SG orders Apple, Google to block gov't spoofing on messaging apps

Singapore has directed Apple and Google to block impersonation of government agencies on their messaging platforms, following a rise in scams using iMessage and Google Messages.

The order, issued under the Online Criminal Harms Act, requires both companies to prevent accounts and group chats from displaying names that mimic “gov.sg” or other official agencies, or to filter such messages.

Authorities said the move follows incidents where scammers pretended to be companies like SingPost on these platforms.

Currently, government agencies use a local SMS registry to protect the “gov.sg” name, but this does not extend to iMessage and Google Messages.

Apple and Google have agreed to comply, and are advising users to update their apps for new security measures.

🔗 Source: Reuters

🧠 Food for thought

Implications, context, and why it matters.

Singapore directive exposes gaps in SMS and OTT security

Singapore’s SMS Sender ID Registry (SSIR) launched in March 2022 and became mandatory 31 January 2023, with SMS scams down 64% from Q4 2021 to Q2 2022 1. It does not cover iMessage or Google Messages, which lets scammers mimic government agencies there 2.
The Online Criminal Harms Act (OCHA) lets authorities issue directives, seen when Singapore threatened Meta with fines in September for Facebook impersonation scams 2. Apple and Google now must block spoofed ‘gov.sg’ display names or filter those messages, with no timeline or penalties disclosed 2.
Traditional telecom rules like SSIR cover SMS via operators including Singtel or StarHub or M1 1 while OTT apps sit outside and need platform-by-platform enforcement.

CPaaS and reg-tech can fix cross-channel sender checks in APAC

Communications Platform as a Service (CPaaS) providers can build tools to unify sender ID checks across SMS and OTT apps. Singapore’s telecom operators use anti-scam filtering with machine reading technology (automated content scanning) for SMS 1, yet no local registry or verification covers iMessage or Google Messages 2.
Regulatory technology (reg-tech) firms in Asia-Pacific (APAC) can offer compliance products for varied national rules. Singapore polices spam under the Spam Control Act 2007, which requires consent 3, while OCHA with SSIR form a separate track that could push OTT rules elsewhere.
Investors should watch if Singapore extends SSIR to cover OTT messaging or backs third-party verification providers. Such moves would validate cross-channel anti-impersonation products and spur regulator vendor partnerships.