Crypto scams targeting Singaporeans

The most expensive hour in a Singapore crypto story is not a bad trade. It is the hour after the first loss, when someone on Telegram offers to get the money back. Pig butchering, cloned apps, fake MAS PDFs and “recovery agents” are now a single pipeline. The first hit empties an account. The second hit empties whatever is left, plus a loan, plus a relative’s PayNow.

This desk writes so you can recognise the pattern before the QR is scanned. We do not recover funds, we do not run a tracing desk, and we will not introduce you to anyone who claims they do. If you want a correction to an article, use the contact form. If you have lost money, skip to the reporting section and go to the police.

Pig butchering that starts on Telegram or a dating app

A stranger builds a relationship over weeks — LinkedIn, a dating app, a “wrong number” WhatsApp. They do not ask for money first. Eventually they mention a private trading group or a “licensed Singapore desk.” Screenshots show steady returns. A small first deposit, often S$500 to S$2,000, is allowed to withdraw so that trust lands. Then a tax or “margin top-up” appears, and the withdrawal button dies.

The platform in the screenshots is not a MAS licensee. It is a website with a Singapore flag and a made-up UEN. The payment instruction is often PayNow to a mule account, or a USDT send to an address they dictate, sent at 10pm when you are tired enough to scan a QR rather than look up a licence.

If the relationship existed before the trading talk, that is not evidence of good faith. It is the product. Do not add funds to “unlock” a withdrawal. Do not borrow. Do not introduce a colleague. Look the firm up on the MAS Investor Alert List and the Financial Institutions Directory. If it is not there, you are not in a dispute with a licensee. You are in a fraud.

Fake MAS letters and cloned apps

A PDF with the MAS lion, a reference number, and a deadline is cheap to make. Real MAS consumer-facing pages live on mas.gov.sg. Real licence checks live in the Financial Institutions Directory. MAS does not email you to say your Bitcoin is involved in a money-laundering case that can be cleared by transferring USDT to a “safe holding wallet.” MAS does not ask for a seed phrase. MAS does not sell a recovery token.

The cloned-app version is more technical and more effective. You search an exchange name, tap the first App Store or Play Store result, and install a lookalike icon. Or a Google ad leads to a domain that is one character off. The login page harvests your password and one-time code, then the real account is emptied from another country. Sometimes the fake app is a complete trading interface with made-up balances, so you deposit again to chase a number that never existed on a chain.

Install from a URL you typed, on the company’s own site, after you have matched the legal name to the directory. Prefer the website over a newly appeared APK. Check the developer name in the store listing against the licensee, not against the brand. Enable anti-phishing codes. If an app asks for permission to read SMS or to overlay other apps, delete it.

A related stunt uses IRAS. Scammers have long impersonated tax officers for e-filing season; they now add a crypto angle — a “capital gains assessment” that can be settled in tokens. Singapore does not have a blanket capital-gains tax. A demand to pay IRAS in USDT is not an assessment. It is a script. Our crypto tax explainer covers what IRAS actually publishes. Pay nothing to a wallet address that arrived in an email.

QR codes, PayNow and the “support agent”

A QR code is not a picture. It is a payment instruction or a URL. Scanning one from a chat is equivalent to typing a beneficiary account you have not checked. Pig-butchering desks, fake support agents and job scams all love QR because it skips the moment where you might read a name.

In-app support impersonation follows a loss or a withdrawal hold. You search the exchange name plus “support,” join a Telegram handle that uses the logo, and a person who already knows your ticket number — harvested from a phishing page — tells you to “verify the wallet” by entering the seed, or to send a test amount to a whitelist address they control. Licensed platforms do not ask for a seed. They do not use personal Telegram accounts. They do not call you from a +1 or +44 number to walk you through remote desktop.

PayNow name-check exists for a reason. If the displayed name is a person you do not know, stop. If the amount is “a verification of S$9,999,” stop. If the agent says the QR is for GST, a release fee, or a travel-rule penalty payable to MAS, stop. MAS does not collect penalties from retail customers via PayNow QR.

Public Wi-Fi at a mall food court is a poor place to approve a withdrawal. So is a phone call that insists you stay on the line while you “just confirm.” Hang up. Call the number on the back of your bank card or the number on the licensee’s website, not the number that just rang.

Telegram “recovery agents”

Once a loss is public — a police report, a forum post, a Google review — a second team arrives. They claim to be former CAD, former exchange staff, or a “blockchain forensic firm” that works with MAS. They want a retainer in Bitcoin, or access to the compromised wallet “to deploy a smart contract that freezes the thief.” They produce a fake court order. They produce a fake MAS acknowledgement.

This is the same crime, restocked. You cannot pay a thief to catch a thief and expect a refund. Any person who contacts you unsolicited after a scam to recover the funds is, until proven otherwise with a licence you have checked, a continuation of the scam.

CryptoMarkets.sg will not do this work, will not refer it, and will not look at your seed to “see if anything can be done.” The contact page is for corrections, licence updates and reader questions about articles. It is not a recovery desk. If an email claiming to be from us asks you to send tokens or to install software, it is not from us.

How to report to SPF and CAD

Speed matters more than perfect prose.

Tell your bank immediately, using the official hotline, if PayNow or FAST has left the account. Ask whether a recall is still possible. Tell the DPT platform, in the authenticated app, to freeze what is left and to preserve logs. Do not use a Telegram handle for that notice.

File a police report. The Singapore Police Force accepts reports online and at Neighbourhood Police Centres. Commercial fraud sits with the Commercial Affairs Department; the police report is still the intake. Include dates, amounts in S$, wallet addresses, transaction hashes, usernames, phone numbers, QR screenshots and URLs. Do not wait until you have “the full story.” Add documents later.

Use ScamShield to block numbers and to submit the scam. Notify IMDA’s scam channels where the vector was SMS or a fake site. If a MAS-looking PDF was involved, you can also alert MAS through its public channels so the Investor Alert List can be considered; that does not replace a police report and it does not recover funds.

Preserve the phone. Do not factory-reset it because you are embarrassed. Forensic value lives in the chat history you are tempted to delete.

None of this predicts that you will be made whole. Mule accounts empty quickly. Reporting still matters: it maps mule networks, and it is the document a bank or exchange will later ask for.

What you should never share, and what to do instead

Never share a seed phrase, a hardware-wallet PIN, an authenticator backup, a banking OTP, or a screenshot of a QR that is meant to receive funds into your wallet (scammers overlay those). Never grant AnyDesk, TeamViewer or “Microsoft Quick Assist” to someone who called you. Never send more tokens to release, unlock, hedge or insure a position that has already been stolen.

If you still hold coins, move them — on a device you control, to an address you generated, after you have read the storage guide — only once you are sure the destination is yours. A panicked send to a new app recommended by the same chat is how the rest leaves.

Check licences on mas.gov.sg, install apps from official URLs, treat QR as a payment order, and treat unsolicited recovery as hostile. For device versus book custody, see hardware wallets versus exchange custody. This publication is not the police and will not take a cut to “help.” That is the entire product of the second scam.