SINGAPORE: Two male Chinese Malaysians aged 25 and 47 have been arrested for exploiting their positions at a Singapore mobile phone shop to secretly access customers’ Singpass accounts and create LiquidPay e-wallets without their knowledge. Investigations revealed 171 additional victims whose Singpass accounts were compromised in the same scheme.
The arrests were made on August 25, 2026 following an operation between Aug 21 and 25 by the Cyber Command, supported by GovTech Singapore’s Singpass Trust and Safety team.
The two men were employees at a mobile phone shop in Singapore. Investigations revealed they exploited customer interactions to access Singpass accounts without consent. In one documented instance, when a customer came in to purchase a new SIM card, one of the men offered to help update the mobile number linked to the customer’s Singpass account and used that opportunity to secretly create a LiquidPay account in the customer’s name.
Since early March 2026, at least 20 Singapore citizens and work permit holders had already been investigated for involvement in registering LiquidPay accounts that received S$110,063 arising from various scams. Preliminary investigations suggest some of these individuals may not have been aware the accounts were created in their names.
Further investigations identified 171 more Singapore citizens and foreign workers whose Singpass accounts were linked to the same activity. The fraudulently created accounts were used to register more than 160 additional LiquidPay accounts without the account holders’ knowledge. All affected accounts have been frozen.
Charges and penalties
The two men were charged on August 27, 2026 with assisting another to retain benefits from criminal conduct under Section 51 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992. This offence carries imprisonment of up to ten years, a fine of up to S$500,000, or both.
Investigations into Singapore citizens and work permit holders who voluntarily provided their Singpass credentials are ongoing. Disclosing Singpass credentials to facilitate an offence under the Computer Misuse Act carries a fine of up to S$10,000, imprisonment of up to three years, or both.
What the public should know
The Police urged the public never to disclose Singpass passwords or Two-Factor Authentication details to unknown persons, and not to accept offers of monetary gain in exchange for Singpass accounts or credentials. Singpass access can be used to open bank accounts, e-wallets, cryptocurrency accounts, and mobile phone lines for illegal purposes.
The case is a reminder that Singpass credential theft does not always involve phishing; in this instance, it was facilitated by trusted service personnel exploiting a routine customer interaction. Members of the public should be cautious whenever anyone offers to access or update their Singpass account on their behalf.
To report information on such crimes, call the Police Hotline at 1800-255-0000 or submit at www.police.gov.sg/i-witness. For scam information, visit www.scamshield.gov.sg or call 1799.
Read also: iMessage courier scam losses climb to S$2.2 million as scammers widen their targets
