75% of unauthorised attempts to change residential addresses were successful
The Immigration & Checkpoints Authority (ICA) has suspended the online service that allows Singaporeans to change their residential address after it found unauthorised attempts to do so.
About 80 unauthorised attempts have been found so far, ICA said in a media release on Saturday (11 Jan).
ICA started probing unauthorised change of residential addresses in September
ICA started investigating cases of unauthorised changes of residential addresses in September last year, it said.
While it initially found only a few apparently unconnected cases, more surfaced recently.
Eventually, 80 attempts were uncovered, with 75% of them — about 60 — able to change a residential address successfully.
Perpetrators used victims’ Singpass account & NRIC details
Last month, ICA found out how the perpetrators did it.
They made use of three important tools:
- a stolen or compromised Singpass account
- the victim’s NRIC number
- the date of issue of the victim’s NRIC
Unauthorised change of residential addresses used to set new Singpass password
With these details, the perpetrators would change the victim’s residential address via ICA’s electronic change of address (eCOA) service.
The system would then send a verification PIN by mail to the registered residential address set by them.
They would use the PIN sent in the mailer to confirm the change of address.
Once they successfully changed the registered residential address of the victim, they could use it to set a new password for the victim’s Singpass account.
They did this by getting Singpass to mail a new PIN to the new address, ICA said, adding:
It is likely that the perpetrators are using stolen or compromised Singpass accounts and letter boxes of third parties to generate more mule accounts to use for scams and other cybercrimes.
eCOA service temporarily disabled
To prevent further abuse, ICA will implement additional security measures to the eCOA service.
Thus, it has been temporarily disabled as of 11 Jan.
A check on the ICA website says the eCOA service is undergoing maintenance so Singpass face verification can be enabled.
Face verification will minimise the risk that a stolen Singpass account can be used to change a person’s address.
After a review, the service will likely return on Tuesday (14 Jan).
eCOA service allowed proxies to change residential addresses on others’ behalf
The eCOA service, which was introduced in 2020, allows Singapore residents to report a change of residential address to ICA online.
While residents can change the address of themselves and family members, they were also able to do this for others under the “others” module.
This was introduced so those who are not digitally savvy can get a proxy to change their address online on their behalf, without making a trip to the ICA Building.
An average of 900 Singapore residents a month change their residential address through a proxy, ICA said.
However, this “others” module will now be unavailable until further measures have been implemented to safely allow proxies to change a residential address.
In the meantime, those who require proxies to help them change their address may visit the ICA Building during opening hours.
ICA will assist those affected
ICA apologised for the inconvenience as it reinforces the security of the eCOA service.
As for those affected by an unauthorised change to their residential address, ICA is contacting them.
ICA will help them replace their NRIC and change their registered address back.
ICA will also work with GovTech to reset the Singpass accounts of those whose accounts might have been compromised.
The Police are investigating the cases to identify the scammers and their accomplices.
Have news you must share? Get in touch with us via email at news@mustsharenews.com.
Featured image from MS News.