If you have been affected by a scam or suspected cybercrime in Singapore, the priorities are to limit further harm, contact the appropriate bank or platform, make an official Police report where relevant and preserve useful evidence safely. ScamShield’s 1799 helpline and app can help with scam enquiries and reports, but an app report is not a Police report. SingCERT offers technical incident-reporting guidance for cybersecurity matters.
The gold standard of victim support is not a promise to recover every stolen dollar. It is a calm and accurate service that helps a person reach the correct authority, protect accounts and personal information, keep an honest record of events and obtain suitable follow-up without being exploited a second time.
This article follows a fictional account-compromise case, with separate routes for financial risk, Police investigation, technical recovery and emotional support. It provides no hacking, retaliation or self-directed digital forensic instructions.
This scope is distinct from The Gold Standard of Victim and Witness Support (broader crime victim support), The Gold Standard of Cybersecurity Companies (cybersecurity service companies), The Gold Standard of Data Recovery Services (technical file recovery) and The Gold Standard of Police Report Filing Services (filing Police reports). The focus here is the affected person’s protection and coordinated recovery journey.
Find the part you need
Start with immediate protection and official reporting. The middle chapters explain evidence and account security; the final chapters cover safe follow-up, dignity and service quality.
Open the 17-chapter guide
- Protect people and stop ongoing loss first
- Separate scams, cyber incidents and other digital harm
- Contact the bank through an independently verified route
- Make an official Police report when a cybercrime is suspected
- Use ScamShield for its actual role
- Know when technical assistance from SingCERT is useful
- Preserve evidence without exposing the person again
- Write a simple chronology rather than a speculative story
- Secure affected accounts through authentic providers
- Protect identity information and limit further disclosure
- Handle threats, harassment and coercion through safe channels
- Make recovery support humane rather than judgmental
- Distinguish official updates from third-party recovery promises
- Understand financial recovery without making guarantees
- Coordinate police, bank, platform and technical roles
- Learn from the incident without demanding public exposure
- Measure the service through protection and reliable handoffs
1. Protect people and stop ongoing loss first
If you suspect that online fraud or unauthorised access has affected you, the first priority is to prevent further loss and seek the right official help. A dramatic accusation, a promise to recover everything or an hour spent reconstructing every detail should not delay necessary action. The situation may involve money, personal data, a compromised device, threats or misuse of an online identity; each needs a proportionate response.
Singapore ScamShield’s official ‘I’ve been scammed’ guide advises contacting the bank immediately when relevant, filing a Police report, securing affected accounts and reporting to platform administrators. If urgent police attention is required, official guidance points to 999. Readers should follow current instructions from their bank and competent authorities rather than an unsolicited caller claiming they can reverse the loss. A support service succeeds by helping the person reach legitimate protection quickly.
The quality measure is timely action that reduces exposure, not the number of forms filled in before safety has been addressed.
2. Separate scams, cyber incidents and other digital harm
Not every suspicious email proves a crime occurred, and not every technical fault is a scam. A stolen payment, ransomware disruption, unauthorised account access, harassment through a platform and malicious website can raise different issues. Their reporting and recovery paths may overlap but should not be described as identical. A person may also experience several harms from one event, such as losing money and having private information exposed.
Use a calm intake checklist to identify what is known: which accounts or services are affected, whether money was transferred, whether anyone is currently threatening the person, and what devices or records may be relevant. Singapore’s Cyber Security Agency says its SingCERT Cyber Aid accepts reports of cybersecurity incidents based in Singapore, while the Police are the authority for investigation of cybercrime. Do not assume a CERT incident report replaces a criminal report.
Accurate classification directs the person to the right help without making them become a forensic specialist.
3. Contact the bank through an independently verified route
Where a bank account or payment card may be compromised, delays can allow additional financial loss. ScamShield recommends immediate contact with the bank and describes bank fraud hotlines and available protective functions. The correct practical steps depend on the bank’s current services, the account and the incident. A person should not call a number supplied by someone who may be the scammer.
