Nearly $2.2 million lost to impersonation scams on iMessage in less than 2 months

SINGAPORE – A surge in scams where fraudsters use Apple’s iMessage service to pose as official institutions or courier companies, including NinjaVan and SPX Express, has led to nearly $2.2 million in losses within less than two months.

In an advisory on Aug 20, the police said its anti-scam and cybercrime unit has foiled more than 30,000 Apple iMessage accounts linked to the fraud campaign.

They added that the total amount lost to such scams had increased by more than 80 per cent within a month. On Aug 5, the police said in a media release that more than $1.2 million had been lost to similar ruses since June 24, with at least 251 cases reported, the police said.

In these cases, victims would receive fraudulent messages from numbers bearing foreign country codes or from e-mail addresses made up of random alphanumeric strings imitating recognised couriers such as NinjaVan, J&T Express and SPX Express.

The police have also seen similar ruses impersonating government agencies and financial institutions.

Recipients would be told to click on links that resemble the actual URL of couriers, government agencies or financial institutions.

In some cases, they would be told to acknowledge the message by replying with “Y” or “1”. This is likely an attempt to deceive them into disabling Apple iMessage’s built-in security features, which prevent recipients from clicking on links in messages until they have interacted with the sender, the police said.

Upon clicking on the link, they would be redirected to a fake website that resembles the official websites of the couriers, government agencies or financial institutions, and be prompted to pay a small fee to release their package or fine.

They would be asked to provide their credit card and internet banking credentials, and authorise the transaction with their digital tokens.

In some cases, their credit cards would later be added to Google Pay or Apple Pay. Their bank digital tokens may also be set up on unfamiliar devices and later be used to make unauthorised transactions. Some victims also reported unauthorised logins to their bank accounts from unfamiliar devices.

Government agencies and couriers do not use iMessage to communicate with the public.

“Members of the public are advised to exercise caution when receiving messages via iMessage and to look out for warnings indicating that a message may be spam,” said the police.

Government official impersonation scams are on the rise in Singapore, with such cases more than doubling from 1,504 cases in 2024 to 3,363 cases in 2025.

To contact the police about scams, call 1800-255-0000 or go to www.police.gov.sg/i-witness.