Retiree Group Scams on TikTok and Facebook: How Malware Deletes Singpass and Drains Bank Accounts
Direct Answer
Scammers are running fake "retiree group" advertisements on TikTok and Facebook to lure elderly Singaporeans into downloading malware-infected APK files. The malware uninstalls security apps like Singpass and ScamShield, and in some cases raises bank transaction limits without authorisation. Since 1 April 2026, at least 8 cases have been reported with total losses of at least S$69,000, according to the Singapore Police Force (SPF).
Introduction
If you have elderly parents, grandparents, or relatives who use TikTok or Facebook on their phones, this scam should be on your radar. A new variant of government official impersonation scam is specifically targeting senior citizens in Singapore through social media advertisements promising community activities for retirees. The Singapore Police Force issued a public advisory on 18 June 2026, warning that the scam involves malware which actively removes security protections from victims' devices — leaving them vulnerable to financial exploitation.
This is not a phishing email or a suspicious phone call. It is a sophisticated, multi-stage operation that combines social engineering, mobile malware, and impersonation of government officials. Understanding how it works is the first step to protecting yourself and your loved ones.
How This Scam Works in Singapore
The scam follows a deliberate three-stage playbook designed to exploit the trust and digital habits of elderly Singaporeans.
Stage 1: The Lure — Fake Retiree Group Advertisements
Scammers post advertisements on TikTok and Facebook promoting activities for senior citizens. The ads use friendly, inviting language such as "Join our Retirees Group!" and "Come and be part of our group!" They feature images of happy older adults in community settings — waterfalls, building courtyards, and social gatherings. The advertisements encourage interested viewers to submit their contact details to join.
Stage 2: The Malware — APK Download Disguised as Activity List
After a victim submits their contact details, the scammers reach out via WhatsApp. They instruct the victim to download an Android Package Kit (APK) file, claiming it contains a list of activities for the retiree group. In reality, the APK is malware. Once installed, it silently uninstalls critical security applications — specifically Singpass and ScamShield — from the victim's device. In at least one case, the malware also raised the victim's bank transaction limit without authorisation, preparing the account for large unauthorised transfers.
Stage 3: The Impersonation — Fake Government Officials
With the victim's security apps removed and their device compromised, a scammer contacts the victim while impersonating an official from the Ministry of Law (MinLaw) or the SPF Anti-Scam Centre (ASC). The scammer claims the victim's device has been compromised by an illegal mobile application and instructs them to transfer money or hand over valuables such as gold or mobile phones, purportedly to assist with police investigations. Victims only realise they have been scammed when they grow suspicious of the transactions or when they check with the relevant authorities.
Real-World Impact and Statistics
Since 1 April 2026, the Singapore Police Force has received reports of at least 8 cases involving this specific scam variant, with total losses amounting to at least S$69,000. That is an average of approximately S$8,625 per victim — a devastating sum for retirees who may be living on savings and CPF payouts.
The scam targets elderly Singaporeans who are active on social media, particularly TikTok and Facebook. Many seniors in Singapore use these platforms to stay connected with family and pass the time, making them exposed to malicious advertisements. The malware's ability to uninstall Singpass is particularly concerning, as Singpass is the national digital identity platform used for accessing government services, healthcare, and financial accounts. Without it, victims lose not only a critical security tool but also their ability to verify their identity for essential services.
The fact that the malware can raise bank transaction limits without authorisation suggests that the attackers have deep access to the victim's device settings, potentially through accessibility services or device administrator permissions granted during the APK installation.
How to Protect Yourself and Your Loved Ones
Preventing this scam requires a combination of awareness, device hygiene, and communication with elderly family members. Here are the essential steps:
Talk to your elderly relatives about this scam. Show them this article. Explain that no legitimate retiree group will ask them to download an APK file from WhatsApp.
Disable "Install Unknown Applications" on Android devices. Go to Settings > Security > Install Unknown Apps and ensure this is turned off for all apps. This prevents APK files from being installed outside of the Google Play Store.
Enable Google Play Protect. This built-in Android security feature scans apps for malware. Go to Google Play Store > Profile > Play Protect and ensure it is enabled.
Keep ScamShield installed and updated. ScamShield is Singapore's official scam-filtering app developed by the National Crime Prevention Council (NCPC). If it disappears from a device without explanation, that is a red flag.
Set transaction limits on bank accounts. Work with your elderly family members to set conservative daily transaction limits on their bank accounts. This reduces the potential damage if a scammer gains access.
Verify before acting. Government officials will never ask you to transfer money, hand over valuables, or download apps from unofficial sources. If someone claims to be from the Ministry of Law or SPF and asks for any of these, it is a scam.