Find the bank’s official number through its app, website or ScamShield’s current reference, and explain the relevant unauthorised transaction or suspected exposure. Follow authorised bank instructions concerning access restriction or an emergency account measure. Record reference numbers and dates safely. Do not promise the bank can always reverse a transfer; recovery depends on facts, timing and applicable processes.
A credible support worker helps a person reach the bank, not a private intermediary charging a fee for a guaranteed refund.
4. Make an official Police report when a cybercrime is suspected
People sometimes believe an app report, bank inquiry or social-media message is the same as a formal Police report. It is not. Singapore ScamShield expressly says reports submitted through the ScamShield app are not official Police reports. Its victim guidance provides current links for reporting to the Police online or through a Police service point, and SingCERT separately advises Police reporting for suspected cybercrime.
A support process should explain which formal route is appropriate and what details may help an authorised investigation. The person can collect facts and contemporaneous records before or while reporting as safety permits, without delaying urgent financial protection. Do not invent an investigative outcome or advise the person to confront suspects. If there is immediate danger, use the relevant emergency service rather than waiting for an ordinary appointment.
The standard is a truthful route to competent authorities, not a false claim that clicking ‘report scam’ completes every required process.
5. Use ScamShield for its actual role
ScamShield provides tools for checking suspicious messages and numbers, reporting encounters, and accessing scam-related guidance. Its 1799 helpline is intended for scam-related enquiries and can direct users to certain bank channels. It cannot file a Police report on someone’s behalf. Treating the helpline as a universal cybercrime investigation desk can misdirect people and create avoidable delay.
Explain the difference between checking a possible scam, sharing information that may protect others and obtaining official case investigation. The ScamShield app report may help identify suspect calls or messages, but a victim reporting financial loss should still follow the formal Police and bank instructions. The helpline’s role and supported banks can change, so refer to the current official page rather than freezing an old list into an article.
A good service handoff gives the user one clear next action for each distinct purpose.
6. Know when technical assistance from SingCERT is useful
Malware, attempted intrusions, phishing infrastructure or a website defacement can present technical problems beyond the capacity of a general help volunteer. SingCERT Cyber Aid allows people to describe cybersecurity incidents based in Singapore and receive guidance on addressing them. Technical incident support is not equivalent to police criminal investigation, and a person’s broader legal and financial concerns may need other authorities.
Ask whether a device, system or online account still appears compromised and direct appropriate technical issues to approved experts or official resources. Avoid asking the person to experiment with suspicious files, revisit malicious sites or provide passwords to a stranger. If a company system is affected, its trained response team and legal reporting obligations may need separate review. An individual should not be expected to solve a sophisticated intrusion alone.
The gold standard is a coordinated, authorised referral that respects both technical safety and legal responsibility.
7. Preserve evidence without exposing the person again
Evidence may include messages, email headers, receipts, bank transaction records, suspicious account notices or platform conversations. ScamShield’s Police-report guidance describes useful details such as dates, contact modes, claimed identities, relevant screenshots and transaction references. However, preserving evidence does not require clicking a dangerous link or reopening a suspicious attachment.
Save material already available through safe, authorised access. Note what came directly from the victim, what another person observed and what remains uncertain. Preserve original timestamps and files where practicable without modifying or circulating them unnecessarily. Do not create a public folder containing identity documents or bank statements as a shortcut for helping. Authorised investigators and technical professionals can advise on specialist collection when needed.
A useful record is authentic, limited to legitimate purposes and safe for the person whose information it contains.
8. Write a simple chronology rather than a speculative story
After a frightening incident, people may confuse the order of calls, messages and account notifications. That is understandable, especially if several platforms were involved. A support worker who rewrites uncertainty into a confident narrative can damage factual accuracy and create unnecessary distress. Another risk is repeatedly asking a person to recount the same event to numerous helpers.
Use a short timeline with date, approximate time, contact method, action observed, relevant evidence and any bank or Police report references. Label uncertain details honestly. Allow the person to correct inaccuracies and keep earlier versions of material notes where appropriate. Distinguish a scammer’s claims from verified facts. Do not coach the person to adopt a dramatic description they did not use.
