1. Mr Speaker, Minister Lawrence Wong and Minister Josephine Teo have given an update on the measures to secure banking and communications channels from phishing scams.
2. I chair the Inter-Ministry Committee on Scams, or IMCS in short, which was set up in April 2020. The IMCS brings together Government agencies such as Ministry of Home Affairs, Singapore Police Force (SPF), Ministry of Communications and Information, Monetary Authority of Singapore (MAS), and Ministry of Trade and Industry, and also works with the private sector partners such as the Association of Banks in Singapore, or ABS, to coordinate efforts to combat all scam types. This includes phishing scams, job scams, loan scams, as well as e-commerce scams. IMCS focusses its efforts to coordinate across agencies to review scam types and trends as well as to propose counter-measures. It also enhances enforcement and responses to these scams. And thirdly, IMCS strengthen public education and vigilance on scams.
3. My statement today will focus on two aspects of our anti-scam strategy: (a) enforcement; and (b) public education.
Strengthening Enforcement
4. The main challenge in enforcement is that the vast majority of scams are perpetrated by syndicates that are based overseas. Such cases are difficult to investigate and to prosecute for three reasons.
(a) Firstly, our ability to solve these cases depends on the level of cooperation from overseas law enforcement agencies, as well as their ability to track down scammers in their own jurisdictions.
(b) Second, these scammers are typically part of organised criminal syndicate. They run sophisticated transnational operations which are not easy to detect or to dismantle. The syndicates are well-resourced and adept at using technology to cover their tracks.
(c) Thirdly, when monies have already been transferred out of Singapore, recovery is very difficult.
5. SPF works closely with our overseas counterparts to exchange information and conduct joint operations. For example, in 2021, SPF’s collaboration with law enforcement agencies such as the Royal Malaysia Police as well as Hong Kong led to the take-down of 16 scam syndicates, and the arrest of around 230 persons.
OCBC Phishing Scams
6. Coming back to the OCBC phishing scam, Dr Tan Wu Meng, Mr Sitoh Yih Pin and Mr Dennis Tan asked for an update on the ongoing investigations into the OCBC phishing scam.
(a) As at 13 Feb, SPF has frozen 121 local bank accounts and recovered about $2 million. In addition, about $2.2 million of victims’ funds have been traced to 89 overseas bank accounts.
(b) Based on SPF’s preliminary investigations, at least 107 local and 171 overseas IP addresses were linked to the unauthorised access of the victims’ internet banking accounts. Many of the scam websites used in the phishing scam were hosted by web hosting companies that are based overseas.
(c) SPF has commenced investigations into the local IP addresses linked to the scam, and the owners of the local money mule accounts. SPF is now also working with the Interpol and foreign law enforcement agencies to investigate the beneficiaries of the funds transferred overseas, and the hosts of the scam websites.
(d) As investigations are right now ongoing, we are not able to divulge any more information at this moment.
7. The OCBC phishing scam cases occurred amidst a rise in the number of scams reported in Singapore, which Mr Ang Wei Neng, Dr Tan Wu Meng, and Ms Cheng Li Hui asked about.
(a) In 2021, 23,931 cases of scams were reported, of which 5,020 were phishing scam cases. This is more than a fourfold increase from the 5,147 cases of scams reported in 2017, of which only 16 were phishing scam cases.
(b) Specifically, for phishing scams involving SMSes impersonating banks in Singapore, there were no cases in 2017, but there were 91 in 2018, increases to 57 in 2019, and 149 in 2020, before increasing significantly to 1,021 in 2021 in view of the OCBC phishing scams. The OCBC phishing scam alone accounted for 790 customers in the two months from Dec 2021 to Jan 2022 – by far the largest phishing scam involving spoofed SMSes, as mentioned by Minister Wong earlier. The use of a combination of highly-orchestrated tactics, involving spoofed SMSes appearing in the same thread as genuine messages from the bank and links directing victims to a scam website, as well as the large number of customers targeted in the OCBC scam, show that now, the threat is significantly heightened.
8. On Associate Professor Jamus Lim’s query, in 2021, card fraud cases reported by major credit card issuers in Singapore to MAS formed less than 0.1% of total credit card transactions. MAS and SPF do not track the percentage of funds recovered for these unauthorised credit card transactions.