What to Do If You Are Targeted
If you or a family member has downloaded a suspicious APK or suspects the device is compromised, take these steps immediately:
Turn on Flight Mode. This cuts off all wireless connections and prevents the malware from communicating with the scammer's server. Ensure Wi-Fi is switched off and do not turn it back on.
Do NOT perform a factory reset yet. While it may seem like the safest option, a factory reset before reporting to the police could destroy evidence needed for investigations.
Run an anti-virus or Google Play Protect scan on the device while it is in flight mode.
Check bank accounts, Singpass, and CPF for any unauthorised transactions using a separate, uncompromised device.
Report to the Singapore Police Force immediately. Call the anti-scam helpline at 1799 or file a report at your nearest police station.
After reporting to the police, perform a factory reset of the device and change all important passwords, including banking, Singpass, and email credentials.
Common Mistakes to Avoid
Do not download APK files from WhatsApp, Telegram, or any messaging platform. Only install apps from the Google Play Store or Apple App Store.
Do not share personal contact details with unknown advertisers. If an ad on TikTok or Facebook asks for your phone number or IC number, do not provide it.
Do not trust callers who claim to be government officials and ask for money. No Singapore government agency will ever request money transfers or valuables over the phone.
Do not ignore missing apps. If Singpass or ScamShield disappears from a device, treat it as a potential security incident.
Do not assume elderly relatives are too careful to be scammed. This scam is specifically designed to look legitimate and community-oriented. Even savvy users can be caught off guard.
Conclusion
The retiree group scam targeting elderly Singaporeans through TikTok and Facebook is a troubling evolution in social engineering — combining fake community advertisements, mobile malware, and government impersonation into a single devastating pipeline. With at least S$69,000 lost in just a few months, the financial and emotional toll on victims and their families is significant.
Protecting elderly Singaporeans starts with awareness. Share this article with your parents and grandparents. Check their phones for unknown apps. Disable the ability to install APK files from unknown sources. And remind them: no government official will ever ask for money over the phone.
If you have any doubts about a suspicious message or call, contact the ScamShield Helpline at 1799 or visit www.scamshield.gov.sg to verify. Staying informed is the best defence.
FAQ
How do I know if my phone has been infected with malware from a retiree group scam?
Check whether your Singpass or ScamShield apps have disappeared without your action. If they are missing, or if you notice unfamiliar apps installed on your device, treat it as a potential infection. Other signs include unexpected pop-ups, reduced battery performance, or changes to your phone's settings that you did not make. Run a Google Play Protect scan immediately and check your bank accounts for unauthorised activity using a separate device.
Why do scammers target elderly Singaporeans specifically?
Elderly Singaporeans are often active on social media but may have less experience identifying sophisticated scams. They may be more trusting of community-oriented advertisements and less likely to question instructions that appear to come from government officials. Additionally, many seniors keep significant savings in bank accounts, making them financially attractive targets. The scammers exploit both the trust and the digital habits of this demographic.
What should I do if my elderly parent has already transferred money to a scammer?
Contact their bank immediately to report the fraudulent transaction and request a freeze on the account. Then file a police report with the Singapore Police Force — call the anti-scam helpline at 1799. Time is critical: the sooner the bank is notified, the higher the chance of recovering the funds. Also check whether the parent's Singpass or other accounts have been compromised, and change all passwords.
Is TikTok doing anything about these scams?
According to SPF, TikTok has stated that it is committed to protecting its community from scams and fraudulent activity. The advertisements mentioned in the SPF advisory and the associated advertiser account were removed when reported to TikTok. TikTok's community guidelines prohibit content that attempts to scam, defraud, or mislead others, and violating accounts may be suspended or removed. However, new malicious advertisements can still appear, so users should remain vigilant.
Can I reinstall Singpass after it has been deleted by malware?
Yes. You can reinstall Singpass from the Google Play Store or Apple App Store. However, before doing so, ensure that the malware has been removed from your device — either through an anti-virus scan or, ideally, a factory reset after reporting to the police. Reinstalling Singpass on a still-infected device could result in the malware removing it again or capturing your login credentials.
How can I verify if someone claiming to be from the SPF or Ministry of Law is genuine?
Government officials in Singapore will never ask you to transfer money, hand over valuables, or download apps from unofficial sources. If someone claiming to be a government official makes any of these requests, it is a scam. Hang up immediately and verify by calling the official agency directly using a number from their official website. You can also check the ScamShield app or call the ScamShield Helpline at 1799 to verify suspicious communications.