Singapore's scam problem has moved beyond badly written SMSes. Victims now face spoofed sender IDs, overseas calls, WhatsApp and Telegram messages, fake job offers, malware links, investment chat groups, deepfake-enabled impersonation and pressure tactics that make a scam feel like an urgent personal decision rather than a cyber incident. That is why the ScamShield app matters: it gives ordinary users a fast way to check suspicious contact points before acting.
ScamShield is part of a broader national anti-scam defence involving the Singapore Police Force (SPF), National Crime Prevention Council, Open Government Products and other public-sector partners. The official ScamShield portal describes it as a one-stop source for scam awareness, scam checking and help, with the app complemented by the 24/7 ScamShield Helpline at 1799. CSA Singapore also recommends adding ScamShield and anti-virus apps because scammers often approach victims through calls and SMSes before moving them to links, downloads or bank transfers.
For Singapore residents, the app is useful because many scams begin on the phone. For SMEs, it is useful because staff often receive payment redirection messages, fake supplier calls and urgent instructions through mobile channels before the fraud reaches email or accounting systems. For educators and family members, it gives a practical tool to teach a simple habit: check first, act later.
How This Scam Works in Singapore
ScamShield does not stop every scam because scams are not only technical attacks. Most are social-engineering operations. The scammer's goal is to move the victim from normal judgement into urgency, secrecy and compliance. The app helps at the earliest points of contact, but the human decision still matters.
Many Singapore scam journeys start with an unknown phone number, an SMS, a messaging-app note, a link, or a screenshot that looks official. A victim might receive a message claiming to be from a bank, SingPost, LTA, a delivery firm, a government agency, a recruiter or a platform seller. In other cases, the first contact is a call from someone claiming to be a police officer, MAS officer, telco staff member, buyer, property agent or business partner. Scammers may then push the target to click a link, download an app, reveal credentials, share a one-time password, increase transfer limits, move money to a so-called safe account, or make repeated PayNow or bank transfers.
The ScamShield app helps by letting users check suspicious numbers, messages and links. The official ScamShield guidance says the enhanced app uses an AI-powered checker and can assess submitted numbers, messages or links, including message screenshots from SMS, WhatsApp and Telegram. If something appears to be a scam, the app can also route relevant information to authorities for action.
The app also filters incoming calls and SMSes from unknown numbers. ScamShield says it uses a combination of on-device algorithms and information provided by SPF, including blacklisted numbers linked to scams, to decide whether a call or SMS is likely to be a scam. On iOS, scam SMSes may be moved to a junk SMS folder. On Android, the user may receive a notification when a scam message is detected. The app can also work silently in the background to block scam calls.
There are limits. ScamShield does not filter calls and SMSes from contacts saved on your phone, for privacy reasons. That matters because fake friend call scams and account-takeover scams may involve a familiar name or a number that appears to belong to someone you know. The app also cannot judge the full context of a business transaction, a property rental, an investment offer, a supplier invoice or a family emergency. It can flag suspicious signals, but it cannot replace a second-channel verification call, a bank freeze, a police report or a company approval workflow.
Real-World Impact and Statistics
The case for using ScamShield is strongest when viewed against Singapore's scam losses. SPF's Annual Scam and Cybercrime Brief 2025 reported that overall funds lost to scams fell from S$1.1 billion in 2024 to S$913.1 million in 2025, but the median loss per case rose from S$1,389 to S$1,644. SPF's Police Life summary also noted that the top scam types by total amount lost included investment scams, government official impersonation scams, job scams, phishing scams and business email compromise scams.
This means the national picture improved in headline numbers, but individual victims still face painful losses. A person who treats ScamShield as a first-check habit may avoid entering credentials into a phishing site. A small business employee who checks an unfamiliar payment redirection message before approving an invoice may prevent a business email compromise loss. A senior who checks an urgent call or message before transferring money may avoid a government official impersonation scam.
The official ScamShield site highlights the scale of government official impersonation scam losses, including S$242.9 million lost in 2025. That category is especially relevant because impersonation scams often rely on calls, in-app calls and messages that pressure victims to transfer money or disclose credentials. ScamShield's own advice is clear: government officials will not ask members of the public to transfer money or disclose bank login details over a phone call.
The Anti-Scam Command and banking sector remain crucial once money is at risk. Published SPF summaries for 2025 reported that the Anti-Scam Command recovered S$140.5 million and averted further losses. But recovery is never guaranteed. The faster a victim acts, the better the chance of freezing funds, and that is why prevention tools, scam checking, bank kill switches and helpline escalation need to work together.
For SMEs, the cost of a scam is not only the transfer amount. A successful scam can expose customer data, vendor records, payroll details, invoices, device access and login credentials. Depending on the facts, organisations may also need to consider obligations under the Personal Data Protection Act (PDPA), internal incident reporting, cybersecurity remediation and possible offences under the Computer Misuse Act if malware, unauthorised access or compromised systems are involved.
How to Protect Yourself
Install and set up ScamShield on the phones used for personal and business communications. For families, prioritise seniors, young adults searching for jobs, helpers, and anyone who handles payments or online purchases. For SMEs, include directors, finance staff, customer service staff, sales staff, operations managers and anyone authorised to approve payments.
Use the app as a checking habit, not only as a background filter. When a message asks you to click a link, call a number, make payment, download an app, share Singpass information, reveal bank details, provide an OTP or keep the matter secret, pause and check the number, message or link in ScamShield. The most valuable moment is before the first click or transfer.
Treat app results as one signal. If ScamShield flags the contact as suspicious, stop the interaction. If it does not flag the contact but money or credentials are involved, verify through an official channel anyway. Go to the organisation's official website or app yourself. Do not use phone numbers or links supplied in the suspicious message. For banks, use the number on the back of your card or inside the official banking app. For government agencies, check the official gov.sg source.
