation, send real-time alerts, and provide a reporting channel open at all times with a self-service way to block access. Responsible telcos must block Sender ID SMS that do not come from authorised aggregators and filter SMS with known malicious URLs. If you are a bank or a payment firm, your warnings must line up with what those duties promise, word for word.
Platforms have obligations too. Under the Online Criminal Harms Act, designated online services must follow codes of practice to disrupt scams. On 17 August 2026, SPF issued new and enhanced codes covering messaging and conferencing services, social media services and e-commerce services. For you, that means a report you file with a platform has a regulatory backstop. Your comms should tell customers how to report, not only what to ignore.
The one rule: warn fast, name your channels, repeat it
Three parts you can brief in five minutes
- 1. Warn fast. Publish a short warning within hours of the first credible reports, not after the investigation ends. Say what the fake message looks like, what it asks for, and what you will never ask for. A screenshot description helps; a screenshot with live links in it does not.
- 2. Name your channels. List the exact channels you use: the registered SMS Sender ID, the verified WhatsApp Business name, the official app, the domain, and the hotline. Then state the things you never do, such as asking for one-time passwords or sending links to log in. A precise list turns every fake into an obvious outlier.
- 3. Repeat it. Impersonation comes in waves. One post on one channel reaches a fraction of customers. Repeat the warning in the app, on the login page, in the next statement email, at the branch or counter, and in the IVR message, then keep a short version live for as long as reports continue.
The impersonation warning tracker (original framework)
Use this as a working tracker when reports start coming in. The windows are planning targets; match them to how fast the scam is spreading.
| Stage | Window | Audience first | What you publish | Owner | Trap to avoid |
|---|---|---|---|---|---|
| 1. Confirm | Hour 0–2 | Fraud, security, contact centre | Internal note: what the fake looks like, a holding line for agents | Comms with fraud lead | Waiting for full scope before telling front-line staff |
| 2. Warn | Hour 2–6 | Customers on owned channels | Short advisory: what it looks like, what we never ask, how to report | Comms | Posting a screenshot with a working link or QR code |
| 3. Channel truth | Day 1 | Customers, media, partners | A standing "How to know it's really us" page | Comms with digital | A vague list ("our official channels") with no names |
| 4. Repeat | Day 1–14 | Customers who did not see the first post | In-app banner, login page, email, branch, IVR | Customer experience | Treating one social post as job done |
| 5. Account for it | Week 2 onward | Regulator, board, affected customers | What happened, what we changed, what customers should still watch for | Comms with legal and regulatory | Silence once the wave fades, until the next one |
Two points make this tracker work. First, stage three outlives the incident. A good channel truth page becomes the link you send every time. Second, stage five matters most where losses occurred. Affected customers will compare your words with the outcome of their claims.
Write the warning customers will actually read
A scam warning is not a press release. It competes with the scam message on the same small screen. Keep it to what a customer needs to act.
- Lead with the action. "Do not click links in SMS claiming to be from us about a parcel fee" beats "We are aware of fraudulent messages circulating".
- Describe the fake, briefly. Sender name used, wording, what it asks for. Do not reproduce working links, phone numbers or QR codes.
- State what you never do. For example, never ask for an OTP, never send a login link by SMS, never call to ask a customer to transfer money to a "safe account". Only say this if it is true for every team. Check with operations first.
- Give one way to check and one way to report. Your hotline or app, plus the national route: the ScamShield helpline 1799.
- Say it in the languages your customers use. In Singapore that often means English, Chinese, Malay and Tamil versions for consumer brands.
