PUBLISHED ONFebruary 05, 2025 8:21 AMByBhavya RawatNo government e-services can be used with only a person's NRIC number and its date of issue, said the Ministry of Digital Development and Information (MDDI) on Tuesday (Feb 4).
In a written reply to questions raised by several MPs during Parliament, Digital Development and Information Minister Josephine Teo said that government agencies have conducted checks on the potential impact on online services.
These checks came after scammers used compromised Singpass accounts to change the addresses of victims via the Immigration and Checkpoints Authority's (ICA) e-service platform last month.
"So far, there have been no transactional services identified that can be completed in the same manner," she said.
Teo explained that government agencies are required to conduct regular risk assessments of their tech systems, including risks arising from systems managed by other agencies, adding that vulnerabilities must be addressed immediately.
When asked how the Government Technology Agency (GovTech) supports ICA in the roll out of additional security measures, Teo assured that the agency is working to improve the security of Singpass, through testing and better fraud analytics.
ICA has since introduced facial verification scanning when individuals use their Singpass accounts for higher risk transactions such as changing their home address, she added.
On Jan 11, ICA announced that scammers had used hacked Singpass accounts to circumvent several security safeguards in the ICA's change of address system.
The service was launched in 2020 to make it more convenient for people to update their address online.
Individuals can also appoint someone to help them change their address. They would just need to log into their own Singpass account and provide the NRIC details of the person whose address is being changed, after which ICA sends a PIN to the new address.
However, scammers made use of hacked Singpass accounts and leaked NRIC details to log into ICA's platform. They then successfully changed the address of 71 victims, according to the latest figures heard in Parliament on Feb 4.
The PIN requested by these scammers would be mailed to the false address, allowing them to change the victims' address on ICA's website. They could also reset victims' Singpass passwords this way.
The compromised accounts and letter boxes of victims were supposedly used to generate mule accounts for crimes, ICA said in January.
The electronic change of address function on ICA's site remains suspended while security improvements are being made, said Minister of State for Home Affairs Sun Xueling on Feb 4.
Since investigations began in September 2024, 13 people have been arrested over the incident. Four men have been charged with offences under the Computer Misuse Act.
First-time offenders found guilty of unauthorised disclosure of access codes under the Computer Misuse Act can face a jail term of up to three years, fined up to $10,000, or both.
[[nid:712705]]
bhavya.rawat@asiaone.com
