Last updated 25 October 2026 — by Adrian Tan, SDM. Marketing guidance, not legal advice. References are to MHA, Singapore Police Force, ScamShield and CCS publications as read on 25 October 2026. Where we interpret how a rule applies to sellers, we say so.
A small fashion label in Jurong lists its end-of-season stock on Carousell. A Tampines hobby shop sells Pokémon cards through its Facebook Page and Marketplace. A skincare brand runs its main store on Shopee and Lazada, and a home baker takes orders through Instagram and WhatsApp. All four are legitimate businesses. All four are now selling into a market where the government’s main worry about online marketplaces is scams, and where the platforms are being pushed, by law, to treat every seller as a possible fraudster until proven otherwise.
That shift changes how a real business should list, advertise and take payment. The rules are mostly aimed at the platforms, not at you, but they decide which platforms ask for your identity, what a “verified” badge is worth, how buyers are told to spot a scam, and how quickly a suspicious-looking listing can be taken down. This guide explains the framework as it stands in October 2026, the numbers behind it, and what a seller should do differently on each platform.
The short version
- The old safety ratings are gone. MHA’s Transaction Safety Ratings, which scored marketplaces on their anti-scam features from 2022, were replaced on 24 August 2026 by the E-Commerce Scams Situation Report, which reports actual scam cases and losses by platform.
- Only three services are legally designated. Under the Online Criminal Harms Act’s E-Commerce Code, the designated services are Carousell, Facebook Marketplace and Facebook Business Pages. Shopee, Lazada, Amazon and TikTok Shop are not designated under that code.
- Designated platforms must verify sellers against government records and offer payment protection. The enhanced code issued on 17 August 2026 adds tighter login checks, with compliance due by 31 January 2027.
- A Singpass badge is no longer proof on its own. MHA found scammers buying and taking over Singpass-verified Carousell accounts, so buyers are being told to look for more than a badge.
- E-commerce scams rose in the first half of 2026: 3,865 cases, up 19.3%, with about $8.3 million lost.
- For sellers, the safest-looking behaviour is now the norm: keep payment inside the platform, stay on the platform’s chat, show who you are, and never hand your account to anyone.
From safety ratings to scam outcomes
The framework began on 14 May 2022, when the Inter-Ministry Committee on Scams launched the E-commerce Marketplace Transaction Safety Ratings (TSR) alongside a revised Singapore technical reference for e-commerce, TR 76. The TSR gave each marketplace between one and four ticks across four areas: whether users are who they claim to be, how safe transactions are, whether buyers have channels to recover losses, and how well the platform’s anti-scam measures work. MHA reviewed the ratings every year, and they became a shorthand for which platforms were safest to buy on.
The final ratings, for 2025, are still on MHA’s TSR page, which was last updated on 4 March 2026. Amazon, Lazada, Shopee and TikTok Shop each held four ticks, with TikTok Shop rated for the first time. No platform sat at three ticks. Carousell had two and Facebook Marketplace had one. The feature breakdown explains the gap. The four top-rated platforms all verify seller identity and offer secure payment. On Carousell both were “optional”, and Facebook Marketplace offered neither. All six monitored fraudulent seller behaviour and kept transaction records.
On 24 August 2026 the TSR was retired. The first E-Commerce Scams Situation Report (ESSR), published on ScamShield, says it “replaces” the ratings. The difference matters. The TSR rated what a platform had built. The ESSR reports what actually happened: how many scams were reported on each platform and how much money was lost. For a seller, that means the platforms are now publicly compared on outcomes, which gives every platform a strong reason to remove anything that looks risky, quickly.
Which platforms the law actually regulates
The legal teeth come from the Online Criminal Harms Act 2023 (OCHA). Its directions and information-gathering powers took effect on 1 February 2024, and its Codes of Practice on 24 June 2024. The E-Commerce Code took effect on 26 June 2024 and originally designated Carousell, Facebook Marketplace, Facebook Advertisements and Facebook Pages as the services carrying the highest e-commerce scam risk.
The code requires designated services to do two things that sellers notice directly. First, they must verify users who advertise or post about selling goods or services against government-issued records. Second, they must offer optional payment protection that releases money only after delivery is verified. On top of that, they must quickly disrupt malicious accounts, guard against fake accounts and bots with strong login checks, and report annually.