An orderly chronology should reduce repeated effort and support lawful enquiries without turning a supporter into an investigator.
9. Secure affected accounts through authentic providers
Account compromise can continue after a payment has been reported. A person may need to recover access to an email, messaging service, bank or other platform. Each provider has its own legitimate recovery route and may require identity checks. A fraudulent ‘recovery technician’ may exploit urgency to demand passwords, codes or remote device access.
Use provider websites and apps located independently rather than links received from an unknown contact. Follow official security guidance and seek trusted technical help when the device itself may be compromised. Do not share one-time passwords or reset codes with an unsolicited helper. Document what changes were made where useful, without writing secret recovery information in a public case file.
Reliable support helps restore control of accounts while avoiding a second exposure created by the rescue process.
10. Protect identity information and limit further disclosure
An incident may expose a name, identification number, private photographs, workplace information or payment details. A victim can be harmed again when a helper widely shares screenshots or reposts private data to warn others. Even a well-intended public warning may identify the person or reveal contact details useful to future attackers.
Ask what categories of personal information may be exposed and identify the appropriate official providers or authorities for advice. Share only information necessary for the legitimate report or service. Restrict access to copies, especially where minors or sensitive images are involved. Do not promise that every copied piece of information can be permanently erased from the internet; available remediation varies by platform and law.
The quality test is whether support reduces further disclosure and lets the affected person understand the privacy choices being made.
11. Handle threats, harassment and coercion through safe channels
Some digital incidents involve blackmail, threats to publish information, impersonation or repeated harassment. Those are not ordinary customer-service problems. People may be pressured to pay, send further content or meet the person threatening them. The appropriate response can involve law enforcement, platform reporting and specialist emotional support, depending on the circumstances.
Prioritise immediate safety, avoid instructing a victim to negotiate with or confront a threatening person, and use the relevant official reporting route. Preserve communications that are safely available without encouraging further contact. If the person is a child or another vulnerable individual, involve competent safeguarding services. Do not present payment as a reliable way to stop extortion or promise that platform removal can always be achieved immediately.
A protective programme respects dignity and takes threats seriously without amplifying them.
12. Make recovery support humane rather than judgmental
Victims may feel embarrassed, angry, fearful or exhausted. Shaming language such as ‘you should have known’ can stop someone from contacting a bank or making a report. A person who has transferred money may also need practical help dealing with ordinary expenses and contacting family. None of this requires a general volunteer to diagnose a mental health condition.
Use a respectful, calm approach and ask what immediate practical support the person wants. Singapore Police’s Victim Care Cadre Programme supports victims of crime, including scams, through trained volunteers activated in the Police process; access and suitability depend on the actual case. Refer specialist wellbeing concerns to appropriately qualified services. Avoid asking the person to turn a private experience into a public cautionary story.
The quality measure includes whether the person was heard and offered real options, not simply whether a report number was issued.
13. Distinguish official updates from third-party recovery promises
After an initial report, scammers or opportunists may contact victims claiming to be investigators, bank recovery teams or specialists able to retrieve lost funds for an advance fee. These messages can be persuasive because they refer to details of the original incident. A legitimate victim-support programme must not amplify such promises or collect unnecessary payment information.
Tell readers to verify any claimed authority independently through the Police, bank or relevant platform’s official contact route. ScamShield explains that case updates should be sought from the Police officer or appropriate division contact rather than expecting its 1799 helpline to provide investigative updates. Keep authentic reference numbers and communications so the person can confirm what belongs to the real case.
Support should make official communication easier while shielding the individual from people selling certainty that nobody can honestly guarantee.
14. Understand financial recovery without making guarantees
Not every unauthorised transaction is recoverable, and not every disputed transfer is treated identically by banks or law enforcement. The available steps depend on when a financial institution was notified, account activity, the payment route and the applicable dispute or legal process. A generic article promising 100% retrieval is misleading and can encourage further exploitation.
