Why lending a login, buying an account, or sharing your identity details could become a crime
Singapore’s proposed anti-scam changes are not only about stolen money. They also target the online accounts that scammers use to find victims, build trust, and hide who they really are. The Scams (Countermeasures) and Other Matters Bill, introduced on 4 August 2026, proposes several new offences involving designated online accounts.
The offences are meant to close a gap. Singapore introduced offences in 2024 to deter the misuse of SIM cards, Singpass accounts, and bank accounts. But scam operations also lean on social media, chat, marketplace, and other online accounts. A convincing profile can be just as useful to a scammer as a phone number or a bank account.
As at 13 August 2026, the Bill had received its First Reading but was not yet law. This article explains the proposal in plain language. The exact wording, when it starts, and how it is enforced will depend on the rest of the process and how the law is put into practice.
The four kinds of conduct being targeted
The Ministry of Home Affairs described four proposed offence areas:
- Giving your personal information to open an online account that will be used for crime
- Holding or keeping control of an online account registered with someone else’s personal information
- Supplying an online account for crime
- Receiving an online account for crime
The Bill turns these into three detailed offence provisions. They cover the supply side, the receiving and control side, and the giving of personal information used to open an account.
The focus is not just on whoever presses “send” during a scam. It also reaches the people who create, transfer, rent, lend, or obtain the digital tools that others use.
Which online services are covered
The offences apply to a “designated online account”. That means an account on an online service designated under the Online Criminal Harms Act. The Bill separately proposes stronger penalties for designated platforms that fail to meet anti-scam requirements.
The Ministry of Home Affairs named the designated services as Facebook, Instagram, WhatsApp, Telegram, WeChat, TikTok, Carousell, Google, and Apple. This list can change if the designations change under the relevant law.
An account can be free or prepaid. The definition is meant to cover what people would normally recognise as an account on an online service. So the rules are not limited to paid subscriptions or accounts that hold money.
Supplying an online account for crime
The proposed supply offence covers selling, renting, lending, or otherwise supplying an account, as well as offering to do so. It applies when the supplier knows, or has reasonable grounds to believe, that the account will be used to commit or help an offence, or to cause or help wrongful gain or wrongful loss.
The Bill does not let a person escape by handing over only the login details. Giving another person a username, password, or verification code that lets them control the account can count as supplying the account.
This reflects how the trade in online accounts actually works. A buyer may never meet the registered user or receive a physical device. Control can pass through a password, a recovery email, a session token, or a verification code.
The proposed presumption for suppliers
In certain proceedings, a supplier may be presumed to have had reasonable grounds to believe the account would be used for an offence, if the supplier acted for gain. The same may apply if the supplier did not take reasonable steps to check who the recipient was, where they were, or what they wanted the account for.
The presumption applies until the person proves otherwise. In plain terms, “I did not ask” may not be a safe answer when someone is paid to hand an account to a stranger.
There is a lawful-purpose protection. A person does not commit the offence if there were reasonable grounds to believe the aim was to allow lawful use of, or access to, the account. This is important for genuine account admin, IT support, agency work, and authorised transfers within an organisation.
Receiving or keeping control of an account
The proposed receiving offence covers buying, renting, borrowing, or otherwise receiving an account, including offering to do so. It also covers keeping control of an account that was opened using someone else’s personal information.
The required intention is key. The recipient must intend to use or supply the account to commit or help an offence, or to cause wrongful gain or wrongful loss. Where the account is received for gain, the Bill proposes that, in certain proceedings, the criminal intention is presumed unless the person proves otherwise.
The law is aimed at account traders, mule recruiters, and operators who collect profiles from other people. It is not designed to catch ordinary authorised access, such as an employee running the company’s official social media account for legitimate work.
Giving personal information to open an account
Another proposed offence targets a person who gives, or agrees to the use of, their own personal information so that another person can open a designated online account.
The person must know, or have reasonable grounds to believe, that the details will be used to open the account and that the account will be used for an offence, or to cause wrongful gain or loss.
This can cover more than sending a copy of an identity document. Depending on how the account is registered, personal information can include details or verification material needed to create and control the account.
The Bill proposes a presumption of reasonable grounds in certain cases where the person acted for gain, or did not take reasonable steps to check the user’s identity, location, and purpose. Again, turning a blind eye is treated as a serious warning sign.
Penalties proposed for individuals and organisations
For a first conviction for supplying or receiving a designated online account under the proposed provisions, an individual could face a fine of up to S$10,000, up to three years in jail, or both. For a second or later conviction, the maximums rise to a S$20,000 fine, up to five years in jail, or both.
For an organisation such as a company, the proposed maximum fine is S$20,000 for a first conviction and S$40,000 for a second or later conviction.
