iMessage Scams in Singapore (2026): A 5-Minute Staff Briefing

Four SPF iMessage scam advisories in August 2026

The Police published a run of warnings within three weeks. Each one describes a different story, but the delivery channel and the goal are the same: get the reader to a fake site and capture card details, banking logins or one-time passwords (OTPs).

The pattern did not stop in August. On 2 September 2026 the Police warned about iMessages impersonating DBS fraud investigators and Shopee support, with a fake hotline number in the message. For the wider numbers, see our summary of Singapore scam statistics for the first half of 2026.

Why iMessage gets past Singapore's SMS protections

Singapore has spent years making SMS harder to abuse. Telcos run network-level scam filters, and since 2023 any SMS that uses a name instead of a number must come from a Sender ID registered with the SMS Sender ID Registry. Unregistered ones are labelled 'Likely-SCAM'.

iMessage sits outside all of that. The 20 August advisory says plainly that iMessage is not covered by these measures because it runs on Apple's own system. A message can arrive in the same Messages app, in the same list as your bank's real SMS, without passing any of the checks. Most staff do not notice the difference between a blue iMessage bubble and a green SMS bubble.

Apple does have one defence: links from unknown senders are not clickable until you interact with the sender. That is why the scam messages ask you to 'reply Y to confirm' or 'reply 1 to acknowledge'. The reply switches the protection off.

What each iMessage scam looks like

Staff do not need to memorise every variant. They need to recognise the shape.

• Fake courier: a parcel from DHL, Ninja Van, J&T Express, SingPost or SPX Express 'could not be delivered'. Update your address by 6pm and pay a small redelivery fee.
• Fake Police, Traffic Police or court: you owe a traffic fine, parking fee or court summons, with threats of an arrest warrant or vehicle impoundment.
• Fake bank or marketplace alert: a 'pending transaction' needs verification. Call the number in the message.
• Fake Apple support: a pop-up says someone tried to access your Apple account, followed by a call from a '+1' number and a site such as chat-apple.com asking for Apple ID, crypto logins and OTPs.

The senders are usually foreign numbers starting +212, +63 or +44, or email addresses made of random letters and digits. In several courier cases the stolen card was then added to Apple Pay or Google Pay, or the victim's bank token was moved to a new device.

The government variant overlaps with the calls covered in our guide to government official impersonation scams. The Police have said SPF, Traffic Police and the Singapore Courts will never ask for payment through unsolicited links or text replies.

iPhone settings to switch on today

The Police advise turning on two filters. Apple's screen and filter messages guide has the current steps; the names below match recent iOS versions.

1. 1

   Open Messages and the filter menu

   In the Messages app, tap the filter button at the top of the conversation list, then tap Manage Filtering.

2. 2

   Turn on Screen Unknown Senders

   Messages from people not in your contacts go to a separate folder without notifications. On older iOS versions this switch is called Filter Unknown Senders, under Settings, Apps, Messages.

3. 3

   Make sure Filter Spam is on

   Apple turns spam filtering on by default. Check it in the same Manage Filtering screen.

4. 4

   Allow only the alerts you need

   If you rely on verification codes from new senders, use Allow Notifications to let that category through rather than turning screening off.

5. 5

   Report, then delete

   Swipe left on an unopened message, tap the bin, then Delete and Report Spam. Apple's report spam guide notes you cannot report a message after replying.

Installing the ScamShield app adds call and SMS protection, and the website lets staff check a suspicious number or link. It does not change how iMessage works, so the filters above still matter.

The 5-minute staff briefing script

Read this out at a team meeting or paste it into your group chat. It covers the points from the Police advisories in plain words.

Repeat it when new variants appear. Short and frequent works better than one long training session a year. Our guide on how to spot a phishing email applies the same checks to email.

Why this matters to the business, not just the individual

Most of these messages land on personal phones, so it is tempting to see them as a private problem. They become a business problem quickly. Staff often use the same phone for work email, the company banking token, the Microsoft or Google authenticator app and WhatsApp groups with customers.

If an employee hands over an OTP or lets a bank token be moved to another device, the attacker may reach company accounts too. And if your business sends parcels or reminders, your own customers are receiving the fake courier and bank messages, which is why online sellers should state clearly how they contact buyers. Our guide for online sellers on courier scams covers that wording.

Do it yourself or get help?

The script and the two iPhone settings take five minutes and cost nothing. Do them this week.

If you want a structured session for your team, our Security Awareness Training (S$390) covers iMessage, SMS, email and phone scams with Singapore examples and includes a simulated phishing test, so you can see who would have clicked.