WhatsApp impersonation scams in Singapore involve scammers who hijack or spoof WhatsApp accounts to pose as trusted contacts, such as friends, family, colleagues, or senior executives, and deceive victims into transferring money or sharing sensitive information. Since January 2025, these scams have caused at least $13.5 million in corporate losses and $46,000 from compromised personal accounts in 2026 alone. The Singapore Police Force (SPF) urges all WhatsApp users to never share one-time passwords (OTPs) and to verify unusual money requests through a separate communication channel.
Introduction
WhatsApp is the messaging backbone of daily communication in Singapore. From coordinating family dinners to closing multi-million-dollar corporate transactions, the platform is deeply embedded in how Singaporeans live and work. That trust is precisely what scammers exploit.
WhatsApp impersonation scams have emerged as one of the most damaging fraud categories in Singapore, combining social engineering sophistication with the speed and intimacy of instant messaging. In 2024, messaging platforms including WhatsApp were among the top two channels exploited by scammers nationwide, contributing to 51,501 reported scam cases and over $1.1 billion in losses. While overall scam cases fell 27.6% in 2025, impersonation attacks on WhatsApp continued to evolve, targeting ordinary users, young professionals, and corporate finance teams alike.
This article breaks down exactly how these scams work, who is most at risk, and what you can do right now to protect yourself and your organisation.
How WhatsApp Impersonation Scams Work
OTP Hijacking: The Entry Point
The most common method begins with a deceptively simple trick. A scammer enters your mobile number into WhatsApp's login process, which triggers a legitimate one-time password (OTP) SMS from WhatsApp to your phone. Moments later, you receive a WhatsApp message from a friend or colleague whose account has already been compromised. The message says something like: "Hey, sorry, I accidentally registered your number for WhatsApp. Can you send me the OTP code that was sent to you?"
That message is the trap. The OTP was sent to you because the scammer initiated the login and forwarding it gives them full access to your WhatsApp account. Once inside, they lock you out and begin impersonating you to your entire contact list.
Since 1 April 2026, SPF recorded at least 52 such cases, with total losses of at least $46,000. Some victims reported a cascade effect, one compromised account was used to solicit OTPs from the victim's own contacts, which led to further account takeovers and additional losses of up to $3,000 across multiple people in a single chain.
Impersonation of Friends and Family
With control of a hijacked account, scammers impersonate the account owner and send messages to their contacts. The most frequent scam script involves an urgent request for financial help. The message typically cites an emergency, for instance a hospital bill, an urgent loan, or a financial shortfall, and asks the recipient to transfer money via PayNow QR code or bank transfer.
Because the message comes from a trusted contact's actual WhatsApp account, victims rarely question its authenticity. They only realise they have been deceived when they verify through a phone call or in-person conversation, often after the money has already been transferred and the scammer has disappeared.
Corporate Executive Impersonation
The most financially devastating variant targets Singapore businesses. Since January 2025, at least 10 cases of this scam type have been reported, with total losses amounting to at least $13.5 million.
In these attacks, scammers create WhatsApp accounts using the names and publicly available photos of a company's CEO, managing director, or senior supervisor. They then contact employees, often those in finance, accounts, or junior positions, while impersonating the executive.
The social engineering is meticulous. Victims are instructed to join video calls on Zoom where scammers use digitally altered appearances to further impersonate company leadership, investors, or even officials from the Monetary Authority of Singapore (MAS). Employees are told they have been selected for a "confidential project" and are made to sign non-disclosure agreements, preventing them from checking with colleagues. They are then asked to provide company bank account balances and transfer funds to external accounts for the supposed project.
The ruse collapses only when the employee eventually checks with the actual executive, often after the funds have been irrecoverably transferred.
The Scale of the Problem in Singapore
To understand why WhatsApp impersonation demands serious attention, consider the broader scam landscape in Singapore:
- 2024: 51,501 scam cases reported, with losses exceeding a record high of $1.1 billion. Messaging platforms (WhatsApp and Telegram) were the top two channels exploited by scammers.
- 2025: Scam cases fell to 37,308 (down 27.6%), with losses of $913.1 million (down 17.9%). However, scammers continued to refine impersonation tactics on WhatsApp.
- 2026 (as of May): At least 52 social media impersonation cases from compromised WhatsApp accounts resulted in $46,000 in losses. Executive impersonation scams since January 2025 caused $13.5 million in corporate losses.
