Government and CEO Impersonation Scams (2026): A Staff Protocol

What the 2026 police advisories said

The Singapore Police Force (SPF) published these advisories in 2026. Figures are as reported by the police on the date shown.

The government-official scams mostly target individuals, but your staff are individuals too, and a panicked employee is easier to push into a company payment. The CEO and senior-official variants aim squarely at businesses.

How CEO impersonation scams on WhatsApp work

According to the February advisory, scammers create a WhatsApp account with the name and a public photo of the victim's CEO or supervisor. They message a staff member about a "confidential project", ask them to sign a non-disclosure agreement so they will not check with colleagues, then ask for bank balances and transfers. In some cases the victim joined a Zoom call where the "executives", "investors" or "MAS officials" were digitally altered.

The May case shows how far this has gone. The victim received a WhatsApp message using the Secretary to the Cabinet's photo, then an email from a Proton Mail address with a fake government letter of guarantee bearing the Prime Minister's signature. A Zoom call followed in which the participants, including PM Wong, had been fabricated with deepfake technology. The victim transferred at least S$4.9 million to a corporate bank account before checking directly with the real official.

What real government officials never ask

Each police advisory repeats the same list. Print it and put it next to whoever handles payments. Singapore government officials will never:

• Ask you to transfer money, or hand over cash, gold, luxury watches or cryptocurrency
• Ask you to disclose banking login details
• Ask you to install mobile apps from unofficial app stores
• Transfer your call to the police or another government official

Official government websites end in .gov.sg. If in doubt, the 24/7 ScamShield Helpline is 1799, and the ScamShield website lets you check a suspicious number, message or link.

A verification protocol for payments and sensitive requests

The police advice to businesses is short: brief staff (especially new joiners and interns), be wary of unusual transfer requests, verify through a different medium, and keep work on official channels. Turned into rules a small team can follow, that looks like this.

1. 1

   Define what counts as a sensitive request

   Any new payee, any change to a supplier's bank details, any payment above an amount you set (for example S$5,000), any request for bank balances, payroll or customer data, and anything marked confidential or urgent.

2. 2

   Call back on a number you already had

   Verify using the phone number in your staff list, contract or the official website, never the number, email or link in the message. A WhatsApp from 'the boss' is checked by calling the boss's known mobile.

3. 3

   Require two people to approve

   One person sets up the payment and a second approves it in the bank portal. Many business banking portals offer this as "maker-checker" or dual authorisation; ask your bank how to turn it on. Nobody can approve their own request, including directors.

4. 4

   No secrecy, ever

   Make it a written rule that no one at the company will ever be asked to keep a payment secret from the finance approver. A request for secrecy is itself the red flag that triggers a check.

5. 5

   Agree a code word for urgent calls

   Directors and finance staff agree a word or question that is never written down in email or chat. If someone on a call claims to be a director and cannot answer it, end the call.

6. 6

   Keep work on official channels

   Payment instructions only come through company email or your bank portal, not personal WhatsApp. Check the sender address matches the real person, not a lookalike domain or a free email account.

Brief every new joiner on these rules in their first week. Our guide to spotting phishing emails covers the email side of the same tricks.

If money has already been sent

Speed matters more than anything else. Banks can sometimes stop or recall a transfer if they hear about it within minutes or hours.

If the scammer got into a real mailbox, follow our guide on what to do when business email is hacked, and turn on multi-factor sign-in for every account using our MFA set-up guide.

Do it yourself or get help?

You can put the protocol above in place this week: write the one-page rules, set up maker-checker approval in your bank portal and brief your team. Repeat the briefing every six months, because scam scripts change.

If you would like it done for you, our Security Awareness Training (S$390) sets up short lessons on Singapore scams, including government, WhatsApp and PayNow scams, with completion tracking. The Incident & Ransomware Response Plan (S$390) gives you a written plan with a contact sheet (bank, police, SingCERT, insurer) and a payment-fraud playbook. For blocking lookalike and spoofed emails, see Email Threat Protection (S$290).