The enhanced codes issued on 17 August 2026 reshaped the list. The E-Commerce Code now designates Carousell, Facebook Marketplace and Facebook Business Pages, while Facebook advertising moved to a new Social Media Code. The enhanced E-Commerce Code keeps seller verification and payment protection, adds “stronger consent measures” before logins from new or unrecognised devices are allowed, and imports the Social Media Code’s scam-ad safeguards: removing suspected scam ads, verifying advertisers against government records, and barring ads for unlicensed financial services. Platforms must comply by 31 January 2027. The police said scam cases on all designated services fell by about 37% between 2024 and 2025.
What is not on the list is just as important. Shopee, Lazada, Amazon, Qoo10 and TikTok Shop are not designated under the E-Commerce Code. That is not a loophole. The four-tick platforms already verified sellers and offered protected payment under the ratings system, so the law was aimed at the gaps. TikTok is designated under the Social Media Code instead. We cover the advertising side of these codes, including advertiser verification and OCHA directions, in our guide to Singapore’s online advertising rules and anti-scam codes.
How the phasing played out
MHA did not force every designated platform to verify every seller on day one. It let them start with risky sellers and set a test: if scams did not fall, all-seller verification would follow. Carousell was assessed from July to December 2024, Facebook Marketplace from June to November 2024. In its 10 March 2025 assessment, MHA found that Facebook Marketplace scams had fallen by about 55%, so full verification was not required there. Carousell’s had fallen by only about 11%, which MHA called “not a significant decrease”, and its pilot was extended to 30 June 2025.
The Carousell lesson: why a verified badge is not enough
The most useful part of the story for sellers came on 21 November 2025. Reporting on Carousell’s extended pilot, MHA said e-commerce scams on Carousell rose about 9% in April to June 2025, to 513 cases from 470, even though total scams on the platform fell 36%, to 720 from 1,125. The reason was new. Scammers were increasingly using Singpass-verified accounts that they had taken over, bought, or opened with stolen or purchased Singpass credentials.
In other words, the verification badge had become something scammers wanted to own. MHA did not impose all-seller verification. Instead, Carousell committed to three safeguards by 31 January 2026: passkey and biometric logins, suspending accounts that had been handed over to scammers, and blacklisting the Singpass credentials linked to suspended scam accounts so they cannot verify new ones. MHA also said it was considering new offences for knowingly handing over Singpass-verified accounts.
For a legitimate seller, the lesson cuts both ways. A verified profile is still the baseline trust signal on Carousell, and you should have one. But buyers are now being told, correctly, that a badge alone does not prove a seller is genuine. Your listing has to carry other evidence too, which we come to in the seller playbook below.
The numbers: e-commerce scams in the first half of 2026
The first ESSR covers January to June 2026, and it does not show a problem that is going away. E-commerce scams rose to 3,865 cases from 3,240 in the first half of 2025, an increase of 19.3%. Losses rose to about $8.3 million from $7.0 million. By contrast, police figures reported for all scam types showed cases down about 14% over the same period, so e-commerce is moving against the overall trend.
Three details in the report matter to sellers. First, collectibles are a hotspot: Pokémon trading card scams more than doubled to 605 cases, 15.7% of all e-commerce scams, with losses of about $1.2 million. If you sell cards, figures or limited releases, assume buyers are nervous. Second, the platforms differ: Facebook had the highest losses at about $2.7 million, while Carousell had the most cases, with about $1.0 million lost, and Carousell and Telegram were the most common places scammers first contacted victims. Third, sellers are victims too. The report describes sellers who shipped goods to fake buyers after receiving fake proof-of-payment screenshots.
The ESSR’s advice to buyers is effectively a description of the seller they will trust: choose platforms that verify users against government records, keep payment inside the platform until delivery is confirmed, and use platforms that remove suspicious accounts and listings proactively.
TR 76: the voluntary standard behind the rules
TR 76 is Singapore’s technical reference for business-to-consumer e-commerce. It was first published in 2020 and revised in May 2022 to add anti-scam guidance for e-retailers and marketplaces, covering the stages before, during and after a purchase, customer support and merchant verification. MHA noted at the time that marketplaces which adopted TR 76 generally scored better on the safety ratings.
An enhanced version was announced jointly by Enterprise Singapore, the Competition and Consumer Commission of Singapore (CCS) and MHA on 26 September 2025. Its anti-scam measures include due diligence and identity verification of merchants against government records, suspending fraudulent accounts, detecting suspicious content, responding to regulators within 24 hours unless a legal order sets another deadline, and keeping records. It also tackles fake reviews, misleading interfaces, subscription traps, the accurate display of discounts and a platform’s preferential treatment of its own listings. TR 76 is voluntary; CCS “encourages” businesses to adopt it. The consumer-protection side of it is covered in our guide to dark patterns and fake urgency in Singapore e-commerce.
