In a modern twist on an age-old tale, the wolf no longer dons a sheep’s skin but lurks behind the digital screens, preying on unsuspecting victims.
By: Rose Maswida
In November 2021, the Police were alerted to a fake friend scam involving Arivalagan s/o Muthusamy and his accomplice, Hoang Trung Khang. Learn how officers from Singapore Police Force tracked down the scammers who exploited the cybersecurity loopholes to take over WhatsApp accounts.
Cracking the Code
The duo targeted mobile phone users who were registered with a telco’s voicemail mailbox feature. At that time, the telco allowed its users to access their voicemail mailboxes by dialling their mobile numbers and using a Personalised Identification Number (PIN). However, there was a default PIN number for users who had yet to set their PIN.
Knowing this, Arivalagan and Hoang called mobile phone numbers to test if the calls were diverted to voicemail mailboxes. After which, they would call the telco’s service hotline and key in the targeted victim’s mobile number and default PIN to access victims’ voicemail mailbox. This would offer a one-time password for them to register for a new WhatsApp account under the victim’s mobile phone number, thereby allowing them to take over the victims’ account through another device.
All that Glitters
On 27 November 2021, Arivalagan and Hoang gained access to nine WhatsApp accounts and sold them to an unidentified member of a scam syndicate. Three individuals were deceived into investing in gold or cryptocurrency, resulting in a total loss of $83,750 to the impersonators. Prior to this, they had also gained access to and sold other WhatsApp accounts.
A police report was lodged by one of the scam victims. The victim whose WhatsApp account had been used in the scam also informed the Police about suspicious activities on his account including a message stating, “Another account had logged into your account.”
Caught Red-Handed
Officers were able to track the transfer of $31,000 from one of the scam victims to an account, and noticed there were several withdrawals from it at an ATM.
With the PolCam network in place, officers were able to track Hoang, who had made the withdrawals. They were able to arrest Arivalagan and Hoang subsequently. Evidence such as mobile phones, cheques, bank cards and a number of digital devices were seized from the duo. The swift actions of the Police prevented Arivalagan and Hoang from exploiting other victims. They were prosecuted for offences related to the Computer Misuse Act under section 3(1). Arivalagan was sentenced to 10 months’ imprisonment while Hoang was sentenced to one year and four months’ imprisonment.
The vulnerabilities that the duo had exploited for committing the offences have since been rectified. The Police will continue to crack down on cybercrime and bring those involved to justice.
Crime Files
Police Life brings you actual investigations that Police officers have pursued to keep Singapore safe and secure. Watch a reenactment of this case on Crimewatch, Episode 9, 2024!
Explore Our Content
Editor's Pick
