- Joined
- Aug 20, 2022
- Messages
- 15,704
- Points
- 113
ICA temporarily suspends e-service after 80 unauthorised attempts to change residential address
The perpetrators, who were using stolen or compromised Singpass accounts, succeeded in changing the addresses in about 75 per cent of these attempts, says the Immigration and Checkpoints Authority.
SINGAPORE: The Immigration and Checkpoints Authority (ICA) on Saturday (Jan 11) said it has suspended an electronic service that allows Singapore residents to change residential addresses online.
This comes after the authority identified about 80 cases of unauthorised attempts to change registered residential addresses via an “others” option – which allows the change of address by a proxy – available on the online service.
The perpetrators, who were using stolen or compromised Singpass accounts, succeeded in changing the addresses in about 75 per cent of these attempts to likely “generate more mule accounts to use scams and other cybercrimes”, it added.
ICA has suspended the electronic change of address (eCOA) service from Saturday morning to implement additional security measures and prevent further abuse.
“We will conduct a review in the next two days and will likely bring up the service on Jan 14,” ICA said in a news release.
“The ‘others’ module will remain unavailable until ICA has implemented further measures to safely allow the change of address by a proxy.”
Scroll to continue with content
HOW THE ELECTRONIC SERVICE WORKS
The electronic service was first introduced in October 2020 to allow Singapore residents, including those who reside overseas, to report a change of residential address to ICA online.Individuals can make a change to their own, or others’ residential addresses by logging into the online service with their Singpass accounts under three options: Myself, myself and my family members, and others.
ICA noted that the “others” module was introduced in 2020 for those who are not digitally savvy to get assistance in updating their residential addresses online from proxies with Singpass accounts.
An average of 900 Singapore residents change their residential address through proxies every month, according to the authority.
PRELIMINARY FINDINGS
ICA’s commissioner Marvin Sim said the authority started investigations from September last year after receiving reports from members of the public who encountered unauthorised changes of their residential addresses.“Initially, there were only a few cases that appeared unconnected, but more cases surfaced recently,” the authority said, adding that the number of cases grew to 80 to date.
By last December, ICA’s investigations showed that the perpetrators had used stolen or compromised Singpass accounts to change the residential addresses of the victims through the “others” module of the e-service.
“To do so, they would have had previously acquired both the NRIC number and date of issue of the NRIC of the victims, to input these details into the eCOA service,” ICA said.
“The COA service would then send a verification PIN mailer to the registered resident address set by the perpetrator, where he could access the mailer to confirm (the) change of address.”
Once the registered residential addresses of a victim was changed, it was used to set a new password for the victim’s Singpass account by requesting the Singpass service to mail a new PIN to the registered residential address set by the perpetrator.
Speaking at a press conference held at the ICA Building, Mr Sim said the perpetrators “are likely to be locals” and there are “no indications that there are foreign actors involved”.
There are also no fixed demographic patterns for the victims involved.
Mr Sim declined to reveal other details about the suspects, noting that police investigations are ongoing.
“Once police have completed the investigation, we will come down hard on the perpetrators,” he said.
Responding to questions from reporters, Mr Sim also said there is “no indication” that the incident is connected to the recent exposure of NRIC numbers via the new Bizfile portal of the Accounting and Corporate Regulatory Authority (ACRA).
“For the ACRA portal, the date of issue is not known ... because for the perpetrators to change (the residential addresses), they need both the NRIC and the date of issue (of the NRIC),” he said.
ADDITIONAL SECURITY MEASURES
ICA said the additional security measures that will be rolled out include integrating face verification technology into the Singpass login for the online service.“This will minimise the risk that a perpetrator can use the stolen Singpass account of a third party to access the service to change a victim's address,” it said.
It is also mulling the introduction of an OTP option before residential addresses can be changed via the “others” option.
“This means that for the whole transaction to go through, the person (for) whom the address is being changed must first acknowledge that he or she has asked the proxy to change the address,” said Mr Sim in response to a question from CNA.
“These are some of the options that we are looking at. The assurance I want to give is that unless we are quite confident that we are able to put in place more comprehensive safeguards, we will not bring back the ‘others’ module,” he added.
ICA said while the e-service is temporarily suspended, those who require proxy assistance may approach the IC Unit on Level 3 of the ICA Building for assistance between 8am and 4.30pm from Mondays to Fridays.
It is also in the midst of contacting all known affected individuals and will assist them with obtaining replacement NRICs, which will have the same NRIC numbers but different issue dates, as well as help them to revert their registered addresses to the correct ones.
For those whose Singpass account may have been compromised, ICA said it will work with GovTech to reset the accounts.
It also advised members of the public to check their registered address on ICA’s website and report any inaccuracies immediately via https://go.gov.sg/reportunauthorisedchange.
