In this guide · 8 sections
- 01How event ticket scams work in Singapore
- 02One official ticket link, said everywhere
- 03Secure and verify your social accounts
- 04Protect your confirmation emails with SPF, DKIM and DMARC
- 05Transfer and resale policy
- 06Reporting fake listings and impersonating pages
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Publish one official ticket link everywhere, say plainly that tickets bought elsewhere may be refused, secure and verify your social accounts, protect confirmation emails with SPF, DKIM and DMARC, set a clear transfer and resale policy, and report fake listings quickly, pointing fans to ScamShield.
How event ticket scams work in Singapore
The Police's June 2026 advisory on concert ticket scams describes the pattern. Victims see offers on messaging or social platforms such as Telegram, Carousell, X, Xiaohongshu and Facebook. Scammers send screenshots or videos of fake tickets or receipts, rush the victim to pay because the offer is time-limited, then either disappear or claim the payment never arrived and ask for more.
A later advisory in August 2026 noted at least five cases with losses of at least S$3,500 for one concert before general sales had even opened, with payments made by bank transfer or PayNow. The police said it had asked Carousell to remove resale listings, and that Facebook Marketplace's commerce policies do not allow the buying, selling or trading of event tickets.
| Scam type | What fans see | What organisers can do |
|---|---|---|
| Fake resale tickets | Cheap or sold-out tickets on Carousell, Telegram or X | State the only official seller; warn that resale tickets may be refused |
| Ticket-buying services | Offers to queue or buy on the fan's behalf for a fee | Explain how the real queue works and that no one can skip it |
| Fake organiser pages | Lookalike Facebook or Instagram page selling tickets | Verify your accounts and report impersonators quickly |
| Fake confirmation emails | Emails that look like they come from you or your ticketing partner | Authenticate your domain with SPF, DKIM and DMARC |
| Phishing links | Lookalike ticket sites asking for card details | Use one memorable URL and publish it everywhere |
One official ticket link, said everywhere
Every police advisory tells the public to buy only from authorised platforms. Fans can only do that if you tell them clearly which platform that is.
Pick one official sales channel
Your own site or a named ticketing partner. If you use several partners, list every one of them on a single page.
Use a short, memorable URL on your own domain
For example yourevent.sg/tickets that redirects to the ticketing page. Fans can type it instead of clicking links in messages.
Repeat it on every channel
Website banner, social bios and pinned posts, confirmation emails and press releases should all show the same link.
Say what is not official
State plainly that tickets bought from unofficial resellers or social media sellers may be refused at entry, and that you will never sell tickets through direct messages.
Explain the queue
If sales use a virtual queue, explain how it works and that no service can guarantee a place in it.
Our guide to event registration sites and ticketing covers ticket tiers, GST-inclusive pricing and refund terms for the official channel.
Protect your confirmation emails with SPF, DKIM and DMARC
Fans expect a confirmation email after buying. Scammers send fake ones to make a fraudulent sale look real, or to phish card details. Email authentication makes it much harder for anyone to send email that passes as your domain.
- SPF lists the services allowed to send email for your domain, such as your mail provider and ticketing platform.
- DKIM signs each email so receiving servers can check it was not altered.
- DMARC tells receiving servers what to do with email that fails those checks. At p=quarantine or p=reject, spoofed email is sent to spam or blocked.
Make sure your ticketing partner's sending service is included in SPF and signs with DKIM for your domain, or sends from its own authenticated domain that you name to fans. Our guide to SPF, DKIM and DMARC walks through the records.
Transfer and resale policy
A clear policy reduces both scams and genuine disputes. Decide before sales open and publish it on the ticket page.
Policies that help fans
- Official transfer or resale feature inside the ticketing platform
- Name on ticket checked at entry for high-demand events
- Tickets issued only in the official app or account, not as PDFs by email
- Clear statement that resale outside the official channel may be refused
Policies that leave gaps
- No legitimate way to pass on a ticket, which pushes fans to unofficial sellers
- PDF tickets that can be copied and sold several times
- Silent on resale, so fans assume it is allowed
- Policy changed after tickets are sold
The June advisory pointed to Ticketmaster's terms for one tour, which said tickets could not be transferred or resold and that holders of resale tickets would be turned away without refund. Whatever your rules are, apply them consistently and say them before purchase.
Reporting fake listings and impersonating pages
Capture evidence
Screenshot the listing, the seller's profile and URL, payment details if shown, and the date. Ask fans who report scams to send screenshots too.
Report to the platform
Use the report option on Carousell, Telegram, X, Facebook or Instagram. Ask staff to report the same listing. Our guide on fake social media ads impersonating your business covers Meta's impersonation and trademark routes.
Report phishing sites
Send fake ticket websites to SingCERT and to the domain's registrar or host.
Tell the police
Lodge a report if fans have lost money using your event's name, so cases can be linked. Point victims to their bank and to a police report.
Warn your audience
Post a short warning with the official link, and point fans to the ScamShield helpline 1799 or ScamShield app to check suspicious offers.
The government's ScamShield site and helpline let the public check and report suspected scams. Linking to it from your ticket page costs nothing and gives worried fans somewhere to go.
Do it yourself or get help?
The official link, the resale policy and the warning posts are content decisions your team can make today. The technical parts, domain email authentication and account security, are where a little help goes a long way before a big on-sale.
Our Emails Land in Spam Fix (S$249) sets up SPF, DKIM and DMARC for every service sending as your domain and moves DMARC to enforcement safely. Website Security Hardening (S$290) locks down the site hosting your ticket page, and Security Awareness Training (S$390) gives staff short lessons on Singapore scams, including fake payment and impersonation tricks.
Frequently asked questions
According to 2026 police advisories, scammers post fake ticket offers on platforms such as Telegram, Carousell, X, Xiaohongshu and Facebook, send screenshots of fake tickets or receipts, and pressure buyers to pay quickly by bank transfer or PayNow. They then disappear, or claim payment was not received and ask for more.
Name one official sales channel and repeat the link everywhere, warn that tickets from unofficial resellers may be refused, verify and secure your social accounts, authenticate your email domain with SPF, DKIM and DMARC, offer an official transfer option, and report fake listings and pages quickly.
The Singapore Police Force said in 2026 advisories that, in line with Meta's commerce policies, Facebook Marketplace does not allow content promoting the buying, selling or trading of event tickets. Police also asked Carousell to remove resale listings for high-demand concerts.
DMARC tells receiving email servers to quarantine or reject messages that claim to come from your domain but fail SPF and DKIM checks. At enforcement, it becomes much harder for scammers to send fake confirmation or payment emails that appear to come from your organisation.
Fans who lost money should contact their bank immediately and lodge a police report. They can check suspicious offers with the ScamShield helpline on 1799 or the ScamShield app, and report fake listings to the platform. Organisers should also report impersonating pages and phishing sites.