Singapore is tightening the way identities are verified across digital services as fraudsters become increasingly sophisticated at exploiting stolen personal information, compromised accounts and social-engineering tactics.
The push for stronger identity checks comes as Singapore’s digital economy becomes increasingly dependent on online authentication. From banking and e-wallets to telecommunications, government services and business registration, a single compromised digital identity can potentially give criminals access to multiple services.
The scale of the threat is becoming clearer through a series of recent cases involving Singpass, Singapore’s national digital identity platform.
In one recent operation, authorities uncovered a scheme in which compromised Singpass accounts were used to create more than 160 financial accounts without the account holders’ knowledge. Investigators identified more than 170 Singapore citizens and foreign workers whose identities were linked to the activity.
In another case, scammers targeted work permit holders with offers of quick cash in exchange for access to their Singpass accounts. The compromised accounts were subsequently used to register more than 30 financial accounts and over 1,200 mobile phone lines.
The incidents demonstrate why digital identity has become a critical front in Singapore’s fight against fraud.
Criminals are no longer relying solely on traditional phishing emails or fake websites. Increasingly, they are manipulating victims into voluntarily handing over information or changing security settings themselves.
In several cases, victims were persuaded to change the mobile phone number or email address connected to their Singpass account. Once those details were controlled by scammers, criminals could receive authentication codes and take over the account.
That means even strong technical safeguards can be undermined if criminals successfully manipulate the person behind the account.
Singapore has responded by adding more layers of verification for transactions considered particularly risky.
Face verification is already required for certain high-risk Singpass activities, helping establish that the person attempting to access or modify an account is actually the legitimate account holder.
The government has also introduced passkeys as an additional authentication option for Singpass users. Unlike conventional passwords, passkeys are designed to provide stronger resistance against phishing because users do not have to enter a password into a potentially fraudulent website.
The move reflects a broader change in digital security.
For years, passwords and one-time passwords were considered sufficient protection for many online services. But criminals have become increasingly effective at stealing credentials, intercepting authentication information and persuading users to reveal sensitive details.
The problem is particularly serious when one digital identity acts as a gateway to multiple services.
Singpass currently provides access to thousands of government and private-sector services and processes more than 41 million transactions each month. That convenience also makes it an attractive target for criminal networks.
A compromised identity can potentially be used to open financial accounts, register mobile lines, create e-wallets, establish businesses or facilitate other fraudulent activities.
Authorities are therefore increasingly focusing on identity verification before suspicious transactions are completed, rather than relying entirely on passwords or SMS authentication.
The changes are also being driven by the growing sophistication of scams.
Fraudsters have become better at impersonating employers, government agencies, banks and legitimate businesses. Some schemes use realistic job advertisements and convincing documentation to persuade victims that they are dealing with genuine organisations.
In one recent pattern, scammers posed as recruitment agents and offered jobs through social-media platforms. Victims were asked to provide personal information and modify details connected to their digital identities, supposedly to complete employment-related procedures.
Only later did some victims discover that their accounts had been taken over and used for financial applications.
The rise of artificial intelligence could further complicate the problem.
AI can make fraudulent messages more convincing, automate large-scale social engineering and help criminals create realistic impersonations. As these tools become more accessible, identity systems may increasingly need to determine not only whether the correct credentials were entered, but whether the person using them is genuinely the authorised individual.
That is why biometric verification, device-based authentication, behavioural monitoring and stronger account-risk assessments are becoming increasingly important.
However, tighter security also creates a difficult balancing act.
Digital services are popular partly because they are fast and convenient. Requiring additional identity checks for every transaction could create unnecessary friction, particularly for elderly users, people with disabilities and individuals who have limited access to smartphones or reliable internet connections.
The challenge is therefore to make security stronger without making digital services unnecessarily complicated.
Singapore’s approach is increasingly based on risk.
Routine transactions can remain relatively seamless, while higher-risk activities can trigger additional verification such as facial authentication or other security checks.
The government is also examining vulnerabilities surrounding mobile phone numbers linked to digital identities. This is important because control of a registered mobile number can sometimes become a stepping stone to taking over an account.
The latest developments suggest that Singapore’s digital-security strategy is moving beyond the traditional idea of protecting a username and password.
The focus is shifting toward protecting the identity itself.
That distinction is crucial.
A password can be changed after it is stolen. But when criminals obtain someone’s identity information and use it to create financial accounts, telephone lines or other services, the consequences can extend far beyond a single compromised login.
For businesses, the implications are equally significant.
Companies operating digital services may increasingly be expected to verify customers more rigorously, detect unusual account activity and respond quickly when identities appear to have been compromised.
Financial institutions and telecommunications providers are already major targets because fraudulent accounts and mobile lines can be used to move money, receive scam proceeds or coordinate further criminal activity.
The growing number of identity-related fraud cases suggests that criminals are adapting faster than traditional security measures can keep up.
Singapore’s next phase of digital transformation will therefore depend not only on making online services faster and more convenient, but also on ensuring that the person behind every digital transaction is genuinely who they claim to be.
As scams become more convincing and criminals increasingly exploit legitimate digital identities instead of simply stealing passwords, stronger identity verification is becoming less of an optional security upgrade and more of a fundamental requirement for the digital economy.
Leave a Reply