On 22 October 2026 the Singapore Police Force announced that a two-week islandwide operation, run from 8 to 21 October, had put 277 people under investigation as suspected scammers or money mules. According to the police release, they are linked to more than 883 scam cases and about S$6.1 million in victim losses. The release says the suspects ranged from 15 to 76 years old and that the cases covered e-commerce, phishing, job, government-official impersonation, investment and lucky-draw scams.
The release is an enforcement announcement, not a data-policy document. But sweeps like this can only work if investigators can trace money through bank accounts and match transactions to people. That makes the operation a fair test of how Singapore governs the data powers behind it.
The strongest case for the current approach
The case for aggressive, data-driven enforcement is real. Scams are a high-volume crime in which the victim usually authorises the transfer, so the money moves fast and the trail is mostly financial. Money mules, who lend accounts to launder proceeds, are the chokepoint. Police can't find them without looking at account activity.
Singapore has also pushed enforcement upstream. The police release says people involved in mule-related offences "may face restrictions on banking services and mobile line subscriptions" to stop further facilitation of scams. The Protection from Scams Act 2025 added a related tool aimed at potential victims: restriction orders that limit a person's banking when police believe they are about to send money to a scammer.
A government that does this well can reduce real harm without censoring anyone or regulating platforms into silence. Much of the policy debate around scams focuses on content and intermediaries, so a data-driven approach to the crime has some appeal. Targeting accounts and money flows is narrower than demanding that platforms monitor every message.
What the public record does not show
Proportionality depends on knowing how often powers are used, against whom, and who checks them. On those questions the public record is thin.
The operation announcement gives outcomes (people investigated, cases, losses) but not the inputs. It does not say how many account-data requests were made, what legal authority was used, how many accounts were frozen, or how many people flagged were later cleared. "Investigated" and "assisting with investigations" are also not findings of guilt. A sweep that counts 277 people tells us little about error rates unless prosecution and clearance figures follow.
The restriction-order regime shows the same gap on a smaller scale. In a written parliamentary reply dated 4 March 2026, the Minister for Home Affairs said 12 restriction orders had been issued as of 15 February 2026. One had been lifted, two had ended at the statutory maximum of five extensions, and nine remained in effect. Ten of the 12 recipients asked to withdraw money for daily expenses, and police approved those requests. The reply also said banks would need significant system changes to support graduated restrictions, so the government is not prioritising them for now.
That is useful transparency, and it deserves credit. But the reply, as published, does not describe independent review of these orders, and every approval of a withdrawal runs through the same agency that imposed the restriction. For a regime this new and this small, a dozen orders is also too few to say whether it is proportionate.
Why other jurisdictions' disputes matter here
Singapore's system is not the American one, and the comparison should not be stretched. Still, recent disputes elsewhere show what happens when data access is not tightly bounded. On 1 October 2026 the Electronic Frontier Foundation reported that the Marin County Sheriff's Office in California shared automated license plate reader data with out-of-state and federal agencies, and EFF and the ACLU of Northern California are demanding more information. On 28 October EFF wrote that civil liberties groups filed a friend-of-the-court brief urging a federal appeals court to curb grand jury subpoenas used to unmask social media users who criticise immigration enforcement.
Those are US cases with US legal hooks, and neither involves scam enforcement. The shared lesson is that data collected for one purpose tends to drift to others unless purpose limits and audit trails are enforced. Anti-scam data powers are sympathetic today because the harm is concrete. Powers built for scams can still be reused.
What proportionate oversight would look like
None of this requires slowing enforcement. A pro-innovation, pro-speech position favours targeted tools over broad ones, and targeted tools earn trust by being measurable. Four low-cost steps would do that:
- Annual transparency reporting. Publish the number of account-data requests and restriction orders, the share that led to charges, and the share later dropped or cleared.
- Purpose limitation. State that data obtained under anti-scam authorities is used for scam and laundering investigations and nothing else, with audit logs available to a named oversight body.
- Independent review of restrictions. Where police can restrict a person's banking, add a review step outside the issuing agency, and publish how often it changes the outcome.
- Mule-specific safeguards. Many mules are young or are themselves deceived, and the release's age range of 15 to 76 shows the net is wide. Reporting should distinguish knowing facilitators from people tricked into lending an account.
These measures cost little and protect the programme's legitimacy. If sweeps like this keep producing headline numbers, the public should also be able to see the error rate.
Bottom line
Singapore's 8 to 21 October operation shows an enforcement model that can reach many suspects quickly, and the harm it targets is real. The next step is to publish the data behind it. Oversight figures are what let a state show its bank-data powers are proportionate rather than just asking to be trusted.