The Police have observed a new variant of malware scams where factory reset would be initiated by scammers on the victims’ infected devices after the malware executes unauthorised transactions on the phone’s i-banking app. In the first half of 2023, more than 750 cases of victims have downloaded the malware onto their phones, with losses amounting to at least $10 million.
In this scam variant, victims would come across advertisements for various services (Food purchase, Home Cleaning, Pet Grooming, etc) on social media platforms like Facebook and Instagram. The victims would contact the “sellers” via the social messaging platforms or WhatsApp. The “sellers” would then send a URL to the victims to download an Android Package Kit (APK) file, an application (app) created for Android’s operating system.
After downloading and installing the APK file (which includes granting the app accessibility services), the victims would then be instructed to make a PayNow transfer of $5 as deposit for these services. Unknown to the victims, their internet banking credentials would be stolen by the malware’s keylogging function upon the transfer. After the scammers accessed and performed unauthorised transactions from the victim’s banking account, they would initiate a factory reset on the victims’ devices. The victims would then discover the unauthorised transactions after calling their banks or when they re-install the banking apps on their devices.
The Police would like to remind members of the public of the danger of downloading apps from third-party or dubious sites. Members of the public are advised to adopt the following precautionary measures:
- ADD - ScamShield App and set security features (e.g., enable two-factor (2FA) or multifactor authentication for banks and set transaction limits on internet banking transactions, including PayNow). Ensure that your devices are installed with updated anti-virus/anti-malware applications and your devices’ operating systems and applications are updated regularly to be protected by the latest security patches. Disable “Install Unknown App” or “Unknown Sources” in your phone settings and do not grant permission to persistent pop-ups that request for access to your device’s hardware or data.
- CHECK - For scam signs with official sources (e.g. ScamShield WhatsApp bot @ https://go.gov.sg/scamshield-
bot, call the Anti-Scam Helpline on 1800-722-6688, or visit www.scamalert.sg). Only download and install applications from official app stores (i.e., Google Play Store for Android). Be wary if asked to download unknown apps in order to purchase items or services on social media platforms. Check the developer information on the app listing as well as the number of downloads and user reviews to ensure it is reputable and legitimate.
- TELL - Authorities, family, and friends about scams. Report the number to WhatsApp to initiate in-app blocking and report any fraudulent transactions to your bank immediately.
If you have already downloaded and installed the app (which includes granting the app accessibility services) or suspect that your phone is infected with malware, please take the following steps:
- Turn your phone to “flight mode”. Check that Wi-Fi is switched off and do not switch it on.
- Run an anti-virus scan on your phone.
- Check your bank account/Singpass/CPF etc for any unauthorised transaction(s) using other device(s).
- If there are unauthorised transaction(s), report to the bank, relevant authorities, and lodge a Police report.
- After completing steps a-c, if you believe that your phone has not been infected with malware, you may resume usage of your phone. As a further precaution, you may consider doing a “factory reset” of your phone and changing important passwords.
If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.
For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community!
Annex A
Screenshots of the fraudulent Facebook advertisement ▼
SINGAPORE POLICE FORCE
20 September 2023 @ 7:41 PM