Companies urged to sign up for SMS registry, restrain use of SMS

IN light of recent scams perpetrated via SMS, Minister for Communications and Information Josephine Teo urged companies on Tuesday (Feb 15) to sign up to the pilot Singapore SMS Sender ID protection registry and rethink the way they use SMS.

This comes after scammers impersonated OCBC using SMS to trick customers into providing their Internet banking login credentials via fake bank websites.

Teo was responding to questions posed by Members of Parliament about the recent scams that were perpetrated, and what the government has done to help secure communication methods used by companies.

She added that the Monetary Authority of Singapore has already required all major retail banks to register their alphanumeric sender IDs that they use to communicate with their customers.

By registering their sender IDs with the registry, other SMSes that try to spoof registered IDs will not be delivered as they do not match registry records.

To register a sender ID, organisations will need to have valid unique entity numbers, which will help police with investigations when scams occur, Teo said.

The Infocomm Media Development Authority (IMDA) will also consider making the registry mandatory, although doing so would make it such that businesses that choose not to register their alphanumeric sender IDs will have their SMS messages appear only as telephone numbers.

Furthermore, organisations should use more restraint when transmitting sensitive, confidential information or high value transactions, Teo said, noting that the SMS system is an old technology that was never designed for secure communications.

"It is like our postal services. They are generally safe, but we would not send very valuable items even using registered post," she said.

Aside from SMS, other communication methods, such as phone calls and emails have also been used to spoof companies and phish for information.

Teo likened the scammers who perpetrated the scams on OCBC customers to people who stood in front of the bank and tricked customers into handing over their identity cards and keys, after which they pretended to be real customers to clear out their deposit boxes.

"Why did the victims fall prey? Because the scammer looked real by wearing the correct uniform and name tag bearing the bank's logo. Why did the bank fall prey? Because the scammer was in possession of items that only real customers were expected to have," Teo said.

In order to disrupt scammers' operations, Teo said that the police and IMDA have worked with Internet service providers (ISPs) to block scam websites.

In 2021, 12,000 suspected scam websites were blocked as authorities cast their net wider, a sharp rise from about 500 such websites blocked a year before.

Still, while she noted that there is more capacity to block suspicious websites, scammers will continue to react quickly against these blocks.

In the OCBC case alone, more than 350 scam websites were blocked, with as many as 52 sites being blocked in a single day, as the scammers were quick to create new websites through their campaign.

As for phone calls, Teo revealed that telcos already block around 15 million calls each month, or about 1 in 7 of all incoming overseas calls to Singapore.

Customers can also look for the "+" prefix attached to all incoming overseas calls to avoid picking up such scam calls.

With additional analytics capabilities to block more suspected scam calls, an estimated 55 million calls could be blocked each month.

"Scammers change methods and tactics to evade detection, and our capabilities will need to likewise adapt.

"IMDA will work with the telcos to continuously strengthen their anti-scam capabilities," Teo said.

Singtel's chief executive of consumer Singapore Anna Yip said the telco has blocked an estimated 40 million SMSes per year from overseas mobile operators since it began blocking incoming SMS traffic not officially routed through Tier 1 SMS aggregators 5 years ago. Such aggregators work directly with telcos to send SMSes on behalf of companies.

"Given the increasing sophistication of online scammers, Singtel also regularly updates its SMS firewall, using the latest AI (artificial intelligence) technology and analytics to detect and block messages with harmful URLs," she said.

READ MORE:

• Banks, customers to share scam losses; framework to seek views: Wong
• A better alternative exists for SMS - if players can be persuaded to use it
• BT Explains: What you need to know about SMS phishing