The Police would like to alert members of the public to a persistent trend observed in relation to a phishing scam variant. Scammers would pose as buyers on Carousell and victims would be instructed to complete the transaction on CarouPay after receiving emails with phishing URL links from scammers purportedly impersonating Carousell. In May 2022 alone, at least 15 victims have fallen prey to these scams, with losses totalling $12,000 or more.
Scammers would typically approach victims on Carousell and express interest in purchasing items that the victims are selling. After buying the item, the scammer would request to make payment via CarouPay to the victim’s PayNow account. Thereafter, the victims would receive an email purportedly sent from Carousell, indicating that payment had been made. This phishing email would then instruct victims to access their bank accounts via a phishing link or phishing PayNow QR code provided within the email to receive payment. Upon clicking these links or scanning the QR codes, victims would be redirected to spoofed bank websites, where the victims would be tricked into providing their banking details and One-Time Passwords (OTP) in order to receive payment. Victims would only realise that they have been scammed when they discover unauthorised transactions made to their bank accounts.
Members of the public are advised to note and follow these crime prevention measures:
- Carousell Protection (previously known as CarouPay) will never require you to confirm payment via email or require you to reveal any online banking login credentials through third party websites;
- Always verify the buyer’s profile on online marketplaces by checking the account's verification status, creation date, reviews and ratings;
- Do not click on links provided in unsolicited emails and text messages;
- Whenever redirected to what appears to be a bank website, check that the address is the bank’s known website address before entering any information.
- If in doubt, always verify the authenticity of any matter with the e-commerce platform or with the banks directly,
- Never disclose your personal or Internet banking details and OTP to anyone; and
- Report any fraudulent transactions to your bank immediately.
For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Hotline at 1800-722-6688. Anyone with information on such scams may call the Police Hotline at 1800-255-0000 or submit information online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.
Annex A
Images of scam emails and phishing websites
Screenshots of phishing email directing victims to phishing website to receive payment
Screenshots of phishing websites to receive payment
SINGAPORE POLICE FORCE
14 May 2022 @ 3:50 PM