Enforcement Resources
9. Mr Murali Pillai and Mr Ang Wei Neng asked if the SPF is sufficiently resourced to combat scams. Police are extremely stretched. Our officers have been trying to cope with increasing workload and expectations, without proportionate increase in manpower. We will need to review this untenable situation.
10. Nevertheless, with whatever resources we have, we have reorganised ourselves for greater efficiency and effectiveness. For example, the SPF set up the Anti-Scam Centre, or ASC, in 2019 as a specialised unit focused on anti-scam interventions and enforcement.
(a) In 2021, the ASC conducted 26 island-wide anti-scam operations, which resulted in the arrest of around 7,500 money mules and scammers.
(b) The ASC also partners private sector stakeholders to disrupt scammers’ operations. For example, it has worked with telecommunication companies to terminate scam-tainted phone lines, and with online marketplaces to remove suspicious online monikers and advertisements.
(c) Since 2019, the ASC has frozen around 24,000 bank accounts suspected of being involved in scam activities, and recovered about $160 million in scam proceeds.
(d) This would include part of the $17 million lost since 2020 to about 1,300 cases of phishing scams involving spoofed SMSes impersonating banks in Singapore, a question which Dr Tan Wu Meng asked about. SPF does not track the amount of funds recovered by the scam type.
11. Recoveries of monies lost to scams is very difficult. Where we have been able to, it involved close partnerships with financial institutions, in particular by having a DBS staff co-located with SPF at the ASC to provide swifter and real-time coordination and intervention.
12. ASC and MAS are working with more banks to co-locate their staff at the ASC, to further enhance the ASC’s capabilities to freeze accounts as well as to trace the flow of monies.
13. SPF will be forming an Anti-Scam Command this year to consolidate expertise in scams across the SPF Land units, and thereby further improve coordination of anti-scam enforcement and investigations. The Command will also oversee the newly formed Scam Strike Teams in the seven Land Divisions, which were set up to enable us to take swifter action against scams.
14. As Mr Edward Chia and Mr Christopher de Souza suggested, SPF has also leveraged technology and will continue to do so.
(a) The ASC uses technology to automate manual work processes, such as the generation of electronic production orders to banks for the freezing of bank accounts associated with scams, and sending out personalised crime advisories to members of the public. This will allow the Police resources to focus on essential criminal investigations and enforcement work.
(b) SPF also uses technology such as ScamShield to crowdsource information on scam calls and SMSes. It provides SPF with information on emerging trends, and this enables the SPF to react faster to the various scams.
(c) Another example is the SPF and MAS’s ongoing study with banks to explore the use of enhanced fraud surveillance systems based on Artificial Intelligence to flag suspicious transactions and identify possible fraudulent behaviour in real-time.
Improving Public Education
15. Next, I will touch on improving public education. Enforcement, by itself, is not sufficient. To Ms Foo Mee Har’s question on how consumers can be better protected, the best defence is indeed a discerning public. Hence, the Government has been creating strong public awareness on scams.
16. Ms Cheng Li Hui asked about the challenges in educating Singaporeans on anti-scam precautions and measures. A key finding from the 2019 National Prevalence Survey of Scams was that scam victims tend to lack practical knowledge on safe practices. While the majority of scam victims had come across anti-scam public campaigns and messages, many of them could not recall specific scam prevention tips. They also exhibited poor online hygiene, such as opening emails from unknown sources.
17. The Government’s anti-scam public education campaign, called ‘Spot the Signs. Stop the Crimes.’, aims to address these challenges. The campaign emphasises the importance of individual responsibility, and also uses real-life examples to build awareness and vigilance on the tell-tale signs of scams. As part of this campaign, we have disseminated materials advising the public on scam prevention tips, such as never to share one-time-passwords, or OTPs, with unverified parties and to beware of requests for gift cards and online credits.
18. Mr Mohd Fahmi Bin Aliman asked if there is an age group that is most vulnerable to phishing scams, and the common scams that different segments of the population fall prey to.
19. Scam victims are of a wide range of ages; everyone is susceptible. That said, different profiles of victim fall prey to different types of scam.
