Your social media feed is a comfortable, familiar place, which is exactly why scammers love it. When a message comes from a friend’s account or a page you follow, your guard drops. Learning to recognise social media scams in Singapore means understanding that a trusted name at the top of a message does not guarantee a trusted person is typing it. Once you know the common patterns, the warning signs become obvious, and you can protect both yourself and the friends in your contact list.
The Most Common Social Media Scams
Scams on platforms like Facebook, Instagram, WhatsApp, and Telegram tend to fall into a few recognisable shapes.
The hacked-friend message. You get a note from someone you know, often out of the blue, asking for a favour. It might be “Can you help me receive an OTP, I’m locked out” or “Are you free to PayNow me, I’ll pay you back tonight”. The account is real but the person controlling it is not. The moment a friend asks you to share a verification code or send money urgently, stop and verify through a different channel, such as a phone call.
Impersonation and cloned profiles. A scammer copies a friend’s photo and name, creates a new account, and adds you. Then they strike up a chat and steer it towards money, a “sure-win” investment, or a request for personal details. A quick check of the friend count and post history usually reveals a near-empty fake.
Fake giveaways and prizes. “Congratulations, you have won an iPhone, just pay the delivery fee” or a page offering luxury goods at absurd discounts. Real giveaways never ask you to pay a fee to release a prize, and never ask for your banking login or OTP.
Investment and job lures. Attractive strangers or professional-looking pages promise easy income, part-time “likes” jobs, or guaranteed trading returns. These often overlap with recognising job scams and fake offers and romance scams, and the ask always ends at your wallet.
Phishing links. A message claims your account will be suspended, or that someone tagged you in a shocking photo, with a link to “log in and check”. The link leads to a fake login page that harvests your password.
Warning Signs and How to Respond
Across all of these, the red flags rhyme. Be alert when a message carries urgency (“do this now or lose access”), secrecy (“don’t tell anyone”), or an unusual payment request. Be suspicious of any link asking you to log in, and of any request for a one-time password.
Here is the rule that keeps you safe: never share OTPs, passwords, banking logins, or Singpass details with anyone, full stop. Banks and government agencies never ask for these, and neither does a genuine friend. A one-time password exists to prove it is you, so handing it over hands over your account. If someone pressures you to “verify” yourself or install an app so they can help, it is a scam.
When you suspect a scam, do not engage further. Take a screenshot, report the account or message to the platform, and block it. If money has changed hands or you have shared sensitive details, report it to ScamShield through the app and helpline, and to the Police. Our guide to using ScamShield and Singapore’s anti-scam tools explains what those tools can and cannot do.
Locking Down Your Own Accounts
Protecting yourself is only half the job. If your account is hijacked, the scammer uses your trust to reach everyone you know, so securing your own login protects your whole circle.
The single most effective step is turning on two-factor authentication (2FA). This adds a second check beyond your password, so even a stolen password is not enough to get in. An authenticator app or a passkey is stronger than SMS codes. Our two-factor authentication guide walks through the setup.
A few more habits make a real difference:
- Use a long, unique password for each social account, ideally stored in a password manager.
- Review the list of devices and apps connected to your account, and remove anything unfamiliar.
- Be careful which third-party apps you grant access to your profile.
- Keep your recovery email and phone number up to date, so you can regain access if something goes wrong.
If an account is already compromised, act quickly. Change the password, sign out all devices, and follow the platform’s recovery flow. Recovering a hacked account covers the steps in order.
A Practical Wrap-Up
Social media scams work by borrowing trust, whether from a friend’s face, a familiar logo, or the thrill of a prize. Slow down when a message feels urgent or unusual, verify requests through a separate channel, and never share codes or passwords. Then lock your own accounts with strong passwords and 2FA so a scammer cannot turn your good name against the people you care about. A little healthy suspicion, applied consistently, is the best protection there is.