ST Explains: How do scammers exploit government directories, and how can they be stopped?

Singapore has taken steps to reduce the exposure of its public officers' personal information in online directories, aiming to curb the rising tide of scams involving impersonation of government officials. This measure follows a sharp increase in such scams, which rose to 3,363 cases in 2025, nearly double the previous year's total of 1,504. These scams have caused victims to lose S$242.9 million in 2025, making it the second-largest financial loss from all scam categories that year. Scammers often pose as officials from bodies such as the Singapore Police Force, the Immigration and Checkpoints Authority, and the Ministry of Law. They warn victims of fabricated issues like unauthorized bank or telecommunications applications, unpaid taxes, or potential legal problems. Victims are pressured to provide personal details, passwords, or transfer funds to so-called "safe accounts" to resolve these alleged issues. In some instances, scammers have also impersonated bank and telecom staff, directing victims to fake government representatives to facilitate fraudulent transfers. The effectiveness of these scams is partly due to the availability of real officer names, positions, agencies, and contact numbers in online directories. This information gives scammers a veneer of legitimacy, making it easier for them to manipulate victims. According to Andy Prakash, founder and CEO of IT security firm Privacy Ninja, verifying an officer's existence through an online directory does not necessarily confirm that the person on the other end of the call is genuine. Telcos have implemented several measures to combat such frauds. Since 2019, they have blocked the spoofing of emergency and government agency numbers. Starting in April 2020, overseas calls received a "+" prefix to alert users that the call might not originate within Singapore. By December 2022, all overseas calls that attempted to mimic local numbers were blocked entirely. However, scammers have shifted tactics, using messaging platforms like WhatsApp to bypass these restrictions. On WhatsApp, scammers can spoof local numbers, including those associated with government agencies, because the platform operates outside the jurisdiction of Singapore's telcos. They may also use official logos as profile images or appear in uniforms during video calls to enhance the illusion of authenticity. Aaron Ang, regional director at cybersecurity consultancy CWG Innovations, emphasized that no legitimate Singapore agency conducts business via WhatsApp. He noted that the very use of the platform should serve as a warning sign for users. To safeguard against scams on WhatsApp, users are advised to modify their privacy settings to mute unknown callers. If uncertain about a call, individuals can reach out to the national ScamShield helpline at 1799 or utilize the ScamShield app to report suspicious numbers. Ang suggested that altering all government contact details at once could inadvertently create new vulnerabilities, comparing it to changing one's home address to avoid junk mail. Private sector organizations generally refrain from publishing employee directories online due to concerns about corporate espionage. Similarly, government agencies face risks if their directories are exploited. While some countries like Canada, Hong Kong, and Australia maintain public directories for transparency, the balance between accessibility and security remains a challenge for Singapore. The government continues to refine its strategies to ensure public safety while maintaining necessary communication channels with citizens.