The offence about giving personal information carries a proposed maximum of a S$10,000 fine, up to three years in jail, or both, for an individual. An organisation could face a maximum fine of S$20,000.
In certain cases involving knowing participation in scam offences, an individual could also face caning of up to 12 strokes. The exact fault element matters here. The Bill links this extra punishment to knowledge or intention involving the use of the account for a scam offence.
A completed scam may not need to be proved
The proposed wording is designed to allow earlier action. For the supply and receiving offences, the prosecution does not need to prove, for the relevant point about use of the account, that a specific offence actually happened.
Similarly, for the personal-information offence, proving the person’s state of mind does not require proof that the designated account was used for a specific offence.
This does not remove the need to prove the elements of the charge. It means a person may not escape simply because the scam was stopped before a victim paid money, or because investigators cannot tie the account to one completed crime.
Everyday offers that could put you at serious risk
Several offers should set off alarm bells:
- Someone offers S$200 to “rent” your old Telegram or Facebook account.
- A stranger asks for your verified Carousell profile to advertise products.
- A person wants to use your identity details and selfie to create accounts.
- A recruiter asks you to create Google or Apple accounts and hand over every password and recovery method.
- A buyer wants a WhatsApp account with an established history and a Singapore phone number.
- Someone promises payment if you keep receiving verification codes for accounts they control.
The words used in the offer do not decide whether it is safe. Calling it marketing, testing, “account warming”, or freelance work does not turn a criminal purpose into a lawful one.
Legitimate account access is still possible
Online work often needs shared or delegated access. A marketing agency may manage a client’s page. An IT provider may reset employee accounts. A family member may help an elderly relative secure an account. A buyer of a genuine business may receive its digital assets as part of a documented sale.
The proposed offences include lawful-purpose protections. Even so, legitimate users should record their authority and purpose. Use the platform’s built-in role access instead of sharing passwords where you can. Keep contracts, approval emails, and handover records. Confirm the other party’s identity and location, especially when access is being transferred.
The more unusual the request, the stronger your checks should be. Payment for an account, secrecy, urgency, crypto-only payment, and refusal to reveal identity are all warning signs.
What platforms and businesses should do
Platforms may need stronger controls against account farming and transfers. Useful measures include spotting clusters of newly verified accounts, unusual changes to recovery details, repeated device switching, and logins from places that do not match the account’s history.
Businesses should replace shared passwords with named roles and least-privilege access. Remove departing staff immediately, and keep recovery methods under the business’s control. Agencies should keep an up-to-date register of client accounts, authorised users, and the reason for access.
These steps are not just about avoiding legal risk. They also make it easier to show that access was authorised and used lawfully if an account is later investigated.
What to do if you have already handed over an account
Act fast. Recover the account through the official platform process, change the password, log out active sessions, and remove any unknown recovery details. Keep the messages that show how the transfer happened and any payment offered or received.
Report the matter to the platform. If you think the account has been used for a scam, make a Police report and provide the account details, dates, login alerts, transaction records, and the other person’s contact information.
Do not demand extra payment from the recipient in exchange for silence or continued access. Do not delete evidence or make up a story. Reporting early and truthfully can help prevent further harm and lets the situation be assessed properly.
The bottom line
Singapore’s proposed offences treat online accounts as potential scam infrastructure. Supplying login details, receiving a verified profile, or lending your personal information can be serious when you know, intend, or have strong reason to believe that criminal use will follow.
The practical lesson is simple. Do not sell, rent, or lend online identities. Check who will control an account and why. Use proper access tools for genuine work, keep records, and report suspicious requests before the account reaches a scam syndicate.
Frequently Asked Questions
1. Could a person under 18 be investigated for one of the proposed offences?
Age can affect how a case is handled and how it is sentenced, but being young does not make risky account dealing harmless. If a minor is involved, a parent or guardian should get legal advice quickly and preserve the relevant messages and devices.
2. Can the platform suspend an account even if no criminal charge is filed?
Yes. A platform can act separately under its own terms and safety policies. A platform restriction and a criminal case are different processes with different tests.
3. Could a victim sue a person who supplied an account used in the scam?
A civil claim would depend on causation, evidence, the available legal grounds, and the person’s role. A victim should get legal advice based on the actual loss and conduct.
4. Would the offences apply when the supplier and recipient are overseas?
Cross-border application can depend on the offence, the conduct, and the rules on jurisdiction. A Singapore-based user should not assume that an overseas counterpart or server removes the legal risk.
5. What if a company admin accidentally gives access to the wrong contractor?
An accident is different from knowing or intentional criminal participation. The company should cancel the access immediately, keep the audit trail, report any misuse, and document the error and its response.
Thank you for sharing this article...
About the Author: Randy Alta
