The Singapore Police Force warned the public in a news release about a new form of phishing scam that is surging, where scammers are targeting victims through the use of SMSes to get their Singpass information.
Victims would receive unsolicited SMSes where the ID of the sender would be similar to Singpass, with a slight change in the name, such as “MySingpass” and “SGSingpass”.
They (the victims) would be told that their Singpass would be deactivated, or has been deactivated and that a facial verification would be needed.
The victims would then be sent a URL through the SMS to get them to log into their Singpass, and they would be taken to a spoofed Singpass login site, requiring their login credentials.
They would then be led to a 2FA page and receive a prompt for their Singpass OTP, and the victims would then realise that they had been scammed after receiving notifications that their profiles had been updated.
Some of the victims reportedly received alerts that “they” had signed up for credit cards and bank accounts, as well as having unauthorised transactions charged to the cards.
The SPF added that the authorities has since taken down the phishing websites but as with all fights against scams, public and user vigilance plays a crucial role in taking them down completely.