Help the person obtain accurate bank information, preserve relevant records and understand how to submit a concern through the proper channel. Where a financial dispute, consumer claim or legal remedy may exist, refer to qualified professionals and current institution guidance. Do not instruct people to transfer money into a ‘safe account’ provided by an unsolicited caller. Distinguish reporting a scam from obtaining a civil remedy or bank reimbursement.
The gold standard communicates uncertainty truthfully and supports timely action within real institutional powers.
15. Coordinate police, bank, platform and technical roles
One incident may require several organisations to act. The bank can address account exposure; the Police investigate suspected crimes; a platform manages user accounts and content; SingCERT provides cyber-incident advice within its scope. Confusion occurs when every organisation assumes another has already completed the needed task.
Maintain a small support map listing the issue, relevant authority or provider, report reference, date and next authorised contact. Avoid sharing every detail with every party automatically; privacy and necessity matter. A trusted helper may assist with administrative organisation but must not claim to speak on behalf of the Police or access bank accounts without appropriate authority. If a referral is not accepted, record the problem and seek the correct channel.
A good response is coordinated without creating a fictional all-powerful recovery service.
16. Learn from the incident without demanding public exposure
After immediate protection, people may want to understand how the incident happened and how to reduce future risk. Education is useful, but it should not become a public interrogation about the victim’s choices. A support provider can help identify general warning signs, authentication habits and trusted verification routes without exposing private financial or family details.
Use relevant, current official guidance and adapt it to the person’s level of confidence, device access and needs. Avoid elaborate security routines the person cannot realistically maintain. Check whether the individual knows where to verify suspicious calls and how to contact a bank or platform without relying on unexpected messages. If the original issue remains technically unresolved, do not label it closed merely because an awareness handout was distributed.
Learning is successful when the person has safer, more understandable choices, not when the organisation obtains a promotional testimonial.
17. Measure the service through protection and reliable handoffs
Crime statistics, number of reports and amounts claimed are not sufficient measures of victim support. A case may remain under investigation while the person has taken appropriate steps to protect accounts and access care. Another case may be reported quickly but leave someone exposed to repeated fraud because provider responsibilities were unclear.
Review whether urgent financial action reached the correct bank, whether a formal Police report was made when relevant, whether useful evidence was preserved safely, and whether account or wellbeing support was accessible. Record unresolved tasks without pretending a recovery is guaranteed. Invite private feedback on confusing handoffs and fix recurring errors. Protect individual identities in any aggregate reporting.
The gold standard is a respectful, accurate route from crisis to greater safety and meaningful follow-up.
Original worked example: the fake support message after an account compromise
A fictional Singapore resident receives a message claiming that her online shopping account has been suspended. She opens a link, enters details and later discovers unfamiliar card transactions. An unknown person then calls claiming to be a bank fraud investigator who can reverse the charges if she first confirms an OTP. The resident feels embarrassed and assumes she must answer every question quickly. The most dangerous part of the sequence may now be the follow-up call, because the person is at risk of losing more money and information.
A responsible supporter guides her to stop engaging with the unknown contact and find the bank’s official fraud channel independently. She follows the bank’s authorised instructions about the affected card or account. She checks ScamShield’s current ‘I’ve been scammed’ guidance and makes a Police report using the genuine reporting route, recording the times, messages and known transactions. She does not reopen the suspicious link to gather extra proof, and no helper asks for passwords or banking codes. If the device appears compromised, appropriate technical support is sought through the provider or official cyber-incident resources.
The support record keeps the bank report reference, Police submission and platform recovery separate. Later, a purported ‘fund recovery specialist’ contacts the resident asking for an advance payment. She verifies the claim through official channels and avoids that second demand. A welfare check focuses on whether she understands her options and has a safe way to obtain updates, rather than whether anyone can promise the original money will return. The scenario illustrates correct boundaries, not a guaranteed financial result.
