ACRA Scam Advisory: How to Tell a Real ACRA Message From a Fake One

ACRA does not contact you by SMS or WhatsApp, and it never sends QR codes through those channels to collect Singpass login details. If a message claiming to be from ACRA arrives that way, it is not from ACRA. That single rule disposes of most of what is circulating.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

The scam ACRA has warned the public about is specific and it is worse than a stolen password. The objective is to get your Singpass credentials in order to register a business in your name. You wake up as the owner or officer of an entity you have never heard of, created by someone who intends to use it.

That is a corporate problem, not just a personal one, which is why it belongs in a corporate services guide rather than a general cyber-safety note. Below is how to verify anything that claims to be from ACRA, in about thirty seconds, and what to do if you think something has already gone through.

What ACRA does and does not do

The advisory is useful precisely because it draws hard lines. Lines are testable. Judgment calls are not, and under time pressure judgment is what fails.

Two of those rows do a disproportionate amount of work. If the request arrived by message rather than email, stop. If it arrived by email but the sender domain is not acra.gov.sg, stop.

The official addresses, and why typing them matters

ACRA operates a small set of web properties. Everything else that looks like ACRA is not.

The advice ACRA gives here is the right advice and almost nobody follows it: type the address into your browser rather than clicking a link. Lookalike domains are cheap, convincing and easy to register. A link that reads correctly in the visible text can point anywhere, and on a phone you usually cannot see where.

If you do click, check that the address ends in gov.sg before you type anything into the page. Not “contains” gov.sg. Ends in it. A domain like bizfile-gov-sg.example is not a government site, and neither is acra.gov.sg.login-verify.example, even though both read plausibly in a hurry.

The wider impersonation rules

Beyond ACRA specifically, there are four things a genuine Singapore government official will never do on a phone call:

1. Ask you to transfer money.
2. Ask you to disclose bank log-in details.
3. Ask you to install a mobile app from an unofficial app store.
4. Transfer your call to the Police.

The fourth is the least known and the most useful, because the fake call transfer is the pivot in a lot of scripts. You are told the matter is now criminal, the line clicks, and a second “officer” comes on to add authority and urgency. Genuine agencies do not hand callers around like that.

Government SMS, where it is sent at all, comes from the gov.sg Sender ID. There are documented exceptions for National Service call-ups and emergency services, but for anything touching your company registration, treat an SMS from any other sender as fake.

And do not be reassured by the caller knowing things about you. Scammers routinely open with your name or NRIC number to establish credibility. Personal data leaks constantly. Knowing your NRIC number proves nothing at all about who is calling, which is one of the reasons Singapore has been moving away from treating the NRIC number as a secret at all. Our note on what the NRIC phase-out means for company KYC and onboarding covers the shift and what it means for your own verification procedures.

What goes wrong: a company registered in your name

Here is the practical consequence, and it is the part the advisory does not spell out.

If someone obtains your Singpass credentials and registers a business against your identity, you are now on a public register as the person behind that entity. Everything that follows attaches to your name. The entity has filing obligations. It may open a bank account. It may be used to receive proceeds of fraud, to apply for credit, or to sponsor work passes. Your own subsequent dealings, from a mortgage application to a professional licence, will surface it.

Unwinding it is not a phone call. It involves reporting the fraud, establishing to the registry’s satisfaction that the registration was not yours, and then a rectification or deregistration process that runs on the registry’s timetable rather than yours. Meanwhile the entity exists. If the register shows you as an officer of something you did not create, you have a serious problem and it is not self-resolving.

Directors of real companies have an adjacent exposure. Bizfile access is granted to people, and a compromised Corppass or Singpass account in the hands of someone else can be used to make filings against your live company: changing a registered address, appointing an officer, altering shareholdings. This is exactly why access control is worth taking seriously, and why our guide to who should have Bizfile access and which Corppass roles to assign argues for the smallest workable number of people with filing rights. Nominee arrangements sharpen the point further: the Singapore courts have been treating the misuse of nominee directorships with increasing severity, as the sentencing framework discussed in our note on Public Prosecutor v Zheng Jia makes clear.

