POLICE ADVISORY ON RESURGENCE OF SOCIAL MEDIA IMPERSONATION SCAMS INVOLVING FAKE CAMPAIGNS 2023.8.2……【Police】【Singapore】The Police have observed the resurgence of social media impersonation scams involving fake campaigns. From 1 January to 26 July 2023, at least 124 victims have fallen prey to this variant, with total losses amounting to at least $330,000.
➤【新加坡】骗子社媒谎称受害人中奖至少124人被骗33万元
在社交媒体平台上冒充受害者的亲友，不法之徒谎称对方在本地品牌举办的活动中“中奖”，实则是为了窃取受害者的个人资料。警方指这类诈骗卷土重来，今年1月至7月26日，至少124人受骗，损失总金额至少33万元。
新加坡警察部队星期三（8月2日）发文告，揭露这类诈骗手法的详情。警方指出，骗子一般上通过入侵或冒充受害者亲友的社交媒体账户，在社媒平台如脸书或Instagram诱导受害者参与不同品牌如“Lazada”或“Grab”等举办的活动。
受害者过后会被告知他们在这些活动中“中奖”，但需要提供电话号码和或不同平台发出的一次性密码（OTP）以领取奖品。殊不知，骗子其实使用这些OTP来完成链接受害者银行户头或银行卡的交易。
在一些案件中，受害者收到的OTP其实是用来重置社交媒体户头的密码，而受害者在提供OTP后，就会发现社媒户头被入侵。有一些受害者也会收到链接，而这些链接其实用来重置他们的户头等，导致骗子取得这些户头的控制权。
警方说，骗子也有可能让受害者提供转账卡或信用卡的资料等，而受害者答应后就会收到一个链接，但这个链接其实是一个钓鱼链接，受害者点击后就会发现银行户头或电话账单过后会出现未经授权的交易。

POLICE ADVISORY ON RESURGENCE OF SOCIAL MEDIA IMPERSONATION SCAMS INVOLVING FAKE CAMPAIGNS

The Police have observed the resurgence of social media impersonation scams involving fake campaigns. From 1 January to 26 July 2023, at least 124 victims have fallen prey to this variant, with total losses amounting to at least $330,000.

The scam works in the following ways:

Victims are approached on social media platforms such as Instagram or Facebook on the pretext of joining, or voting in fake campaigns allegedly organised by local brands (e.g. Lazada, Grab, Shopee). Unknown to the victims, these social media accounts have either been taken over by scammers or were spoofed by culprits impersonating as victims’ relatives or friends.
The scammers would then ask victims for their phone numbers and/or One-Time Passwords (OTPs) sent out from various platforms (e.g. Microsoft, Grab, Google) in order to receive gift vouchers or monies “won” from the “campaign”.
The OTPs provided by the victims would be abused by the scammers to approve transactions from the victims’ linked bank accounts/cards to e-wallets (e.g. Grab Activation Code). Victims may also lose access to their Instagram/Facebook accounts after giving away OTPs that were meant to reset their account passwords.
In some variants, victims may lose access to their Instagram/Facebook accounts after clicking on links that were meant to reset their account passwords or to change the email addresses linked to their accounts.

Apart from requests for phone numbers and OTPs, victims may be asked for their debit/credit card details, internet banking credentials and/or OTPs on the pretext of receiving gift vouchers or monies “won” from the “campaign”. Victims would receive a link leading them to a website fraudulently bearing the DBS logo which would be used to phish for their banking credentials. Victims would later discover unauthorised transactions made to their banking accounts and/or unauthorised charges made to their handphone bills.

The Police would also like to advise members of the public to adopt the following precautionary measures:

ADD – ScamShield App and set security features (e.g., enable two-factor (2FA) or multifactor authentication for banks, social media, Singpass accounts; set transaction limits on internet banking transactions, including PayNow/PayLah).
CHECK – for scam signs with official sources (e.g., visit www.scamalert.sg, call the Anti-Scam Helpline at 1800-722-6688 or check with the platforms on the authenticity of the campaigns). Be wary of unexpected requests or offers from social media contacts, especially those related to campaigns or contests. Never disclose your personal details, banking credentials and OTPs to anyone.
TELL – authorities, family, and friends about scams. Report any fraudulent transactions to your bank and telecommunications company immediately. If your social media account has been compromised, report this to the platform and inform your friends so that they do not fall prey to scammers who may use your social media account to impersonate you.

If you have any information relating to such crimes or if you are in doubt, please call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. All information will be kept strictly confidential. If you require urgent Police assistance, please dial ‘999’.

For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Helpline at 1800-722-6688. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community.

Annex A

Example of a Fake Lazada Campaign with Phishing Link Provided

20230802_police_advsry_on_resurgence_of_social_media_impersonation_scams_invlvng_fake_campaigns_1

Example of a Facebook Password Reset Code Given by Victim to Participate in the “Campaign”