Why should a small seller care about a standard aimed at platforms? Because it describes what the platform will check you for. If a marketplace has adopted TR 76, expect merchant identity checks against ACRA or Singpass records, automated flags on suspicious content, and fast account suspensions when a regulator asks.
What this means for how you list, advertise and take payment
None of the rules above makes a seller do anything by law. They do, however, change what a trustworthy listing looks like, and they make it more likely that a listing which looks like a scam is treated as one. This is our reading of the practical consequences.
Get verified, then prove more than the badge
On Carousell and Facebook, complete whatever identity verification the platform offers. It is the trust signal the whole regime is built around, and buyers are told to look for it. But since MHA has said scammers buy verified accounts, add evidence that is hard to fake: a long transaction history and reviews, your registered business name and UEN, a link to your own website, a physical pickup address where you have one, and consistent branding across your Shopee, Lazada, Instagram and Facebook profiles. If you trade as a business, a business account rather than a personal one helps buyers see that you exist outside the platform.
Keep payment inside the platform, and say so
Every official source now tells buyers to pay through in-platform checkout that holds money until delivery. A seller who asks for PayNow or a bank transfer to a personal account looks exactly like the scams buyers are warned about. Use the platform’s payment protection wherever it exists, state in the listing that you only accept in-platform payment, and if you sell through Facebook or Instagram without a checkout, send buyers to a proper store page with a recognised payment gateway. Our guide to payment gateways for Singapore businesses compares the options.
Think twice before moving buyers to WhatsApp or Telegram
The ESSR names Telegram as one of the most common channels scammers use to reach victims. Asking a buyer to “continue on Telegram” now reads as a red flag. It also changes your legal position. Once you collect a buyer’s phone number and personal details off-platform, you are the organisation responsible for that data under the Personal Data Protection Act, with duties around consent, purpose and protection, and any later promotional messages engage the Do Not Call rules. If you use WhatsApp for order updates, do it through a verified business account, and read our guides to WhatsApp marketing rules in Singapore and PDPA rules for marketing and tracking.
Make listings look like a business, not a bargain that is too good
Scam listings share features: prices well below market, stock that is “almost sold out”, pressure to pay quickly, and photos lifted from someone else’s shop. Those tactics trigger platform filters and buyer suspicion, and false discounts or fake urgency can breach the Consumer Protection (Fair Trading) Act. Use your own photos, explain any discount against a genuine previous price, and describe condition and delivery times accurately.
Protect your account like a shop key
Turn on passkeys or biometric login where offered, and never let anyone else use your verified account, even a friend “helping out”. MHA has said it is considering offences for knowingly handing over Singpass-verified accounts, and Carousell already suspends accounts that have been handed to scammers and blocks the linked Singpass credentials from verifying again. Losing a verified seller account can mean losing your reviews and history with it.
Protect yourself as a seller
Never ship against a payment screenshot. Confirm the money is actually in your account or held by the platform before you release goods, and be wary of buyers who insist on a courier they arrange or who send “proof” of a payment you cannot see. The ESSR describes exactly this pattern.
Expect your Facebook Page and ads to be checked
Facebook Business Pages are now designated, and the enhanced code brings stronger login checks and advertiser verification against government records by 31 January 2027. If your business sells through a Page or runs Facebook and Instagram ads, keep the Page’s business details, admin roles and verification current, so a check does not interrupt your campaigns. Impersonation of your own Page by scammers is a separate risk, covered in our guide to protecting your brand from impersonation.
| Where you sell | Designated under the E-Commerce Code? | 2025 rating | What to do as a seller |
|---|---|---|---|
| Carousell | Yes | 2 ticks | Verify, use protected checkout, add business details and history, turn on passkeys |
| Facebook Marketplace | Yes | 1 tick | Link to a real store or checkout, avoid off-platform transfers, keep a verified Page behind your listings |
| Facebook Business Page | Yes (from Aug 2026) | Not rated | Keep business details, admins and verification current before 31 Jan 2027 |
| Shopee, Lazada, Amazon | No | 4 ticks | Seller identity is already checked; focus on accurate listings and genuine discounts |
| TikTok Shop | No (TikTok is under the Social Media Code) | 4 ticks | Keep sales inside TikTok Shop checkout; expect ad and advertiser checks |
| Your own website | No | Not rated | Show your UEN, address, returns policy and a recognised payment gateway |
Four worked examples
The Pokémon card shop. A Tampines hobby shop sells sealed booster boxes on Carousell and through its Facebook Page. Given that card scams more than doubled in the first half of 2026, it completes verification on both, lists only through Carousell’s protected checkout, adds its shop address and opening hours for collection, and pins a post on its Page saying it never asks for bank transfers. Its listings use its own photos of the actual stock, with a date card in shot.
