What to Do When Someone Is Impersonating You Online

If the impersonation involves a threat, doxxing, or an attempt to get money from your contacts, call the Singapore Police Force first. Do not start with a platform report. Someone using your photos to ask your friends for a loan, or posting your address and promising violence, is a police matter. Dial 999 if there is an immediate physical threat. For everything else, use the non-emergency hotline 1800-255-0000. Delaying to file a platform report gives the scammer hours to do real damage. The platform report comes second.

Before you delete, block, or report anything, document the fake profile with screen-grabs. Capture the profile page, the bio, the posts, and the direct messages. Include the URL in the address bar and the timestamp.

This is the only evidence you will have if the profile is taken down before the police ask for it. A screen-grab of the impersonator's message to your colleague is worth more than a description of it. Do this for every device you find the profile on. If it sits on a service you do not use, ask a friend to capture it for you. Store the images in a folder you can share, not just on your phone's camera roll.

Each major service has its own reporting flow for impersonation. Knowing which one you need halves the time you spend hunting. For Facebook, use the dedicated Meta impersonation reporting URL. On Instagram, the impersonation reporting path lives in the help centre under the same name. TikTok's impersonation report sits under the safety section of its support site. LinkedIn has a distinct form for false profiles.

The IMDA Online Safety Code requires these designated services to provide an easy-to-use mechanism for users to report harmful content, including impersonation, and to review and act on those reports within a specified timeframe. That requirement exists because services used to ignore these requests. Filing the report is not a police report: it is a request to enforce the company's terms of service, nothing more.

A platform report and a police report are not the same action. Confusing them is a common error.

A platform report asks a private company to remove content because it violates their rules. A police report initiates a legal process under Singapore law, including the Protection from Harassment Act. Reporting to Instagram does not file a report with the Singapore Police Force, and a police report does not automatically remove the fake profile. You may need both. The platform report gets the content down quickly; the police report gives you legal standing if the harassment continues. Do not let the confirmation page convince you the matter is closed. That confirmation only means the company is considering the case.

Harassment, Doxxing, And Malinformation

The Protection from Harassment Act, Chapter 256A, is the primary legal tool for impersonation that turns into harassment. POHA covers three distinct behaviours: harassment, doxxing, and malinformation. Doxxing means publishing personal information like your address or phone number with the intent to cause harassment, alarm, or distress. Malinformation is genuine information shared with intent to cause harm, such as a real photo of you used in a fake advertisement. POHA's doxxing provisions came into effect on 1 January 2020.

What POHA Does Not Cover

The Act also covers stalking and the fear, provocation, or facilitation of violence under Section 5. What POHA does not cover is a fake profile that simply sits there, doing nothing harmful. A dormant impostor profile that does not communicate with anyone may be a terms-of-service violation, but it is not necessarily a crime under POHA.

If the impersonation involves doxxing or repeated harassment, apply to the Singapore courts for a protection order. A protection order can compel the harasser to stop publishing your personal information and to remove content already posted. The application goes to the Magistrate's Court or the Family Court, depending on the circumstances. You do not need a lawyer to file, but representation helps because the court requires specificity about the acts of harassment. The court may issue an expedited protection order in urgent cases where there is a real risk of violence or serious harm. These orders target the individual publishing the content, not the service hosting it. A protection order is only as effective as the willingness of the police to enforce it.

Scammers exploit your willingness to trust official-looking channels. A fake profile that uses a government logo, a photo of a minister, or a URL that resembles a .gov.sg address is using the officialdom halo. The Elections (Integrity of Online Advertising) Act, which commenced in 2024, regulates online election advertising including AI-generated content that misrepresents candidates, and the Singapore Deepfake Accountability and Robustness Act, Act 29 of 2025, adds further obligations. But these laws do not stop a scammer from using a generic photo and a convincing name.

The police will never contact you through WhatsApp to demand a fee, and the courts will not ask you to pay fines through a fake profile. When you see a government name on a fake profile, verify through the official website, not through the message the scammer sent you.

The Protection from Online Falsehoods and Manipulation Act, Chapter 258, exists to correct online falsehoods, not to remove fake profiles. POFMA allows the government to issue correction orders or take down content that is against the public interest. It is not a mechanism for an individual to demand a service remove a fake profile of yourself. If a fake profile is spreading falsehoods about you, POFMA is not the tool. The POFMA Office handles the government's enforcement.

Your recourse is POHA if the content harasses you, the service's terms of service if it merely violates their rules, or the police if it is a scam. Filing a complaint under POFMA without government support will go nowhere. Know which law applies to which problem.

ScamShield And Reverse Image Search

ScamShield, developed by the Government Technology Agency and the Singapore Police Force, blocks calls and SMS messages reported as scams. It is a useful shield against the phone-based version of impersonation, but it does not remove fake social media profiles. A reverse image search can tell you where your photos have been used before, which helps you find other fake profiles you did not know about. Upload a suspicious image to a public image search engine, but be aware that this may reveal the identity or location attached to that image.