Which service does what?
| Service | Primary purpose | Important limitation |
|---|---|---|
| Bank or payment provider | Account and payment protection | Cannot promise all transactions will be reversed |
| Singapore Police | Official crime reports and investigation | Outcome depends on the facts and law |
| ScamShield App | Report suspicious calls, messages and links | Not an official Police report |
| ScamShield 1799 | Scam checking, information and bank routing | Cannot make a Police report |
| SingCERT Cyber Aid | Cybersecurity incident reporting and advice | Not a substitute for a criminal investigation |
| Trusted platform support | Authorised account restoration | Never guarantees complete data or funds recovery |
Victim support quality checklist
- Prioritise immediate safety and steps that can limit further loss.
- Verify bank and provider contact details independently.
- Use the proper Police reporting process for suspected crime.
- Do not mistake a ScamShield app report for a Police report.
- Use SingCERT for appropriate technical cybersecurity incidents.
- Preserve messages, receipts and chronology without clicking dangerous links.
- Protect personal identity and account recovery information.
- Avoid blame and allow honest uncertainty in the victim’s account.
- Refer threats, coercion and child-safety concerns to competent help.
- Reject guaranteed fund recovery or unsolicited paid recovery offers.
- Track bank, Police, platform and technical referrals separately.
- Provide accurate updates without claiming investigative authority.
- Review long-term account safety and privacy with trusted providers.
- Measure protected outcomes rather than the number of complaints alone.
Frequently asked questions
What should I do first if money has been taken in a scam?
Follow current ScamShield guidance: contact your bank immediately through an official channel, make the appropriate Police report and secure affected accounts.
Does reporting a scam in the ScamShield app create an official Police report?
No. ScamShield explicitly distinguishes its app reports from formal Police reports.
Can the 1799 ScamShield helpline file a Police report for me?
No. The helpline assists with scam-related enquiries and guidance; the Police reporting process is separate.
When should I contact SingCERT?
SingCERT’s Cyber Aid handles reports of cybersecurity incidents based in Singapore. The Police remain the relevant authority for criminal investigation of suspected cybercrime.
Should I open a suspicious link again to collect proof?
No. Preserve safely available records and obtain advice from competent investigators or technical professionals rather than increasing exposure.
Can a private recovery agent guarantee that stolen money will return?
No credible support service should promise a guaranteed outcome; beware of unsolicited recovery requests and fees.
Can victims of scams receive emotional or practical support?
The Singapore Police Victim Care Cadre Programme supports suitable victims through trained volunteers within Police processes, subject to the actual case.
Can a helper use my passwords to fix everything?
Avoid sharing passwords or one-time codes with unsolicited people. Use legitimate provider recovery routes and authorised professional assistance.
The gold standard is protection without false promises
A responsible cybercrime victim-support system is clear about authority, evidence and uncertainty. It helps a person act promptly, preserves the facts in usable form and provides safe referrals rather than claiming control over banks, courts, investigators and platform operators. It recognises emotional distress without making the incident a public spectacle.
Real quality is visible in the practical handoffs: the affected account secured where possible, the report sent through the right official process, technical concerns referred appropriately and the person able to make informed decisions afterward. Recovery is a continuing process, and honesty about what cannot be guaranteed is part of that support.
Official Singapore protection and reporting sources
ScamShield Singapore — I’ve Been Scammed (Updated June 2026)
ScamShield Singapore — What to Include in a Police Report
ScamShield Singapore — Submit a Scam Report (Not a Police Report)
ScamShield Singapore — 1799 Helpline: Scope and Limitations
Cyber Security Agency — SingCERT Cyber Aid Incident Reporting
Singapore Police Force — Victim Care Cadre Programme
Connected eduKate Gold Standard reading
The Gold Standard of Victim and Witness Support
The Gold Standard of Cybersecurity Companies
The Gold Standard of Data Recovery Services
The Gold Standard of Police Report Filing Services
Featured photograph shows public computer terminals at the National Library Building in Singapore. It illustrates digital access and is not a photograph of the fictional cybercrime incident or its victim.
Editorial review: 19 October 2026. General victim-support information only, not individual financial, technical or legal advice. Follow current bank, Police, ScamShield and SingCERT guidance for the actual circumstances.