- Adults aged 30 to 49 accounted for 36.1% of all scam victims in 2025, frequently targeted through messaging platforms. Young adults (20 to 29) were likewise heavily affected through WhatsApp.
- The Anti-Scam Command (ASCom) recovered approximately $140.5 million and prevented at least $348 million in potential losses in 2025, but self-effected transfers accounted for 81.8% of reported scam cases, meaning most victims sent money directly to scammers before any intervention was possible.
- Government official impersonation scams involving WhatsApp calls were also on the rise, with at least 61 cases and over $4.1 million in losses since July 2025.
Who Is Most at Risk
WhatsApp impersonation scams do not discriminate, but certain groups face elevated risk:
Employees in finance or accounting roles are prime targets for executive impersonation scams. Junior staff, interns, and new employees who are less likely to personally know senior leadership are especially vulnerable.
Active WhatsApp users with large contact lists are valuable targets for account hijacking. Each compromised account gives scammers access to dozens or hundreds of potential secondary victims.
Singapore SMEs that rely on informal messaging for business communications rather than verified corporate channels face particular exposure. Companies that conduct financial transactions or share sensitive data over WhatsApp without verification protocols are effectively leaving the door open.
Older adults and less digitally savvy users may be more likely to comply with OTP requests from seemingly trusted contacts, not understanding that sharing an OTP gives away account access entirely.
Practical Steps for Scam Prevention
For Individual Users
-
Never share your WhatsApp OTP with anyone. WhatsApp will never ask you to share your OTP. If someone asks for it, it is a scammer, even if the message appears to come from a friend.
-
Enable Two-Step Verification on WhatsApp. Go to Settings > Account > Two-step verification > Enable. This adds a PIN that is required when registering your phone number with WhatsApp, making it significantly harder for scammers to hijack your account.
-
Verifymoney requests through a separate channel. If a contact sends an urgent request for money via WhatsApp, call them on the phone or message them on a different platform before sending anything. Scammers can hijack accounts, but they cannot easily impersonate a voice.
-
Turn on "Silence unknown callers" in WhatsApp. Go to Settings > Privacy > Calls > Silence unknown callers. This blocks unsolicited WhatsApp calls from numbers not in your contacts.
-
Check and remove unknown linked devices. Go to Settings > Linked Devices and remove any sessions you do not recognise. Scammers often maintain access through linked desktop sessions.
-
Install the ScamShield app. Available on iOS and Android, ScamShield helps identify scam calls and messages and is an additive layer of defence developed by the Singapore government.
-
Keep WhatsApp updated. Security patches and new features are released regularly. Running an outdated version exposes you to known vulnerabilities that scammers exploit.
For Businesses and SMEs
-
Brief all employees, especially new hires and interns, on WhatsApp Executive Impersonation scams. Ensure every staff member knows that senior leaders will never request fund transfers exclusively through WhatsApp messages.
-
Establish a dual-verification protocol for all financial transactions. Any instruction to transfer company funds, especially large amounts, must be verified through a second, independent channel (e.g., a phone call to the known internal number, or an in-person confirmation) before execution.
-
Use official communication channels for work-related matters. Company emails and enterprise communication tools (e.g., Microsoft Teams, Slack with proper identity verification) should be the standard for business instructions, not WhatsApp.
-
Flag non-standard requests immediately. Train employees to treat any out-of-the-ordinary instruction, confidentiality demands, urgency pressure, NDAs before fund transfers as potential red flags.
-
Report incidents to SPF immediately. Early reporting increases the chance of fund recovery. Call the Anti-Scam Helpline at 1799 or file a report at www.police.gov.sg/e-services/report/report-a-crime.
Common Mistakes to Avoid
Sharing your OTP because the request "seemed innocent." Scammers deliberately use casual, low-pressure language to make the request feel harmless. That "accidentally sent to you" message is designed to exploit your helpful instinct. It is always a scam.
Assuming a message from a friend's account means it is really your friend. A compromised WhatsApp account means a scammer is on the other end. The profile photo, chat history, and tone of conversation can all remain unchanged after a takeover.
Responding to urgency with immediate action. Scammers manufacture urgency specifically to override your critical thinking. Any request that pressures you to act quickly without verification, whether it involves money, OTPs, or personal information, should trigger caution, not compliance.