The steps, in order, if you think something has happened

1. Do not engage further. Stop replying, stop clicking, do not “verify” anything through the channel that contacted you.
2. Change your Singpass password and review your 2FA settings if you disclosed anything at all, or if you are unsure whether you did.
3. Check what is registered against you. You can see the entities and positions attached to your own identity by logging in to Bizfile as an individual user with Singpass. If you have not done that before, our guide to logging in to Bizfile as an individual walks through it.
4. Call the ScamShield Helpline on 1799 if you are unsure whether what you received was a scam. It operates around the clock and it exists for exactly this question.
5. Report misuse of Singpass access to the Police, on 1800-255-0000 or online through the Police i-Witness service.
6. Contact ACRA directly to verify an email or link, or to raise a registration you do not recognise. The Helpdesk number published in the advisory is 6248 6028, operating Monday to Friday, 8.30am to 6.00pm. Reach it by typing the ACRA address into your browser rather than by using any number supplied in the suspicious message.
7. Tell your corporate secretary. If a filing has been made against your company, the sooner someone who reads the register weekly knows about it, the sooner it can be caught and corrected.

Two habits that make this a non-event

Check your own register on a schedule. Officers and members can download their company’s statutory registers from Bizfile at no cost and with no limit on frequency, so the only cost of a monthly look is the two minutes it takes. An unauthorised filing that sits unnoticed for a year is a crisis. The same filing caught in three weeks is an administrative correction.

Keep filing rights narrow. Most companies hand Bizfile access to more people than need it, often because it was convenient once. Access granted is access that can be phished. Reviewing the list annually is one of the cheapest controls available to a small company, and if you use an external provider, the ability to remove their filing access cleanly matters too: see removing filing access for an appointed CSP. Providers themselves now operate under a tighter statutory regime, summarised in our Corporate Service Providers Act 2024 compliance FAQ.

For general scam guidance beyond company matters, ScamShield is the government’s consolidated resource.

Frequently asked questions

Does ACRA ever send SMS or WhatsApp messages?
No. ACRA’s advisory states that it does not contact customers through SMS or WhatsApp, and that it will never send QR codes through SMS, messaging apps or other non-official platforms to ask for Singpass login details. Any message of that kind claiming to be ACRA is fraudulent, regardless of how official it looks.

How do I check whether an email is really from ACRA?
Look at the sender domain and the links. Genuine ACRA email comes only from addresses ending in @acra.gov.sg, and contains links only to acra.gov.sg or bizfile.gov.sg. If either test fails, treat it as fake. To confirm, contact ACRA using a number or form you reached by typing the ACRA address into your browser yourself.

Someone used my Singpass to register a business. What do I do first?
Report the misuse of Singpass access to the Police, on 1800-255-0000 or through the i-Witness online submission, and contact ACRA to flag the registration. Change your Singpass password and review your two-factor settings. Then check, through Bizfile as an individual user, exactly what entities and positions are recorded against your identity.

Is ACRA running a survey that asks for my bank details?
No. ACRA has stated that it has not commissioned any surveys requiring details such as your Singpass ID or bank account information. A caller or emailer conducting a “survey on ACRA’s behalf” and asking for those details is running a scam. End the interaction and, if unsure, call the ScamShield Helpline on 1799.

The caller knew my name and NRIC number. Doesn’t that prove they are genuine?
No. Scammers routinely cite personal details to appear legitimate, and that data circulates widely. Knowing your name, NRIC number or even your company’s UEN proves nothing about who is calling. Verify through a channel you initiated yourself, never through contact details the caller supplied.

Which web addresses are genuinely ACRA’s?
ACRA’s corporate site is at acra.gov.sg and its filing portal is bizfile.gov.sg. It also operates vcc.bizfile.gov.sg for Variable Capital Companies, apimall.acra.gov.sg, acratrustbar.gov.sg for document verification, and elearn.acra.gov.sg for its academy. Every genuine address ends in gov.sg. Type them rather than clicking links.

Someone should be watching your register

Most scam damage to a company is not done at the moment of the scam. It is done in the months afterwards, while nobody notices that the register has changed.

Raffles Corporate Services maintains statutory registers and filing access for several hundred Singapore companies, reconciles ACRA’s records against clients’ own, and notices when something does not belong. If you have had a suspicious approach, or you are simply not sure who currently holds filing rights over your company, that is a short conversation worth having this week rather than next year.

You can reach us through Raffles Corporate Services, or read more on Singapore corporate secretarial practice at Singapore Secretary Services.

— The Editorial Team, Raffles Corporate Services