ICA detects 99 unauthorised address change attempts on e-service, 71 of them successful

SINGAPORE: The Immigration and Checkpoints Authority (ICA) has detected 99 unauthorised attempts to change registered residential addresses via its online service, with 71 successfully carried out.

The update was given by Minister of State for Home Affairs Sun Xueling on Tuesday (Feb 4) in response to a slew of parliamentary questions about the incident.

ICA initially disclosed on Jan 11 that it had suspended its change of address service online after discovering 80 unauthorised attempts to do so by perpetrators exploiting stolen or compromised Singpass accounts. Seventy-five per cent of these attempts were successful.

In an update on Jan 14, the number of unauthorised attempts rose to 87. Of these, 69 were successful.

The fraudulent attempts were carried out via an “others” option – which allows the change of one’s address by a proxy – available on ICA’s online service.

Providing the latest update on Tuesday, Ms Sun said that ICA has reviewed all applications done through the “others” module since the start of the online service in October 2020.

It has “ascertained that unauthorised changes took place only in the recent months, from August 2024 onwards”.

To mitigate the impact on those affected, ICA has reached out to all 99 individuals to verify and restore their correct addresses, as well as assist them in replacing their identity cards, Ms Sun said.

The Singpass accounts for all 99 individuals have also been suspended “out of an abundance of caution” to prevent further unauthorised activity, with ICA assisting these individuals to reset and secure their accounts.

For the 71 victims whose addresses were fraudulently changed, ICA is working with other government agencies to “comprehensively assess the impact”, especially those whose registered addresses had been used by other agencies to administer their schemes since the fraud began.

These checks are ongoing, said Ms Sun.

“Agencies will provide the appropriate assistance and restoration if there has been any adverse impact on the calculation or disbursement of government benefits, including CDC (Community Development Council) vouchers, to these individuals,” she told the House.

Out of the 71 successful unauthorised changes, the culprits went on to take over 16 Singpass accounts by performing a password reset and requesting the new password to be mailed to the new address.

Ms Sun said the Singapore Police Force is coordinating with government agencies and private entities to stop or reverse any fraudulent activity originating from these 16 compromised Singpass accounts.

“If there have been monetary losses arising from the compromised Singpass accounts, police will work with agencies and financial institutions to remediate the losses wherever possible,” she said.

ICA’s online service resumed partially since Jan 14 after an additional security measure of face verification was introduced for those seeking to change their own residential addresses.

The two other options to change addresses via the “others” and the “myself and my family” modules will remain suspended until additional safeguards can be put in place, said Ms Sun.

Thirteen suspects have been arrested thus far in relation to the case, with four men charged in court for offences under the Computer Misuse Act 1993.

For these offences, the punishment for a first-time offender is a jail term of up to three years, a fine of up to S$10,000 (US$7,300), or both.

The police will make known other details in due course as its investigations progress further, said Ms Sun.

Responding to a question from Member of Parliament Joan Pereira (PAP-Tanjong Pagar) on whether ICA could have acted sooner in suspending its online service, Ms Sun said that a review is under way.

She noted that ICA started its investigations in September 2024 after receiving several reports of unauthorised change of address.

“Initially, the cases appeared unconnected. Time was needed to investigate and triangulate information from various reports made,” she said.

By December, ICA’s investigations established how the unauthorisied changes were done and what they were used for.

At the same time, ICA was reviewing the technical aspects of improving the security of its online service. Following an internal assessment, it decided to suspend the online service on Jan 11.

“In hindsight, ICA could have taken steps to cease the service earlier in December 2024 when the modus operandi was established, but these are judgment calls that public officers have to make every day,” said Ms Sun.

“The Ministry of Home Affairs is reviewing with ICA what lessons we can draw from this incident.”