By Alexander Joseph Woon Wei-Ming, Provost’s Chair and Lecturer for the Law Programmes at Singapore University of Social Sciences (SUSS) School of Law

Singapore is generally considered a safe society, but as the Singapore Police Force (SPF) likes to remind us, “low crime doesn’t mean no crime”. Nowhere is this more apparent than with scams. Although physical crime in Singapore has remained mostly stable, with relatively low volumes, there has been over the past decade an enormous growth in cybercrime, particularly scams. Indeed, since 2022, the SPF has released the numbers on cybercrimes and scams separately from the statistics on physical crime.

To give a snapshot of the situation, in the first half of 2025, the SPF handled 22,476 cases classified as scams and cybercrime; scams accounted for 87.5% of these cases. In contrast, the SPF handled only 10,341 physical crimes within the same period.

It is therefore no surprise that scams are a top law enforcement concern in Singapore. A key challenge is that scams are not susceptible to the same solutions traditionally deployed to combat physical crime. To understand why, we need to begin by understanding scams as part of an ecosystem, rather than as isolated instances of criminal conduct.

The cheating ecosystem

The first, most obvious, response to scams is to ask why they are not simply made a crime. The answer is that scams already are criminal: in Singapore, they are considered to be forms of cheating, which is an offence under the Penal Code 1871. Thus, if a scammer can be caught, he can be prosecuted and sent to jail, and the proceeds of the scams returned to the victim.

However, that is a very big “if”. The problem with scams in the Singapore context is that many scammers are not in Singapore. Therefore, it is, in many cases, impossible for the SPF to investigate and arrest scammers based overseas. The issue is not gaps in the law (legislative gaps) but rather with practical problems of enforcement (enforcement gaps).

The kind of scams we need to be concerned about are perpetrated by syndicates based outside of Singapore, usually somewhere in Asia. These syndicates typically employ large numbers of people to systematically target Singaporean victims. This kind of cheating can take many forms, but in general, contact is established via cold calling (over the telephone or on a social media platform), and once a suitable victim is hooked, the scammer will attempt to move the victim to a private messaging channel. Thereafter, the victim will be deceived and manipulated until they are ready to hand over money.

At this point, ancillary offences to cheating kick-in. In order to evade detection and facilitate retrieval of the proceeds of the scam, the scammers usually avoid handling the money directly. The money is passed through money mules, which can be either physical or digital. In the case of physical money mules, runners come into Singapore and typically pick up bags of cash, before exiting the country. For digital money mules, money is usually transferred into bank accounts or cryptocurrency wallets control over which has been ceded by the lawful owners to the syndicates (either in exchange for money or sometimes due to coercion). The money is then transferred through a series of accounts or wallets until it reaches the scammers, by which time it is impossible to trace. These offences are forms of money-laundering, which are criminalised under the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992.

Finally, in the process of scamming a target, scammers often harvest personal information that they subsequently use to scam the target’s friends and relatives. For example, a scammer who has compromised someone’s social media account might then target the victim’s grandparents, pretending to be the grandchild in distress (possibly kidnapped) to extract more money.

Current anti-scam responses

Singapore is taking a whole-of-government response to scams. These efforts can be classified into three major categories.

First, there are legal responses to scams. New legislation has been passed to fight scams, such as the Protection from Scams Act 2025, which gives law enforcement officers a surprisingly robust power to issue restriction orders to banks to prevent transfers or withdrawals of money by scam victims. Further, to enhance deterrence, the Sentencing Advisory Panel has issued new guidelines on scam-related offences which prescribe hefty sentences for offenders who facilitate scams by handing over the bank accounts or digital identity credentials.

Second, there are technological measures being put in place, such as the creation of the ScamShield app by GovTech, which helps to automatically detect, block and filter scams. Organisations have also been encouraged to switch to more secure methods of authentication, away from Short Message System (SMS) verification, which has been shown to be capable of spoofing.

Third, there are educational responses. There are a multiplicity of programmes run by the SPF, the Infocomm Media Development Authority (IMDA), the Cyber Security Agency (CSA) and others, sometimes in partnership with non-governmental organisations and technology providers, such as Meta and Google.

Building Inherent Digital Safety Instincts: A Systemic Approach to Scams

The problem is that no response can be, on its own, 100% effective. As noted in the Tech for Good Institute’s report on Building Resilience against Digitally-enabled Scams and Fraud, targeted interventions along the entire scam victim journey is necessary. Unlike with physical crimes, it is difficult to shut scammers down because they are not in Singapore. For the same reason, it is difficult to deter scammers because the risk of apprehension to them is low. While Singapore can target money mules, this does not solve the fundamental problem, because the scammers themselves can always recruit more mules.

Attempts to shut down scammers may be viewed as “supply side” measures: things that are done to reduce the number of scams targeted at victims in Singapore. But we also need “demand side” measures: things that make potential victims more robust towards risk in the first place.

We need more innovation on “demand side” measures, because no matter how good the “supply side” responses are, some scams will inevitably slip through. This is asymmetric warfare, in which the defenders would need to be successful 100% of the time to prevent all scams, but the attackers only need to get past once to potentially ruin someone’s life.

Education alone is not enough. Not everyone will go for an education programme and even those who do may not be able to retain and apply that knowledge effectively (since it may be a long time before they actually come face to face with a scam). It is one thing to be taught how to identify scams in a classroom setting, quite another when one encounters a scam in real life. There are people who have the knowledge, such as lawyers and law enforcement professionals, but nonetheless get scammed.

Some potential avenues for exploration include variants of “just in time” training or “pre-bunking”, in which potential victims are inoculated against scams by being regularly exposed to, and taught to identify, scam materials. For example, showing short clips discussing scams before allowing them to view a video on social media.

Following on from this, it is worth thinking about whether user design mechanisms can be used to help with combating scams. One reason why even professionals who should know better are caught by scams is because they do not always apply their professional minds to their personal business. In psychology, Daniel Kahneman popularised the idea of people having two distinct modes of thinking: system 1, which is easy and intuitive, and system 2, which is harder worker but more analytical.

Generally, people remain in “cognitive ease” in system 1, and only engage system 2 when something causes them to stop and think. While social media and e-commerce platforms tend to promote cognitive ease by reducing friction in their processes, not all friction is bad. Designers could be encouraged (or even required by law to) build in certain mechanisms for “good friction”, points at which the process of a purchase or transfer becomes deliberately inconvenient for a user to force them to think about whether they really should go through with it. In Singapore, “good friction” is already built in for some legal processes. For example, couples undergoing a divorce who have children under 21 are required to go for mandatory counselling and mediation.

The bigger point is to build a culture with inherent online safety instincts. Just like children are taught to look both ways before crossing the street in the physical world, future generations need to be taught similar digital safety heuristics. No one measure is going to solve the problem of scams. The problem of scams is itself a subset of the problem of information integrity issues, which is itself a subset of the problem of online harms. The challenge is to build a society that is not naïve, one that is actively and critically thinking at all times.