Not enabling Two-Step Verification because it seems like a hassle. Adding a simple PIN takes less than a minute and is the single most effective step to prevent account hijacking. Without it, your entire WhatsApp identity is protected only by the OTP, which a skilled social engineer can extract from you in a single message.
Transferring company funds based solely on WhatsApp messages. No CEO, CFO, or board member should ever authorise corporate payments exclusively through an instant messaging platform. If it happens, stop and verify.
Internal Linking Opportunities
- Business Email Compromise: How Invoice Scams Target Singapore SMEs
- Invoice Scam Red Flags Every Singapore Business Should Know
- Job Scams in Singapore: How to Spot Fake Employment Offers
- Phishing Scams Singapore: A Complete Guide to Protection
- How Singapore SMEs Can Build a Culture of Cybersecurity
Frequently Asked Questions
How do scammers hijack a WhatsApp account?
Scammers hijack WhatsApp accounts through OTP (one-time password) manipulation. They enter your phone number into WhatsApp's login process, which sends you a verification code via SMS. They then contact you, often through a compromised friend's account, and ask you to forward the OTP, claiming it was sent to you by mistake. Once you share the code, they gain full access to your account. Enabling Two-Step Verification adds a required PIN layer that prevents this attack entirely.
What should I do if my WhatsApp account has been compromised?
If you lose access to your WhatsApp account, attempt to recover it immediately. Open WhatsApp, tap "Log back in," enter your phone number, and complete the verification process using the OTP sent to your device. Then immediately enable Two-Step Verification under Settings > Account > Two-step verification. Check Settings > Linked Devices and remove any unrecognised sessions. Finally, notify your contacts that your account was compromised so they can ignore any scam messages sent from your account during the takeover period.
How can I tell if a WhatsApp message is from a scammer?
Key warning signs include: urgent requests for money, requests to share OTPs or verification codes, instructions to keep communications secret or confidential, unusual account behaviour from a known contact, and requests to transfer funds via PayNow or bank transfer citing emergencies. The most reliable verification method is to contact the person through a different channel a phone call, a separate messaging app, or in person, before taking any action requested in a WhatsApp message.
Are businesses in Singapore particularly at risk of WhatsApp impersonation scams?
Yes. Since January 2025, at least 10 reported cases of senior executive impersonation on WhatsApp have resulted in losses of at least $13.5 million for Singapore businesses. Companies that use WhatsApp for business communication without formal verification protocols are especially vulnerable. SMEs should implement dual-verification procedures for all financial transactions and ensure employees are trained to recognise impersonation attempts. Any request to transfer company funds must be confirmed through an independent channel before proceeding.
What is the Singapore government doing to combat WhatsApp scams?
The Singapore Police Force operates the Anti-Scam Command (ASCom), which recovered approximately $140.5 million in scam losses and prevented at least $348 million in potential losses in 2025. The ScamShield app, developed by the Government Technology Agency (GovTech) and the National Crime Prevention Council (NCPC), helps block scam calls and filter scam messages. CSA Singapore regularly issues cybersecurity advisories. SPF continues to issue public advisories and operates the 24/7 Anti-Scam Helpline (1800-722-6688) for reporting and enquiries.
How do I report a WhatsApp impersonation scam in Singapore?
Report scam encounters to the Singapore Police Force by calling the Anti-Scam Helpline at 1800-722-6688 (available 24/7) or file an online report at www.police.gov.sg. You can also call 999 for emergencies. Provide all relevant details including screenshots of conversations, transaction records, bank account numbers or PayNow identifiers used by the scammer, and a timeline of events. Early reporting improves the chances of fund recovery.
Conclusion
WhatsApp impersonation scams thrive on the tension between trust and urgency. Scammers weaponise the relationships we maintain through instant messaging and exploit the natural human impulse to help people we know. In Singapore, where WhatsApp is deeply woven into both personal and professional life, the threat is especially acute.
The defences are clear and actionable: never share your OTP, enable Two-Step Verification, verify all unusual requests through a separate channel, and establish formal financial verification protocols at work. The Singapore Police Force, ScamShield, and CSA Singapore provide robust support infrastructure, but the first and most important line of defence is an informed, sceptical user.
Fighting scams is a community effort. Share this article with your colleagues, your family, and your WhatsApp contacts. The more people understand how these scams work, the harder it becomes for scammers to succeed.
Stay safe. Stay sceptical. ACT Against Scams.