ICA temporarily suspends e-service after 80 unauthorised attempts to change residential addresses

PRELIMINARY FINDINGS

ICA’s commissioner Marvin Sim said the authority started investigations from September last year after receiving reports from members of the public who encountered unauthorised changes to their residential addresses.

“Initially, there were only a few cases that appeared unconnected, but more cases surfaced recently,” the authority said, adding that the number of cases grew to 80 to date.

By last December, ICA’s investigations showed that the perpetrators had used stolen or compromised Singpass accounts to change the residential addresses of the victims through the “others” module of the e-service.

“To do so, they would have had previously acquired both the NRIC number and date of issue of the NRIC of the victims, to input these details into the eCOA service,” ICA said.

“The eCOA service would then send a verification PIN mailer to the registered resident address set by the perpetrator, where he could access the mailer to confirm (the) change of address.”

Once the registered residential address of a victim was changed, it was used to set a new password for the victim’s Singpass account by requesting that the Singpass service mail a new PIN to the registered residential address set by the perpetrator.

Speaking at a press conference held at the ICA Building, Mr Sim said the perpetrators were “likely to be locals” and there were “no indications” that foreign actors were involved.

There were also no fixed demographic patterns for the victims involved.

Mr Sim declined to reveal other details about the suspects, noting that police investigations are ongoing.

“Once police have completed the investigation, we will come down hard on the perpetrators,” he said.

Responding to questions from reporters, Mr Sim also said there was “no indication” that the incident is connected to the recent exposure of NRIC numbers via the new Bizfile portal of the Accounting and Corporate Regulatory Authority (ACRA), which was launched on Dec 9.

“For the ACRA portal, the date of issue is not known … because for the perpetrators to change (the residential addresses), they need both the NRIC and the date of issue (of the NRIC),” he said.

ICA stressed that this was “not an issue about (a) system glitch”.

“We designed the digital service since 2020 to provide convenience to members of (the) public, but in recent months, we detected a new modus operandi of people trying to make use of the eCOA to fraudulently change the address of another person and, as a result, seek control of their Singpass for other criminal activities,” said Mr Sim.

“This is why we decided to act decisively.”

ADDITIONAL SECURITY MEASURES

ICA said the additional security measures that will be rolled out include integrating face verification technology into the Singpass login for the online service.

“This will minimise the risk that a perpetrator can use the stolen Singpass account of a third party to access the service to change a victim’s address,” it said.

It is also mulling the introduction of an OTP option before residential addresses can be changed via the “others” option.

“This means that for the whole transaction to go through, the person (for) whom the address is being changed must first acknowledge that he or she has asked the proxy to change the address,” said Mr Sim in response to a question from CNA.

“These are some of the options that we are looking at. The assurance I want to give is that unless we are quite confident that we are able to put in place more comprehensive safeguards, we will not bring back the ‘others’ module,” he added.

ICA said while the e-service is temporarily suspended, those who require proxy assistance may approach the IC Unit on Level 3 of the ICA Building for assistance between 8am and 4.30pm from Mondays to Fridays.

It is also in the midst of contacting all known affected individuals and will assist them with obtaining replacement NRICs, which will have the same NRIC numbers but different issue dates, as well as help them to revert their registered addresses to their actual ones. 

For those whose Singpass account may have been compromised, ICA said it will work with GovTech to reset the accounts.

It also advised members of the public to check their registered address on ICA’s website and report any inaccuracies immediately via https://go.gov.sg/reportunauthorisedchange.