Domain Checks And Official Channels

For domain-based impersonation, such as a fake website using your name, look up the WHOIS record to see when the domain was registered and by whom. A domain that is a few days old is a red flag for a scam. The Singapore Police Force non-emergency hotline and the online police report portal at eservices.police.gov.sg are your official channels.

When you file a police report, you create a legal record. The Singapore Police Force Anti-Scam Command, formed in 2022, centralises the investigation and disruption of scam operations. A report for impersonation involving fraud will be investigated under the Computer Misuse Act if there is unauthorised use of a computer service, covered by Section 6. A report for pure harassment goes to the investigating officer handling your case, who will assess whether POHA has been breached. The police will ask for your screen-grabs, the URLs, and a timeline. They investigate the person behind the profile, not the hosting service. If the profile traces to someone you know, the police may pursue charges. If it traces to an overseas server, the practical outcome may be limited, but the report still matters because it documents the pattern.

Services take time to respond. Some take days. If it is late at night and the fake profile is actively messaging people, you have three options.

First, block the profile immediately. This stops the scammer from contacting you further. Blocking prevents the profile from seeing or interacting with you; muting only hides their content from your view. Second, change your own password and enable two-factor authentication. A fake profile may be a sign that your own credentials have been compromised. Third, tell your immediate circle what is happening so they do not fall for the fake profile's requests.

The failure case is that the service is closed because its support team does not work 24/7, and you have to take the damage-limiting steps yourself. The police report can wait until morning. The blocking cannot.

Every day a fake profile remains active, it builds a digital shadow in your name. Search engines index it. Scammers use it to build trust with your contacts. The content you posted years ago becomes raw material for the impersonation.

The Singapore Police Force reports that impersonation scams alone accounted for a significant portion of the S$1.1 billion in total scam losses for 2024, and the government official impersonation scam category grew despite public education. The cost of not acting is not just emotional distress; it is the risk that your friends and family lose money because they trusted a profile carrying your name and face. The service may eventually remove the profile, but the window of harm is real. Check the police's annual statistics at police.gov.sg/media-room to see the current scale of the problem, but do not wait for those numbers to change before you act.

Since 18 July 2023, the IMDA has designated specific social media services under the Online Safety Code. Those services, including Facebook, Instagram, TikTok, X, YouTube, and HardwareZone, had to comply by 1 January 2024. The code requires these services to provide user reporting mechanisms for harmful content, including impersonation, and to act on those reports within a specified timeframe. The penalty for non-compliance is a fine of up to 10% of annual turnover in Singapore.

What this means for you: the service cannot legally ignore your impersonation report indefinitely. If a designated service fails to act, complain to IMDA. This is a faster route than a police report for getting a fake profile removed, because it targets the service's obligations rather than the identity of the scammer. The service has a financial incentive to comply. The penalty is substantial.

The Personal Data Protection Commission administers the Personal Data Protection Act, which covers how organisations collect and use your data. If the impersonation involves a company that has leaked your personal data and enabled the scam, make a complaint to the PDPC at [email protected]. The PDPC publishes enforcement decisions showing organisations fined for collecting, using, or disclosing personal data beyond what is necessary or without adequate consent.

The PDPC does not remove fake profiles and does not investigate harassment. It is a data protection authority, not a content moderator. If the fake profile was created using a data breach from a specific company, the PDPC complaint is useful. If the profile was created with publicly available information, the PDPC has no jurisdiction over the individual who made it.

Here is the sequence, in the order you should do it.

First, if there is a threat of violence or active fraud, call the Singapore Police Force on 999. Second, screen-grab everything. Third, report the profile to the service using the specific impersonation URL for that service. Fourth, assess whether the content is mere impersonation or whether it crosses into doxxing, harassment, or fraud. If it is the former, the service report may be enough. If it is the latter, file a police report online at the eservices portal or call 1800-255-0000. Fifth, if the harassment continues, apply to the court for a protection order under POHA. Sixth, inform your immediate network so they do not fall for the scam.

This order covers the harm, the evidence, and the legal process. Do not skip the police report because you think the service will handle it. The service can only remove content, not prosecute a crime.

This subject suits the reader who has been impersonated, or who suspects they might be, and wants a clear, actionable sequence that does not involve hiring a lawyer for a first step. It suits the reader willing to spend an hour on screen-grabs and report forms, and who understands that a service report and a police report are different actions. It suits the reader who wants to know when the Protection from Harassment Act applies, not just what it is called.

It does not suit the reader who wants a magic button that removes a fake profile instantly. No such button exists. It does not suit the reader outside Singapore looking for general advice about impersonation in other jurisdictions; the laws here are specific to Singapore and will mislead them elsewhere. And it does not suit the reader unwilling to file a police report. Without that report, the service has no obligation to act beyond its own terms of service.