How do scammers exploit government directories?

Since April 2020, telcos have also added the “+” prefix for all incoming overseas calls to alert users to calls that do not originate in Singapore.

In December 2022, telcos started to block all overseas calls that spoof local fixed and mobile line numbers.

Scammers have now moved to messaging apps like WhatsApp to spoof local numbers, which can include government agency numbers, as the apps sit outside the control of Singapore’s telcos, said Aaron Ang, regional director at Singapore-based cybersecurity and AI consultancy CWG Innovations.

On WhatsApp, scammers may also use profile pictures bearing official logos, or even appear in uniform against an office backdrop during video calls, to make the ruse more convincing.

“No Singapore agency handles case matters over WhatsApp,” said Ang. “The platform itself is the red flag. You don’t even need to work out whether the officer is real.”

To protect themselves against scam calls on WhatsApp, users can adjust their privacy settings to silence unknown callers.

They can also call the national ScamShield helpline on 1799 if they are unsure, or download the ScamShield app where they can submit suspicious phone numbers for screening.

Ang said that it would not make sense for the Government to change all contact details at this point as informing the public of the change could itself create opportunities for scams. “It’s a bit like changing your house number to stop junk mail,” he said.

Risk of corporate espionage

The risk of corporate espionage is why most private-sector organisations do not publish staff directory information online.

Similarly, an agency’s directory can reveal its organisational structure, including the names and contact details of officers in the same department. This allows a scammer to pose as a senior officer using a lookalike e-mail address and instruct subordinates to send confidential documents, or trick them into opening malicious files or click on malicious links.

“The scam is far more believable because the names and organisational relationships are accurate,” said cybersecurity expert Steven Wong from the Singapore Institute of Technology.

Officers working in procurement, licensing or grant administrators are common targets.

Is the public safer now?

While scams will not dry up completely, scammers will have less data to exploit.

Over time, as more rank-and-file public officers leave their organisations, what has already been harvested by scammers will also become outdated, said Anthony Lim, a senior research fellow at the Centre for Strategic Cyberspace and International Studies think-tank.

While online government directories still contain the information of politicians or very senior officers, it will be harder to convince victims that someone who is very senior has called them, said Lim.

What else can be done to stop government impersonation scams?

Mr Matthias Yeo, chief executive of Singapore-based cybersecurity research company CyberXCenter, suggested that agencies use a general e-mail address to communicate with the public instead of publishing individual officers’ e-mail addresses.

“When people are used to communicating through a generic official e-mail, they are more likely to question an e-mail that suddenly claims to come from a specific officer,” said Yeo.

Prakash also suggested a live verification system that allows the public to verify their caller.

It works by allowing government officers to generate a dynamic one-time code, which a member of the public can enter on a government website. The website would then display the officer’s name and agency and confirm that the dynamic code, which will expire in a few minutes, had just been generated.

“This can help verify the live interaction, rather than merely verifying that the officer exists,” said Prakash.

Public education should continue to stress that government officials will never ask people to transfer money or valuables, disclose banking login details, or install apps from unofficial sources.