The Police have observed the resurgence of social media impersonation scams involving fake campaigns. From 1 January to 26 July 2023, at least 124 victims have fallen prey to this variant, with total losses amounting to at least $330,000.
The scam works in the following ways:
- Victims are approached on social media platforms such as Instagram or Facebook on the pretext of joining, or voting in fake campaigns allegedly organised by local brands (e.g. Lazada, Grab, Shopee). Unknown to the victims, these social media accounts have either been taken over by scammers or were spoofed by culprits impersonating as victims’ relatives or friends.
- The scammers would then ask victims for their phone numbers and/or One-Time Passwords (OTPs) sent out from various platforms (e.g. Microsoft, Grab, Google) in order to receive gift vouchers or monies “won” from the “campaign”.
- The OTPs provided by the victims would be abused by the scammers to approve transactions from the victims’ linked bank accounts/cards to e-wallets (e.g. Grab Activation Code). Victims may also lose access to their Instagram/Facebook accounts after giving away OTPs that were meant to reset their account passwords.
- In some variants, victims may lose access to their Instagram/Facebook accounts after clicking on links that were meant to reset their account passwords or to change the email addresses linked to their accounts.
Apart from requests for phone numbers and OTPs, victims may be asked for their debit/credit card details, internet banking credentials and/or OTPs on the pretext of receiving gift vouchers or monies “won” from the “campaign”. Victims would receive a link leading them to a website fraudulently bearing the DBS logo which would be used to phish for their banking credentials. Victims would later discover unauthorised transactions made to their banking accounts and/or unauthorised charges made to their handphone bills.
The Police would also like to advise members of the public to adopt the following precautionary measures:
- ADD - ScamShield App and set security features (e.g., enable two-factor (2FA) or multifactor authentication for banks, social media, Singpass accounts; set transaction limits on internet banking transactions, including PayNow/PayLah).
- CHECK - for scam signs with official sources (e.g., visit www.scamalert.sg, call the Anti-Scam Helpline at 1800-722-6688 or check with the platforms on the authenticity of the campaigns). Be wary of unexpected requests or offers from social media contacts, especially those related to campaigns or contests. Never disclose your personal details, banking credentials and OTPs to anyone.
- TELL - authorities, family, and friends about scams. Report any fraudulent transactions to your bank and telecommunications company immediately. If your social media account has been compromised, report this to the platform and inform your friends so that they do not fall prey to scammers who may use your social media account to impersonate you.
If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.
For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community.
Annex A
Example of a Fake Lazada Campaign with Phishing Link Provided
Example of a Facebook Password Reset Code Given by Victim to Participate in the “Campaign”
Example of a Lazada “Campaign” Banner
SINGAPORE POLICE FORCE
02 August 2023 @ 3:45 PM