Scammers making calls without ‘+’ prefix may be using local SIM cards, say experts

SCAMMERS who make calls that show up as local numbers without the “+” prefix are likely to be using local SIM cards rather than number-spoofing techniques, said several experts.

The Infocomm Media Development Authority (IMDA) had required all Singapore telcos to add a “+” prefix for international incoming calls since April 2020, to help Singapore residents better identify potential scam calls.

It now appears that scammers are trying to circumvent this safeguard by making their calls from local numbers instead.

In a Reddit post published on Mar 21, a user going by the handle Commonjunks said a call came in with the number “8”; the caller said in a “local” accent that there was a dispute over a transaction on Commonjunks’ DBS credit card.

The user said they normally ignore calls that start with “+65”, but this call did not have a prefix.

“I asked him about the nature of the dispute, and he replied that he would need my information first, starting with my name, to proceed,” Commonjunks said, adding that a check with DBS had not turned up any suspicious activity on the DBS account.

The Business Times also found several other individuals who received calls from phone numbers without the “+” prefix and starting with the number “8”. Upon answering these calls, individuals heard a recorded message.

In one instance, the robocall claimed there were issues with the individual’s identity card.

In response to media queries, the police said the matter is under investigation.

Cybersecurity experts said there is a possibility that scammers may have purchased or received SIM cards from visitors to Singapore.

David Siah, executive vice-president of South-east Asia-Australia at the Centre of Strategic Cyberspace + International Studies, a London-based think tank, said there are multiple ways for scammers to get hold of local SIM cards.

For instance, tourists visiting Singapore could sell their SIM cards to these syndicates to be reused. SIM cards may also be thrown away carelessly and picked up by scammers.

Ali Fazeli, chief technology officer of cybersecurity company Nexvision, noted that each person with a valid identity can own up to three SIM cards.

“Probably, (scammers) use people to purchase a local number and then basically use the local number for malicious activities,” he said.

Terence Siau, chief revenue officer at cybersecurity company ABPCyber, said scammers may also have found ways to mask their phone numbers in ways that sidestep the local telcos’ efforts to add the “+” prefix.

He noted that certain organisations use Internet Protocol (IP) phones that allow employees to make calls with local numbers, even while they are overseas.

Fazeli of Nexvision believes that this would be difficult, but did not rule it out. He noted that there are services on the dark web that provide potential scammers with local phone numbers as well.

“When it comes to the hackers, they always find a way,” he said.

To combat these scam calls, Siah suggested the public install ScamShield, an app developed by the National Crime Prevention Council and Open Government Products; it is designed to flag potential scam calls and messages.

Numbers are checked against a database maintained by the police and blocked accordingly. Users can also report suspicious calls or messages.

“With this kind of intelligence, you’ll get a wider database. The more people report these malicious calls, the faster authorities can react to block that number,” he said.

Siah added that consumers should be more vigilant and avoid taking calls from unfamiliar numbers. They should also avoid revealing their personal data.

“My advice is really not to get fixated with the ‘+65’-spotting and say, hey, it’s not ‘+65’, so it must be a safe call,” he said.

As a cybersecurity professional, he no longer picks up most calls.