Fake Ads Using Your Brand? What Singapore Businesses Can Do

What the October 2026 police advisory says

In its advisory of 2 October 2026, the SPF described ads on Facebook, Instagram and TikTok offering cheap household products, food and fashion. Clicking the ad led to a phishing website that asked for card details or internet banking logins, and sometimes for one-time passwords. Victims found out when unauthorised charges appeared.

The advisory is aimed at consumers, but the ads work because they look like real shops. A small business with an attractive product range, good photos and a known name is an easy template to copy. The same pattern shows up in the SPF's mid-year figures: Meta's three platforms accounted for 34.1% of scam cases by platform in the first half of 2026 (see our 1H 2026 scam statistics summary).

Report fake ads and pages to Meta, step by step

There are two routes on Facebook and Instagram. In-app reports work for anyone. Intellectual property reports carry more weight but need a trademark.

1. 1

   Capture evidence first

   Screenshot the ad, the page or account behind it, the landing website and its URL. Note the page URL and the date. Search the Meta Ad Library for your business name to find other ads from the same page.

2. 2

   Report the ad in the app

   Tap the three dots on the ad, choose report, and pick the scam or fraud option. Ask staff and regular customers to report the same ad too, so it reaches Meta's reviewers through several reports.

3. 3

   Report the fake page or account

   Open the page, use the three-dot menu, and report it as pretending to be a business. On Instagram, use the account's report option for impersonation.

4. 4

   File a trademark report if you own a mark

   Meta's trademark help page links to the trademark report form. You need your registration details and the exact URLs of the ads or pages. Copied photos can also go through the copyright form.

5. 5

   Apply for Brand Rights Protection if it keeps happening

   Brand Rights Protection lets approved brands search for and report impersonation, counterfeit and trademark misuse across ads, pages, Shops and posts from Meta Business Suite. It requires a registered trademark.

6. 6

   Report the phishing website

   Send the URL to SingCERT via Cyber Aid, and to the domain's registrar or host. Check suspicious links with ScamShield on 1799.

Meta does not publish a fixed turnaround time for these reports. Keep a log of report dates and reference numbers so you can follow up or show the police.

Why a registered trademark helps

Meta's IP reporting forms and Brand Rights Protection are built around registered trademarks. Without one, you rely on the general impersonation and scam reports, which can be slower and less certain. In Singapore, trade marks are registered with the Intellectual Property Office of Singapore (IPOS).

A business registration with ACRA is not the same thing as a trade mark. Meta's own trademark help explains the difference. If your brand is the main reason customers buy from you, a trade mark registration is worth discussing with an IP agent or lawyer. This is general information, not legal advice.

Tell customers which pages are really yours

Takedowns take time, and new fakes appear. The fastest protection is making it obvious what the real thing looks like.

If your own page or WhatsApp number has been taken over rather than copied, the steps are different. Our guide to a hacked business WhatsApp, Facebook or Instagram covers account recovery and admin hygiene.

Watch for lookalike websites and domains

Most scam ads send people to a website. These are often registered on a domain that looks like yours with an extra word, a hyphen or a different ending.

• Register the obvious variants of your domain, such as .sg and .com.sg, so they cannot be used against you. Our .sg vs .com.sg guide explains the differences.
• Search your brand name once a month on Google and in the Meta Ad Library.
• Set up a free Google Alert for your business name.
• Publish SPF, DKIM and DMARC records so scammers cannot easily send email that appears to come from your real domain. See emails going to spam: SPF, DKIM and DMARC.
• Keep every domain on auto-renew, in an account your business owns.

What changes for platforms in 2026 and 2027

On 17 August 2026, the SPF's Online Criminal Harms Act office issued new Codes of Practice for social media, messaging and e-commerce services. The ones that matter for scam ads:

Separately, a January 2026 Implementation Directive requires Meta to use facial recognition and prioritise Singapore user reports against ads and pages impersonating people at high risk, including people who have filed police reports. If you run ads yourself, expect stricter identity checks on your ad account before January 2027, so make sure it is owned by your business and not your agency.

Do it yourself or get help?

Reporting ads, pinning an official-channels post and searching the Ad Library are all things an owner can do in an hour. The harder parts are proving ownership of pages, cleaning up admin access and stopping lookalike domains.

Hacked Email Recovery (S$290) secures a taken-over account and removes unknown admins and access. Domain & DNS Setup (S$99) moves your domains into an account you control, sets auto-renew and adds SPF, DKIM and DMARC so your real email is easier to trust.