The fashion label clearing stock. A Jurong label moves end-of-season stock on Carousell. Instead of pricing everything at a dramatic “90% off”, it states the original retail price on its own website and the clearance price, links the listing to its site, and uses a business profile with its UEN. It accepts in-platform payment only.
The skincare brand on Shopee and Lazada. Its marketplaces are not designated, and its identity was checked when it opened its stores. Its exposure is different: copycat sellers and scam pages using its name on Facebook. It focuses on consistent branding, a verified Facebook Page that links to its official stores, and a “where to buy” page on its site listing every genuine storefront, so buyers can check.
The home baker on Instagram and WhatsApp. She takes orders by direct message. She moves to a simple order page with a recognised payment gateway, uses WhatsApp Business only for order updates to customers who have ordered, and stops asking new customers for PayNow before she has confirmed who they are. Her bio states her real business name and pickup area.
Who carries the penalties
The penalties in this framework fall on the platforms. Under OCHA as it stands, failing to comply with a Rectification Notice is an offence carrying a fine of up to $1 million, plus up to $100,000 a day for a continuing offence. The Scams (Countermeasures) and Other Matters Bill, which passed Parliament on 9 September 2026, raises this to up to $10 million plus $300,000 a day, and introduces administrative penalties of up to $10 million per breach. We have not been able to confirm when those higher penalties commence.
Sellers are affected indirectly but sharply. OCHA lets the authorities direct platforms to disable content, stop communications or restrict accounts on suspicion, and platforms facing those penalties will act first and ask questions later. A legitimate seller whose listings look like scams is the most likely collateral damage.
Where this leaves you
Singapore’s approach to marketplace scams has moved from rating platforms on their features to regulating the riskiest ones and publishing scam outcomes for all of them. For an honest business, the practical result is simple: the safest way to sell is also the way that converts best in a nervous market. Be verifiable, keep the money and the conversation on the platform, show who you are beyond a badge, and treat your seller account as a business asset.
If you want to build a store and marketing setup that buyers trust, our web design and e-commerce team in Singapore can help, and you can see results we have delivered in our client case studies. For the wider picture, start with our complete guide to web design in Singapore and our guide to digital marketing for Singapore e-commerce businesses.
Frequently asked questions
Do I need Singpass verification to sell on Carousell?
The Online Criminal Harms Act E-Commerce Code requires Carousell to verify sellers against government-issued records, and verification is done through Singpass. After its pilot, MHA did not require every seller to be verified, so check Carousell’s current flow. Being verified is still the trust signal buyers are told to look for.
Are Shopee and Lazada covered by the E-Commerce Code?
No. As of the enhanced code issued in August 2026, only Carousell, Facebook Marketplace and Facebook Business Pages are designated. Shopee, Lazada, Amazon and TikTok Shop already verified sellers and offered secure payment, earning four ticks in the final 2025 safety ratings.
What happened to the Transaction Safety Ratings?
They were replaced on 24 August 2026 by the E-Commerce Scams Situation Report, which reports scam cases and losses by platform rather than safety features. The final 2025 ratings gave Amazon, Lazada, Shopee and TikTok Shop four ticks, Carousell two and Facebook Marketplace one.
When do the new marketplace rules take effect?
The enhanced E-Commerce Code was issued on 17 August 2026, and designated platforms must comply by 31 January 2027. It adds stronger login checks for new devices and scam-ad safeguards, including advertiser verification against government records.
Is TR 76 mandatory for online sellers?
No. TR 76 is a voluntary Singapore technical reference for e-commerce, enhanced on 26 September 2025, and CCS encourages businesses to adopt it. Platforms that follow it check merchant identity, suspend fraudulent accounts and respond to regulators within 24 hours.
Can I be penalised as a seller under these codes?
The code penalties fall on platforms, up to $1 million plus $100,000 a day today. Sellers face account action instead: platforms can remove listings or restrict accounts that look like scams, and false claims in listings can breach the Consumer Protection (Fair Trading) Act.
