The Police would like to alert members of the public to a new variant of scam, where scammers are using compromised WhatsApp accounts belonging to victims’ friends to promote the sale of gold bars.
In these cases, the scammers leveraged compromised WhatsApp accounts belonging to the victims’ friends to communicate with the victims. These scammers would then ask if the victims would like to purchase gold bars at a price that was 30% below the market rate. Scammers would explain that the gold bars were sold cheaply as these gold bars had been seized by the Immigration & Checkpoints Authority or Singapore Customs and were being auctioned off. The scammers would provide a fake invoice purportedly issued by the Singapore Customs and instruct the victims to transfer the payment for the gold bars to various bank accounts provided. In some cases, victims were told to meet up with the scammers to collect the gold bars. Victims only discovered that they had been scammed when they did not receive the gold bars, or when they realised that their friends’ WhatsApp accounts had been hacked after contacting their friends who did not turn up to complete the transaction.
Members of the public are advised to adopt the following crime prevention measures:
- Beware of unusual requests received over WhatsApp, even if they were sent by your WhatsApp contacts;
- Always call your friend to verify the authenticity of the request, but do not do so through WhatsApp as the account might have been taken over by scammers; and
- If the price is too good to be true, it probably is. Purchase only from authorised sellers or reputable sources, especially for high-value items.
In addition, to prevent your WhatsApp account from being compromised, members of the public are advised to take the following precautions:
- Protect your WhatsApp account by enabling the ‘Two-Step Verification’ feature. You can open WhatsApp and go to ‘Settings’ → ‘Account’ → ‘Two-step verification’ → ‘Enable’; and
- You should contact your telco service provider to change your voicemail account’s default PIN or to deactivate the voicemail feature. (Refer to Annex B to understand how scammers can gain access to your WhatsApp account via voicemail)
If you have information related to such crimes, please call the Police hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. Please dial ‘999’ if you require urgent Police assistance.
For more information on scams, members of the public can visit www.scamalert.sg or call the anti-scam hotline at 1800-722-6688. Join the ‘Spot the Signs. Stop the Crimes’ campaign at www.scamalert.sg/fight by signing up as an advocate to receive up-to-date messages and share them with your family and friends. Together, we can help stop scams and prevent our loved ones from becoming the next victim.
Annex A
Annex B
How do scammers leverage voicemail to take over WhatsApp Accounts?
The scammer would deliberately fail the verification process by keying in the wrong 6-digit verification codes repeatedly when he is trying to log into a victim’s WhatsApp account on the scammer’s device.
In the event that there are repeated failed verifications, WhatsApp would prompt the victim to perform a “voice verification”. WhatsApp would initiate the “voice verification” process by calling the victim’s phone number to provide the verification code in an audio message. If the victim ignores the call or if the phone is not switched on, the audio message would be directed to the victim’s voicemail account.
The scammer would then seize the opportunity to access the victim’s voicemail account remotely by using the default PIN used by telco service providers to retrieve the 6-digit verification code from the audio message and take over the victim’s WhatsApp account.
After taking over the victim’s WhatsApp account, the scammer could enable two-step verification to prevent the victim from regaining control over the WhatsApp account.
SINGAPORE POLICE FORCE
02 June 2021 @ 1:45 PM