Two 27-year-old men have been arrested for their suspected involvement in a string of phishing scams that targeted WhatsApp users across Singapore.
The cases surfaced in October 2025, when victims reported receiving unsolicited SMS messages claiming there were issues with their WhatsApp accounts due to a supposed lapse in verification.
The messages directed users to a phishing link that led to a fake WhatsApp login page. Once victims entered their mobile numbers and verification codes, scammers took control of their WhatsApp accounts and used them to send fraudulent loan requests to the victims' contacts.
The victims typically realised something was wrong when they were abruptly logged out of their accounts, saw unfamiliar devices linked to their WhatsApp, or when friends alerted them about suspicious loan messages. At least one person lost about S$1,823 to this scam variant.
Between November 18 and 19, the officers from the Police Intelligence Department and the Commercial Affairs Department mounted an islandwide operation, arresting two men believed to be part of a transnational syndicate operating the WhatsApp phishing scam.
Investigations suggest that the suspects were responsible for sending mass SMS messages to more than 7,000 random phone users in Singapore in an attempt to harvest verification details.
Once the scammers gained access to victims' WhatsApp accounts, they allegedly used the hijacked accounts to solicit fake loans from the victims' contacts. During the operation, the police seized several network-related telecommunications devices, mobile phones, and a Malaysia-registered vehicle.
The suspects will be charged on Thursday, November 20 with abetment to facilitate unauthorised access to computer material under Section 3(1) read with Section 12 of the Computer Misuse Act 1993. First-time offenders face a fine of up to S$5,000, up to two years' imprisonment, or both.
Police reminded the public that they take a firm stance against scams and warned individuals not to lend their bank accounts or mobile lines to others, as they may be held liable if used for criminal activities.
WhatsApp users who suspect their accounts have been compromised are advised to contact WhatsApp for recovery assistance. The police also highlighted precautionary measures under the Add-Check-Tell framework.
Members of the public should download the ScamShield app, enable WhatsApp's two-step verification feature, and check the authenticity of links and messages before responding. They should also verify unusual requests from contacts through phone calls and review their linked devices regularly.
Anyone who encounters or falls victim to a scam should inform the authorities, contact their bank immediately to block unauthorised transactions, and lodge a police report. Suspicious phishing websites should also be reported to internet browser service providers.
