The Singapore Police Force (SPF) has instructed Apple and Google to implement measures to prevent the spoofing of Singapore government agencies on iMessage and Google Messages. The directive, issued under the Online Criminal Harms Act (OCHA), must be enforced by November 30, 2025.
Measures to Protect Users
According to the Ministry of Home Affairs (MHA) in a press release on November 24, Apple and Google are required to:
- Prevent accounts and group chats from displaying names that spoof “gov.sg” or other Singapore government agencies.
- Filter messages from accounts or group chats attempting to use such spoofed names.
- Ensure profile names of unknown senders are either not displayed or shown less prominently than their phone numbers, helping users identify unfamiliar sources.
Why the Order Was Needed
Since July 2024, government agencies have been using the “gov.sg” SMS sender ID to help the public identify legitimate government messages. However, messages sent via iMessage and Google Messages do not have a similar verification system. MHA explained that the public may mistakenly assume messages from accounts claiming to be “gov.sg” are legitimate because they look similar to SMSes.
The police have also noted scams impersonating other registered SMS IDs, including over 120 cases involving SingPost. “There is therefore a need to put in place measures to deter the abuse of iMessage and Google Messages by scammers,” MHA said.
Apple and Google’s Response
Both Apple and Google have indicated they will comply with the directives. In response to media queries, a Google spokesperson said there were no known cases of government impersonation through Rich Communication Services (RCS) messages on Android devices so far. RCS messages allow users to share high-resolution photos and other media.
The spokesperson added, “Google also shares Singapore’s goal of keeping Singaporeans safe online,” reinforcing the importance of protecting users from potential scams.