Kill this, say this
Most weak warnings fail in the same few ways. Swap them out before you publish.
| Kill this | Say this |
|---|---|
| "We are aware of fraudulent activities" | "Scam SMS using our name are asking for a parcel fee. Do not click the link." |
| "Please only use our official channels" | "Our SMS only come from [Sender ID]. Our app is [name]. Our site is [domain]." |
| "We take security very seriously" | "We will never ask for your OTP or send you a login link by SMS." |
| "Customers should remain vigilant" | "If you clicked, call [hotline] now or block your account in the app." |
Sector notes: what changes for your team
Banks and payment firms. Your warnings sit next to the Shared Responsibility Framework duties. Use the same words for your reporting channel and kill switch that your product teams use, and make sure the contact centre script matches. If customers lost money, coordinate every public line with the team handling claims, because customers will quote your warning back to you. For the wider media posture in this sector, see Media Relations in Regulated Sectors.
Telcos. You are both a channel and a brand. Customers may ask why a scam SMS reached them at all. Explain what is blocked and filtered in plain terms, without promising that nothing will get through.
Retail, delivery and logistics. Parcel-fee and refund lures are common because the messages look routine. Your channel truth page should explain how real delivery notices look and how customers can check a tracking number inside your app or site.
Any brand where customer data may have leaked. If the scam message uses real customer details, it may point to a data incident. Bring in your data protection officer straight away, and read our guide to PDPA breach communications before you say anything about how scammers got the data.
Worked example (fictional)
A fictional Singapore home-services firm, composited from common patterns, gets 40 calls in one morning. Customers have received SMS appearing to come from a look-alike Sender ID, asking them to pay a "booking deposit" through a link.
First draft, before review: a Facebook post saying, "We are aware of fraudulent messages. Please stay vigilant and only use official channels." No Sender ID, no domain, no hotline, and a screenshot showing the scam link.
What the comms lead changed:
- 1. Replaced the screenshot with a text description and removed the link.
- 2. Named the registered Sender ID, the booking domain and the app, and said the firm never asks for deposits by SMS link.
- 3. Added the hotline and ScamShield 1799, and a line for customers who had already paid: call the bank first, then the firm.
- 4. Posted the same text as an in-app banner, on the booking page and in the IVR greeting, in four languages.
- 5. Briefed contact centre agents with a three-sentence script before the post went live.
- 6. Set a 14-day review to take the banner down only when calls returned to normal.
The result is not that no customer was fooled. It is that every customer who checked found a clear answer in one step, and the firm had a defensible record of what it said and when.
Desk note for the comms lead
Keep a one-page kit ready before you need it: the channel truth list, approved warning templates in four languages, the contact centre script, the escalation tree for fraud and legal, and the platform reporting routes your security team uses. Review it each quarter, and every time you add or retire a channel. A warning that names a channel you closed last year undoes the whole message.
If the impersonation lands during a wider incident, such as a cyber attack, align the scam warning with the incident timeline. Our guide to cyber incident communications and first audiences covers that sequence.
Who this is for, and who can skip it
This is for teams whose brand customers already receive messages from: banks, payment firms, insurers, telcos, utilities, delivery firms, retailers and government-linked service providers. It also suits B2B firms whose suppliers receive fake invoices or payment-change requests in their name.
You can skip it if your organisation never contacts customers directly by SMS, chat or email, though you will still want a short channel truth page.
Frequently asked questions
Should we post a screenshot of the scam message?
Only if every link, number and QR code is removed or blurred. A text description is often safer and easier to translate.
Do we need to tell the regulator?
That depends on your sector and whether customers lost money or data. Check your licence conditions and notification duties with your regulatory and legal teams. This guide covers communications, not legal advice.
How long should the warning stay up?
Keep the short in-app or site banner live until reports return to your normal level, then keep the channel truth page live permanently.
Should our CEO front the warning?
Usually not for a routine wave. A clear, consistent service message works better. Reserve leadership statements for cases with large losses, a data link, or sustained media attention.
What to do next
This week, write your channel truth list and test it against reality: every Sender ID, number, domain, app and handle. Then draft the warning template and the contact centre script, and agree who signs them off at short notice. If you would like a second pair of eyes on the kit before the next wave, talk to Neuwark's Singapore team.