The Online Criminal Harms Act Explained: How Scam-Related Directions Work in Singapore

Report the scam message first. Then read this. The single action that stops a phishing link from claiming another victim is a police report filed through the ScamShield app or the hotline. Do that before you close the tab.

The common wrong assumption about Singapore's Online Criminal Harms Act is that it is just another version of POFMA, the falsehood law. It is not. OCHA targets material that facilitates a crime, regardless of whether that material is true or false. A phishing link that tells the truth about a bank's opening hours is still a phishing link. That distinction is the entire point of the Act.

The Online Criminal Harms Act 2023 (No. 24 of 2023) received presidential assent on 21 July 2023 and came into force for its main parts on 1 February 2024. It empowers the Ministry of Home Affairs, through a designated competent officer, to issue directions to designated online services to remove, block, or disable access to material that facilitates specific criminal offences. Those offences include scams, phishing, and malicious cyber activity. The Act creates a system of platform obligations that sit alongside, and are separate from, the existing POFMA framework.

If you operate a platform that the government designates as a "designated online service" under the Act, you have obligations. The Act does not apply to every website. It applies to services that the Minister for Home Affairs declares by order in the Gazette. Once designated, that platform must comply with directions issued by the competent officer. The officer is a public servant appointed under the Act, not a minister acting alone.

The Act defines online criminal harm as material that is, or appears to be, used to facilitate a criminal offence. That definition is broad. It covers material that enables a person to commit an offence under the Penal Code, the Computer Misuse Act, the Moneylenders Act, and other listed statutes. If a post tells a reader how to create a phishing page, even if the instructions are accurate, that post can be targeted. The truth value of the material is irrelevant. The only question is whether it facilitates a crime.

The Act creates four types of direction that the competent officer can issue to a designated online service. Each has a specific target and a specific action the platform must take.

Direction To Remove

A direction to remove requires the platform to take down specific scam material that is accessible to end-users in Singapore. The platform must do this within the time period specified in the direction, which is usually hours, not days. Failure to comply within the timeframe is an offence.

Direction To Block

A direction to block prevents end-users in Singapore from accessing a specific piece of material without necessarily removing it from the platform entirely. The material remains on the platform's servers but is made unavailable to Singapore users. This is the option the officer uses when removal would affect users in other jurisdictions who may have a legitimate interest in the material.

Direction To Disable Access

A direction to disable access targets the account or channel that is distributing the scam material. It requires the platform to disable the account's ability to post or share, again within a specified timeframe. This is the tool the officer uses when the same account is the source of multiple pieces of harmful material.

Account Restriction Direction

An account restriction direction goes further than disabling access. It requires the platform to restrict the account's functionality entirely, including its ability to receive messages, follow other accounts, or be discovered in search. The Singapore Police Force may coordinate with the officer to identify accounts that warrant this level of restriction.

The scope of the Online Criminal Harms Act is defined by the list of criminal offences it references. The Act targets material that facilitates an offence under the Penal Code, the Computer Misuse Act, the Moneylenders Act, the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, and a handful of other statutes. A post that instructs a reader on how to carry out a phishing attack is in scope. A post that falsely claims a government minister took a bribe is not in scope under OCHA, because that claim, even if false, does not facilitate a criminal offence. That false claim would fall under POFMA instead.

The Act also covers material that facilitates malicious cyber activity. This includes instructions for carrying out a denial-of-service attack, malware distribution, and tutorials on how to compromise a computer system. The Act does not require that the material itself be illegal. It requires that the material facilitates an illegal act. A tutorial on how to write a computer virus is in scope even if the tutorial is accurate and well-intentioned, because the tutorial facilitates the creation of malware.

The confusion between the Online Criminal Harms Act and the Protection from Online Falsehoods and Manipulation Act is understandable. Both give the Singapore government powers to direct platforms to act on material. But the two laws target different problems and use different tests.

POFMA Targets Falsehoods That Affect The Public Interest

POFMA addresses false statements of fact. A statement must be false, and it must affect the public interest in one of the specific ways the Act lists: public health, public safety, public finances, the integrity of elections, or relations with other countries. If a statement is true, POFMA cannot touch it, regardless of how harmful the statement may be. POFMA issues Correction Directions that require the platform to display a correction notice next to the false statement. In more serious cases, Targeted Correction Directions require the platform to send the correction to users who have seen the falsehood.

OCHA Targets Material That Facilitates Crime, Regardless Of Truth

OCHA does not care whether the material is true or false. It cares whether the material facilitates a criminal offence. A true statement about how to create a fake bank website is in scope. A false statement about a bank's interest rates is not, unless that false statement is itself part of a scam. The two laws can apply to the same piece of material if the material is both false and facilitates a crime. In that case, the government can use either or both laws.

Different Enforcement Bodies And Different Appeal Routes

POFMA is administered by the POFMA Office under the Ministry of Communications and Information. OCHA is administered by a competent officer under the Ministry of Home Affairs. A person subject to a POFMA direction can appeal to the High Court. A person subject to an OCHA direction can also appeal, but the appeal mechanism is different: the Act provides for a review by the competent officer, followed by an appeal to the High Court if the review does not resolve the matter.

The Act sets a maximum fine of $1 million for a designated online service that fails to comply with a direction. The fine applies to the platform, not to an individual employee. For an individual who obstructs the competent officer or who provides false information in connection with a direction, the penalty is a fine or imprisonment for up to 12 months, or both.

The appeal mechanism is a two-stage process. First, the platform can apply to the competent officer for a review of the direction. The officer must consider the application and issue a decision within a specified period. If the platform is not satisfied with the review decision, it can appeal to the High Court. The High Court has the power to confirm, vary, or cancel the direction. During the appeal process, the platform must still comply with the direction unless the High Court orders otherwise.

Concerns About Ministerial Discretion

Civil society groups and legal academics have raised concerns about the scope of ministerial discretion in the Act. The Act gives the Minister for Home Affairs the power to designate online services and to appoint the competent officer. Critics argue that this concentration of power in a single minister, without independent oversight, creates a risk of overreach. The Act does not require the competent officer to publish decisions or to give reasons for directions, although the officer may choose to do so. These concerns were raised during the Parliamentary debate in July 2023 by Members of Parliament and by civil society organisations such as the Association of Women for Action and Research and the Singapore chapter of the International Commission of Jurists.

The Act also requires the Minister for Home Affairs to issue a platform code of practice. The code sets out the obligations of designated online services in relation to scam material, including the steps they must take to prevent its spread. The code may require platforms to maintain a user reporting channel, to respond to reports within a specified timeframe, and to publish transparency reports on the number of directions they receive and the actions they take.

The code of practice is a living document. The Minister can amend it as the threat landscape changes. Platforms that fail to comply with the code face the same penalty as those that fail to comply with a direction: a fine of up to $1 million. The Act does not specify a minimum fine, so the court has discretion to set the penalty based on the severity of the non-compliance.

Use the platform's own reporting tool first. That flags the post for removal under the platform's terms of service. For scams that involve impersonation of a government official or a bank, report it to the Singapore Police Force through the ScamShield app or the police hotline. A platform report and a police report are different processes with different outcomes. The one that matters for criminal enforcement is the police report.

The failure case is doing nothing. If you see a scam message and assume someone else will report it, nobody does. The message stays up, and the next person falls for it. Take the 30 seconds to report it now.