(From left) ICA director of customer operations Angie Wong, deputy commissioner (policy and transformation) Cora Chen, Commissioner Marvin Sim and director of the policy and development division Chui Wai Cheng at the press conference at the ICA building on Jan 11. - ST PHOTO: BRIAN TEO
SINGAPORE (The Straits Times/ANN): The home addresses of about 60 people were changed online without their knowledge, after scammers obtained their NRIC and Singpass details.
Scammers had used compromised Singpass accounts to circumvent several security safeguards in Singapore's Immigration and Checkpoints Authority’s (ICA) change of address system.
ICA has temporarily suspended the change of address function on its website to implement additional security measures to prevent further abuse.
It will also conduct a review in the next two days, and will likely resume the service on Jan 14, it said.
Initially, only several unauthorised changes of residential address were reported in 2024.
But the number has increased recently, and it appears this is one method for crime syndicates to gain access to and control the victims’ Singpass accounts.
On Jan 11, ICA said it started investigating such cases in September 2024.
All NRIC holders are required to report a change of address within 28 days of moving into a new residence, whether it is located in or outside Singapore.
Anyone who reports a false residential address can be fined up to $3,000, jailed for two years, or both. It is also an offence if a user does not affix the new address sticker to the NRIC.
To make it convenient for members of the public to update the authorities on their new address, ICA had in 2020 introduced a feature on its website to allow them to do it online, without needing to go to the police station.
They can access the e-service using Singpass.
ICA Commissioner Marvin Sim announcing the temporary suspension of ICA’s electronic change of address service on Jan 11.ST - PHOTO: BRIAN TEO
To verify the new address, applicants input a unique PIN sent by mail to their new address. Once confirmed, an instant acknowledgement will be sent to indicate the change of address is successful.
Those who are not tech-savvy or unable to submit applications through the online service can appoint proxies, such as a friend or family member who is a Singpass holder, to submit the applications on their behalf through the “Others” module on the e-service.
That person must provide the applicant’s NRIC number and its date of issue to access the e-service.
To complete the process, the proxy must also obtain and enter the PIN mailed to the applicant’s new address.
ICA said an average of 900 Singapore residents change their residential address through proxies every month.
But in September 2024, several unconnected cases of unauthorised change of address were reported to ICA.
And more cases recently surfaced.
By December, ICA realised how the unauthorised changes were done.
ICA said it has so far found about 80 unauthorised attempts, 75 per cent of which were successful in changing the addresses.
It said this is believed to have occurred after the perpetrators used stolen or compromised Singpass accounts to change the residential address of the victim through the “Others” module of the e-service.
To do so, the scammers would have previously acquired both the victim’s NRIC number and its date of issue, to input these details into the e-service.
A verification PIN mailer would then be sent to the registered address specified by the scammers.
But the criminals can then use this method to reset the victims’ Singpass passwords.
For example, if someone forgets his Singpass password, he will request a new one to be sent to his home address.
So now, the criminals could pretend to be the victim and ask for a new password to be sent to the new address they listed.
Once the password has been sent, the criminals can access the victim’s Singpass account.
Said ICA: “It is likely that the perpetrators are using stolen or compromised Singpass accounts and letter boxes of third parties to generate more mule accounts to use for scams and other cybercrimes.”
At a press conference on Jan 11, ICA Commissioner Marvin Sim said there was no indication that foreign actors were involved, and that the scammers were likely to be locals. There was also no particular demographic of victims involved.
Marvin Sim, commissioner, ICA, announcing the temporary suspension of Immigration & Checkpoints Authority's (ICA) electronic change of address service during the press conference at the ICA building on Jan 11.
The authorities are considering integrating face verification technology into the Singpass log-in for the e-Change of Address service.
ICA said this will minimise the risk that a perpetrator can use the stolen Singpass account of a third party to access the service to change a victim’s address.
Those who require proxy assistance for change of address can approach the IC Unit at the ICA Building for help.
ICA reminded the public to check that their registered addresses have not been changed without their knowledge.
The authority said it is in the midst of contacting those affected, and will provide them with a replacement NRIC that features the same number but a different date of issue.
It will also revert the victims’ registered addresses to the correct ones, and work with the Government Technology Agency to reset Singpass accounts that may have been compromised, it added.
ICA said the police are investigating the cases.
Sim said there is no indication that the incidents are connected to the disclosure of NRIC numbers via the Accounting and Corporate Regulatory Authority’s new Bizfile portal. - The Straits Times/ANN
