The tiny island nation of Singapore has one of the most tech-forward populations in the world, with nearly 91 per cent Internet penetration till 2022, growing to a projected 94 per cent by 2026. This is good for business, but this is also good for the business of fraud. The country, with a population of less than 6 million, was hit by 32 million cyber-crimes in the previous year, according to a new report — that makes it an average of more than 5 cyber-attacks per person in Singapore.
Ever innovative, the cyber-criminals are coming at Singapore citizens and residents in various ways. One such way is reaching the targeted victim’s wallet through their stomach. Take the innocuous comfort food favourite: pizza. Ordering pizza online, paying in advance, and then waiting for the delicious treat to arrive — this is what people all over the world do without a second thought. But in Singapore, trying to eat pizza could mean letting scammers take a bite out of one’s purse.
Fake website scam
A Singapore Police Force (SPF) media statement issued in December 2023 said: “The Police would like to alert members of the public to a new variant of phishing scam which involves fake Domino’s Pizza websites that were surfaced via advertisements on online search engines. Between 25 November and 6 December 2023, seven victims have fallen prey to this variant with losses amounting to around S$27,000.”
“Phishing” is exactly what it sounds like — “fishing”; in this case, fraudsters fishing for potential victims.
Its definition, according to the US-based digital communications technology conglomerate Cisco, is: “Phishing attacks are the practice of sending fraudulent communications that appear to come from a reputable source. It is usually done through email. The goal is to steal sensitive data like credit card and login information, or to install malware on the victim’s machine. Phishing is a common type of cyber-attack that everyone should learn about in order to protect themselves.”
This type of cyber-attack usually invites an e-mail recipient to click on a link which then takes the victim to a fraudulent website resembling a genuine website. Evidently, it’s also possible to pull victims into a fraudulent website through search engine results.
Singapore Police explained the pizza scam: “In these cases, victims reported falling prey to [a] phishing scam when they searched for ‘Domino’s Pizza’ on online search engine and clicked on an advertisement in the search results. These phishing websites may resemble the genuine website of Domino’s Pizza, including bearing similar URLs (e.g., domino-plza.com; order.domino.piza.com) and website layouts.
“Victims would place an order through the phishing scam websites and disclose their credit card details to make payment. Victims would realise that they had been scammed after they were notified or discovered unauthorised card transactions made on their debit/credit cards.”
Sometimes the phishing bait is pizza; sometimes it is a cheap concert ticket. The Singapore Police Force, which keeps posting awareness messages on social media, alerted the public through a video, with the text: “Be careful when buying concert tickets from online third-party resellers.”
With a series of concerts slated to be held in Singapore in 2024, this is one warning the public need to take very seriously, especially for those can-you-believe-it last-minute deals. As they say: “If it looks too good to be true, then it probably is.”
Impersonation scam
Even before the victims of the fake Domino’s Pizza website scam could come to grips with the huge losses they had suffered — nearly SGD 4,000 on an average per victim — the Monetary Authority of Singapore (MAS) and the Singapore Police Force issued a joint advisory on December 21, 2023, about an impersonation scam.
The advisory said: “The Singapore Police Force (SPF) and the Monetary Authority of Singapore (MAS) warn the public on a Government Official Impersonation Scam variant, where scammers purportedly claim to be from, or be acting on behalf of, MAS. Since January 2023, there have been at least 41 victims, with total losses amounting to at least $2.6 million.”
Explaining the modus operandi to alert the public, the joint SPF-MAS advisory listed the steps of this scam:
Scam step 1: “Victims would receive unsolicited calls from scammers impersonating bank officers and requesting for verification of banking transactions allegedly conducted by them. When victims denied making such transactions or possessing such bank cards, the scammer would transfer the call to a second scammer claiming to be an officer from the MAS.”
Scam step 2: “This second scammer would accuse victims of being involved in criminal activities (e.g., money laundering, fraud). Victims may be transferred to a third scammer pretending to be an SPF officer for ‘further investigation’.”
Scam step 3: “Under various pretexts (e.g., investigation, resetting credit card magnetic stripe, processing of ‘government insurance policy’), scammers would instruct victims to transfer money to ‘security accounts’ — specified bank accounts supposedly designated by SPF, MAS or other authorities, or request for victims’ banking credentials, credit card details, or One-Time Passwords (OTPs).”
Scam step 4: “Victims would realise that they had been scammed when culprits become uncontactable or when they subsequently verify their situation with the banks or with the SPF through official channels.”
Clarifying that “MAS and SPF officers will never ask members of the public to transfer monies, or for the control of their bank accounts or Internet banking credentials”, the advisory urged people not to disclose any bank account or card details to a caller and never to share an OTP.
Deepfake scam
As technology evolves, so do scams. Powered by Artificial Intelligence, deepfakes are becoming one of the biggest concerns of the 21st century world. It is possible to tarnish reputations, spread misinformation, or commit the digital version of daylight robbery using deepfakes.
A CNA report in early December 2023 said: “Deepfakes in Singapore have jumped five times in the last year alone, and authorities have warned that the technology could be misused to commit cybercrimes.”
Deepfake technology is an extremely advanced type of morphing, so advanced that it’s next to impossible to tell the digitally manipulated fake image, video, or sound apart from the real thing. It’s not just about cutting out Mark Zuckerberg’s head from a photo and placing it on someone else’s shoulders. It’s about making the deepfake Zuckerberg so convincing that the average person might get very easily conned.
A Straits Times report in June 2023 said: “Scammers are tapping sophisticated Artificial Intelligence (AI) tools to create deepfake voice recordings and videos of people, to fool their relatives and friends into transferring money.”
This report quoted Singapore Minister of State for Home Affairs Sun Xueling as saying, “We have already seen overseas examples of bad actors making use of deepfake technology to create convincing clones — whether voice or videos of public figures — to spread disinformation.” The minister was speaking at the Regional Anti-Scam Conference 2023, held at the Police Cantonment Complex.
Even if scam targets are not themselves fooled by deepfakes, they can be blackmailed or exploited in other ways, as the digitally manipulated images and videos may seem believable to others.
A horrified Singapore woman found out in July 2019 that her harmless selfie had ended up on a porn site — in the deepfake picture, she was naked.
A Singapore man fell prey to deepfake tech in April 2022 after refusing to be blackmailed for SGD 8,000 by a hacker — friends and former colleague on his hacked contact list got a video showing the man (or someone with his face) performing sexual acts.
Protection against scam
There’s no telling which route a scammer would take, but some protection is within reach for potential victims. The police advise Singapore people to download the ‘ScamShield’ app, as an all-purpose shield against various kinds of scams. This app helps one filter suspicious messages and block calls, limiting fraudsters’ access to their targets.
Moreover, following the fake Domino’s Pizza website scam and the MAS-SPF scam, government-issued advisories asked the public to do the following:
● ADD – ‘ScamShield’ app and security features (e.g. set up transaction limits for Internet banking transactions, enable Two-Factor Authentication (2FA), Multifactor Authentication for banks).
● CHECK – For scam signs with official sources (e.g. ScamShield WhatsApp bot @ https://go.gov.sg/scamshield-bot; call the Anti-Scam Helpline on 1800-722-6688; or visit www.scamalert.sg).
Look out for tell-tale signs of a phishing website and if the deal is too good to be true, it probably is. Check with the company on its official website if such deals are available and check your card transactions before approving them. If in doubt, never share your personal information and payment card details with anyone.
● TELL – Authorities, family, and friends about scams. Report any fraudulent transactions to your bank immediately.
Reporting a scam
In addition, the government advisories informed Singapore people on how to report a scam: “If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.
“For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community!”