(a) For phishing scams, job scams, e-commerce, investment, loan scams, China official impersonation scams, as well as fake gambling platform scams, we found that young adults between 20 and 39 years old formed the largest group of victims, compared to other age groups.
(b) For social media impersonation scams, Internet love scams, and fake friend call scams, adults between 40 and 59 years old formed the largest group of victims.
20. Hence, the Government has also rolled out prevention initiatives targeted at specific population segments.
(a) SPF and NCPC have partnered the ABS on various initiatives to educate bank customers. For example, the banks have introduced an online quiz on scam prevention. They have also sent out advisories to customers to remind them not to share their OTP with others.
(b) Banks have also stepped up their efforts to train the bank staff, frontline staff to help customers spot signs of scam. For example, in June 2021, OCBC staff helped to prevent a 57-year-old customer from being scammed. The customer had wanted to remit around 6,000 Euros to her Internet “boyfriend” based in the United States. OCBC branch staff noticed that the fund transfer was to be made to a personal bank account in Thailand and suspected that the customer was being scammed. The OCBC staff spent hours trying to dissuade the customer from transferring the funds, and worked with SPF officers to try to advise the customer from sending any money. Eventually, and thankfully, they managed to convince the customer that she was being scammed, after the “boyfriend” was not available for a video call that the bank staff worked with the customer to arrange.
(c) Another example of a preventative initiative is the “SG Cyber Safe Seniors Programme” launched in June 2021 by the Cyber Security Agency of Singapore (CSA), Infocomm Media Development Authority, (IMDA) and the SPF. The Programme seeks to raise seniors’ awareness of online scams and encourage them to adopt good cyber hygiene. Under the Programme, CSA and its partners such as the SG Digital Office offer scam prevention tips, including how to spot signs of phishing and avoiding the sharing of personal information and OTP.
21. The IMCS will step up our public education efforts by scaling up targeted outreach. We will partner agencies and stakeholders that serve as key touchpoints for population segments of interest, and leverage their communications channels to push out anti-scam messages targeted at different segments.
(a) For example, IMCS has started working closely with the Agency for Integrated Care (AIC), Ministry of Education, Ministry of Manpower and MoneySense to push out anti-scam information and awareness programmes for our seniors, our students, our migrant workers and professionals.
(b) The IMCS has also started to work with stakeholders from the private sector: partnering the ABS to reach out to consumers banking services, and major e-commerce marketplaces to reach out to consumers transacting on those online platforms.
22. Everyone should also download ScamShield, to filter out scam messages and block scam calls.
(a) To date, ScamShield has been downloaded about 257,000 times. About 3.7 million SMSes and calls have been picked up as potential scams by the in-app algorithm, and user self-reporting through the app. About 15,500 phone numbers have also been blocked. We are unable to provide Mr Gerald Giam with the percentage of scam calls and SMSes successfully blocked, as ScamShield does not track the number of calls and SMSes made or received by the users.
(b) ScamShield picked up and filtered about 2,000 scam messages used in the OCBC phishing scams. Unfortunately, a lot more scam messages managed to reach the SMS inbox of ScamShield users, mainly because they appeared in the same thread as legitimate messages. This gap will be addressed as agencies enhance our SMS ecosystem as Minister Josephine Teo explained.
(c) That said, ScamShield in itself is not a panacea, and all parts of the ecosystem needs to work together to combat scams, including vigilance from our members of the public.
(d) When ScamShield was developed, we made it available to iOS devices first as it was functionally easier to build. We had initially planned to launch the Android version of ScamShield in late 2021, but it was delayed as GovTech had to reprioritise resources towards supporting our efforts against COVID-19. Agencies are now working towards developing and releasing the Android version in the coming few months.
(e) The IMCS will continue our efforts to encourage the public to download ScamShield, including through community engagements by SPF and Volunteer Crime Prevention Ambassadors. I also like to call on Members of this house to encourage your residents to download ScamShield.
Conclusion
23. In concluding, combatting scams needs a whole of society effort. Even as the SPF steps up enforcement, members of the community still play a vital role. We urge the members of public to be individually alert, and also to raise collective awareness by sharing scam prevention tips with your friends and your family.
24. Together I am confident, we can build a safer Singapore. Thank you, Mr Speaker.
