The Immigration and Checkpoints Authority (ICA) revealed on Saturday (Jan 11) that it has temporarily suspended an electronic service that enables residents in Singapore to change their residential addresses online. The suspension was initiated after approximately 80 unauthorized attempts were detected to alter registered residential addresses using the “others” option, which permits address changes by a proxy through the online service.
According to the agency, the individuals behind the attempts, who were operating with stolen or compromised Singpass accounts, managed to successfully alter addresses in about 75% of the cases. It is believed that these alterations were made to potentially establish more mule accounts for scams and other cybercrimes.
In response to these security breaches, ICA immediately suspended the electronic change of address (eCOA) service in order to implement added security measures to prevent further misuse. ICA mentioned in a news release, “We will conduct a review in the next two days and will likely bring up the service on Jan 14. The ‘others’ module will remain unavailable until ICA has implemented further measures to safely allow the change of address by a proxy.”
ICA stated that the electronic service was introduced in October 2020 to enable Singapore residents, including those living abroad, to report changes of residential addresses to ICA online. Users could modify their own or others’ residential addresses by logging in with their Singpass accounts under three options: Myself, myself and my family members, and others.
Of particular concern was the “others” module introduced in 2020, aimed at assisting those less digitally inclined to update their residential addresses online through proxies with Singpass accounts. On average, about 900 Singapore residents utilize proxies to change their residential addresses every month.
ICA’s commissioner Marvin Sim disclosed that investigations were initiated since September last year following reports from the public about unauthorized address changes. By last December, investigations revealed that the culprits had breached the system using stolen Singpass accounts to alter victims’ residential addresses through the “others” module of the e-service.
Mr. Sim emphasized, “This is not an issue about (a) system glitch…in recent months, we detected a new modus operandi of people trying to make use of the eCOA to fraudulently change the address of another person and, as a result, seek control of their Singpass for other criminal activities.”
As part of efforts to reinforce security, ICA will integrate face verification technology into the Singpass login process for the online service and are considering adding an OTP (One-Time Password) requirement before residential addresses can be altered via the “others” option.
ICA mentioned that while the e-service remains suspended, individuals needing proxy assistance can visit the IC Unit on Level 3 of the ICA Building for help on weekdays between 8am and 4.30pm. Additionally, ICA is reaching out to all affected individuals to provide support in obtaining replacement NRICs (National Registration Identification Cards) and reverting registered addresses to their rightful ones.
For those concerned about compromised Singpass accounts, ICA assured they would collaborate with GovTech to reset the accounts. The public was advised to check their registered addresses on ICA’s website and promptly report inaccuracies.
In response to queries, the Singapore Police Force (SPF) declined to comment further, citing ongoing investigations.