Keep device hygiene tight. CSA Singapore's public advice pairs ScamShield with anti-virus protection because phone-based scams can lead to malware installation. Do not sideload Android apps from links in messages. Keep your operating system and apps updated. Review app permissions, especially accessibility access, notification access and screen-sharing permissions. A scammer who gets you to install a malicious app may bypass your ability to think clearly by watching your screen or controlling your device.
Set up banking safeguards before you need them. Use lower daily transfer limits for accounts used by seniors or staff. Enable transaction notifications. Know where your bank's kill switch is. Separate savings from spending accounts. SMEs should require dual approval for new payees, supplier bank-account changes and urgent transfers, even when the instruction appears to come from a director or long-term vendor.
Teach the "three red flags" rule: urgency, secrecy and money movement. If a caller says the matter is confidential, urgent and requires immediate payment or account access, it deserves verification. That rule works across government impersonation, investment scams, job scams, fake friend calls, malware scams and business email compromise.
What to Do If You Are Targeted
If you are unsure whether something is a scam, call the 24/7 ScamShield Helpline at 1799 before acting. That is the official route for checking suspicious situations, especially when the message or caller is pressuring you to move quickly.
If you have already transferred money, contact your bank immediately and activate the bank's emergency lock, kill switch or fraud hotline. Do this before arguing with the scammer or collecting perfect evidence. Time matters because funds can be moved through multiple accounts very quickly.
Next, lodge a police report through SPF's e-services or at a Neighbourhood Police Centre. Preserve screenshots, phone numbers, bank transaction references, PayNow details, URLs, chat handles, email headers and any instructions received. Do not delete the messages even if they are embarrassing. Evidence helps investigators, banks and platforms connect cases.
If you installed an app or gave remote access, disconnect the device from the internet, stop using it for banking, and seek technical help. Change passwords from a clean device. Revoke suspicious app permissions. Inform your bank that the device may be compromised. If Singpass may be affected, contact Singpass support and follow official recovery steps.
If your SME is targeted, treat it as a business incident. Freeze payments to the suspicious recipient. Alert finance, management and IT. Check whether any email account, messaging account or endpoint was compromised. If personal data may have been exposed, assess whether PDPA breach notification obligations are triggered. Update your payment control process after the incident; a scam attempt is a warning that the current workflow may be too easy to exploit.
Common Mistakes to Avoid
The first mistake is assuming ScamShield will catch everything. It will not. New numbers, newly registered domains, compromised accounts and familiar contacts may not be blocked immediately. A clean result should never be treated as permission to transfer money without verification.
The second mistake is trusting saved contacts. ScamShield's privacy design means it does not filter calls and SMSes from saved contacts. If someone says they changed number, lost access, need urgent help, or wants a temporary loan, call the person through an older known number or another trusted channel.
The third mistake is checking after you act. ScamShield is most useful before clicking, downloading, replying or paying. Once credentials or funds are given away, the response shifts from prevention to containment.
The fourth mistake is using search results to find help in a panic. Scammers buy ads and build fake support pages. Use official apps, official websites, bank cards, SPF e-services and the ScamShield Helpline at 1799.
The fifth mistake is making scam prevention a personal responsibility only. SMEs need policies, not just awareness posters. A finance executive under pressure from a fake CEO call should have a rule to rely on: no new payee, urgent transfer or bank-account change without independent approval.
FAQ
Is the ScamShield app enough to protect me from scams in Singapore?
No. ScamShield is an important first layer for filtering and checking suspicious calls, messages and links, but it should be used with bank safeguards, official-channel verification, device updates, anti-virus protection and quick reporting. Scams often depend on persuasion, not only malicious technology.
What can I check in the ScamShield app?
The enhanced ScamShield app can check suspicious calls, websites and messages, including SMS, WhatsApp and Telegram message screenshots. It can help identify whether something looks like a scam and may automatically report relevant scam information to authorities.
Does ScamShield block all scam calls and SMSes?
No filter blocks everything. ScamShield filters incoming calls and SMSes from unknown numbers using on-device algorithms and SPF-linked information such as blacklisted numbers. It does not filter calls and SMSes from contacts saved on your phone, and new scam infrastructure may appear before it is widely reported.
Should SMEs ask staff to install ScamShield?
SMEs should strongly encourage staff who handle payments, customer enquiries, procurement, HR or management communications to install and use ScamShield. It should sit beside company controls such as dual authorisation, vendor callback checks, low transfer limits and incident escalation rules.
What should I do if ScamShield says a message may be a scam?
Stop responding, do not click links, do not download apps and do not transfer money. Report through the app where appropriate, verify only through official channels, and call 1799 if you are unsure. If money or credentials were already given, contact your bank immediately and lodge a police report.
How does ScamShield relate to MAS, SPF and CSA guidance?
ScamShield is tied to Singapore's official anti-scam ecosystem. SPF provides law enforcement and scam intelligence, CSA promotes cyber hygiene such as phishing awareness and safer devices, and MAS-regulated banks provide controls such as fraud hotlines, transaction alerts and emergency account locking. The strongest defence uses all of them.
Conclusion
ScamShield is not just another app to install and forget. Used properly, it changes the rhythm of a scam attempt: instead of reacting to urgency, the user pauses, checks and verifies. That pause is often the difference between a suspicious message and a completed transfer.
For Singapore residents, the practical rule is simple: install ScamShield, use it before you act, and call 1799 when unsure. For SMEs, make ScamShield part of a wider control system that includes staff training, payment verification, bank safeguards and incident response. Scammers only need one rushed decision. Your defence should make that decision slower, more visible and easier to challenge.