Poll: 80% majority uncomfortable with unmasking NRIC number
Last Friday (13 Dec), veteran journalist Bertha Henson wrote a Facebook post claiming that Accounting and Corporate Regulatory Authority’s (ACRA) newly launched Bizfile had made many individuals’ full NRIC numbers publicly accessible through a search of their full names.
The journalist’s initial revelation raised concerns among the population, and the function has since been made unavailable on Bizfile.
Since then, the Ministry of Digital Development and Information (MDDI) has announced that the government intends to stop masking NRIC numbers.
Image by TheSmartLocal
Singapore has practiced using masked NRIC numbers for some time, where the first four numbers are replaced with asterisks.
“There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others,” said MDDI in a statement.
The announcement has stirred up debate, with Singaporeans voicing out privacy concerns that arise from unmasking their identification numbers.
Large majority bothered by NRIC situation
In a poll conducted by Answers.sg, respondents were asked if they felt bothered by the fact that NRIC numbers might soon become easily accessible to others.
Of the 1,475 respondents, 80% expressed that were uncomfortable with the situation.
A 68% majority of respondents said that they are greatly bothered, while 12% said it bothers them “a little bit”.
Only 12% were completely unbothered, and the remaining 7% were neutral.
MS News spoke to some Singaporeans to further understand their concerns about the issue.
Fear of identity theft
“There are some organisations that use NRIC or a combination of NRIC with other personal details as a method of verification,” said 22-year-old Anita, a part-time receptionist.
“That opens me to risks of experiencing identity fraud, and everyone is already on edge because of scams.”
This sentiment is echoed by 50-year-old Sarah, mother of two. “It feels very unsafe. Anyone can just easily access my IC number and perform illegal transactions without my permission,” she said.
Many netizens have also raised the danger of identity theft or malicious tampering since MDDI’s announcement.
Do you feel safe with your nric exposed?
byu/amirlytryingmybest inaskSingapore
One Reddit user pointed out that their electronic bank statement can be unlocked with the last four digits of their NRIC and their birth date.
The same netizen noted that banks frequently verify account holders’ identity using their NRIC numbers.
“I know the NRIC masking is not completely foolproof too, but we don’t have to hand the information out on a silver platter to make things worse right?” wrote the netizen.
Scammers can sound more convincing
Some are also worried that scams may become more convincing.
“In scam calls that impersonate government officials or civil servants, I think them being able to recite your full NRIC number will increase their credibility,” said 22-year-old Lily, a Masters student in Math and Computer Science. “This is especially applicable to the older generation.”
Source: Zephyr 18 on Canva, for illustration purposes only
A recent phishing attempt shared by a netizen on Reddit reflected the relevance of this concern.
A scammer, posing as the police over a phone call, was able to recite their full name and NRIC number after claiming that the user had a registered phone number “that was sending over 2000 malicious SMSes”.
They then said that all their numbers would be suspended if they did not follow instructions.
The netizen avoided falling for the same after verifying the call with the Scam Shield hotline.
However, they were told to report the case to the police since their personal information — name, contact number, and NRIC number — was leaked.
From January to June 2024 alone, a whopping S$67.5 million was lost through government official impersonation scams.
Some Singaporeans not as concerned
Meanwhile, there are also Singaporeans who are not particularly bothered.
“Since it will not be used in any authentication process, there is no reason to be concerned,” said 22-year-old Kevin Ng, a full-time undergraduate.
Following the Bizfile incident, MDDI has highlighted the difference between identification and authentication.
Identification refers to stating who you are, while authentication refers to proving you are who you state to be.
Source: MDDI on Facebook
Common authentication measures include passwords, security tokens, or biometric data.
MDDI and Personal Data Protection Committee (PDPC) states that NRIC numbers should not be used for authentication purposes, because it is “not a secret” and “assumed to be known”.
In other words, individuals should not be using their NRIC number as sensitive passwords.
Organisations should also not be using NRIC numbers to authenticate anybody’s identity.
However, experts who spoke to The Straits Times mentioned that in reality, many services in Singapore currently use NRIC numbers as a method of identity verification.
This includes banks, telecommunication services, and insurance companies.
“If the government decides to change the policy, then banks and insurance companies will have to adapt accordingly,” said undergraduate Kevin Ng to MS News.
“Regarding identity verification, I don’t think it is a big deal, unless it is to access bank account and funds.”
Moving forward
On Thursday (19 Dec), the government provided further explanation regarding the move to unmask NRIC numbers.
The MDDI released a circular in July for government agencies to “cease any planned use of masked NRIC numbers in new business processes and services.”
The government wanted to make the change only after explaining its rationale. However, ACRA had gone ahead to launch its Bizfile portal.
In the same press conference, ACRA said it will restore the Bizfile search function next week. However, the portal will not display NRIC numbers in its search results.
Source: Josephine Teo on Facebook
Meanwhile, banking and insurance groups have released statements to assure the public.
The Association of Banks in Singapore (ABS) said that fund transfers and payments cannot be made with NRIC numbers alone.
The General Insurance Association of Singapore (GIA) and Life Insurance Association, Singapore (LIA) also released a joint statement assuring policyholders that NRIC alone cannot be used to purchase, alter, or surrender existing policies.
It is also not sufficient to change the bank account designated for insurance payouts, or to change the nominated beneficiary of an insurance plan.
Moving forward, both the banks and insurance companies will conduct a thorough review of their use of NRIC numbers.
Have news you must share? Get in touch with us via email at news@mustsharenews.com.
Featured image adapted from Zephyr18 on Canva and by TheSmartLocal.
