Infocomm Security

[Admin]

2023 July: Ongoing scams in Singapore
        1. Getting concert tickets from scalpers
        2. “Guess who I am” phone call scam
        3. Fake food promos & ads on social media like Facebook
        4. Crypto scams on dating apps
        5. Delivery of online purchases scam
        6. Calls or texts from the bank
        7. Fake giveaways on Facebook with legit-looking comments
        8. Fake links from IRAS & LTA
        9. Phony artwork buyers targeting local artists
        10. Fake job recruiters on Telegram
        11. Job hiring scams for “Online Marketing Associate”
        12. Unofficial emails or unauthorised payments from Apple
        13. Carousell scams
        14. Instagram ambassador scams
        15. Identity thief/impersonation on Instagram
        16. Messages and calls from “royalty” and kidnapping scams
       

Source: https://thesmartlocal.com/read/singapore-scams

Archive: https://archive.fo/tGbFw

[Admin]

Mooncake scam in Singapore swindles 27 victims, results in $325,000 losses in a month
Fraudulent mooncake sales on social media platforms exploit unsuspecting victims, as police share safety measures
Nisha Rahim | Wed, 6 September 2023

SINGAPORE — At least 27 victims have fallen prey to a recent scam involving mooncake sales on social media platforms, resulting in losses totalling around $325,000 since August, said the police on Tuesday (5 September).

The scam involved fraudulent mooncake sales on social media platforms such as Facebook and Instagram, and the police provided details to help the public avoid falling victim to these schemes.

How victims fell for malicious links and lost thousands

The scam victims reported contacting "sellers" advertising mooncakes on platforms like Facebook and Instagram.

Once they expressed interest and placed orders through social messaging platforms, they were redirected to WhatsApp to complete their payments.

However, the police have revealed that the links in the WhatsApp messages led victims to download an Android Package Kit (APK) file, an application designed for Android operating systems containing malware.

In other instances, victims were instructed to make payments via PayNow or bank transfers to purchase mooncakes. Subsequently, the scammers informed victims that their orders needed to be cancelled due to production or manpower issues and then directed them to malicious links under the guise of offering refunds.

Once the APK file was downloaded and installed, the scammers gained remote access to victims' devices, allowing them to steal passwords and access banking credentials, according to the police.

As a result, victims later discovered unauthorised transactions in their bank accounts.

Facebook user's warning

A Facebook user posted on Tuesday in the Facebook Group, Complaint Singapore that she had bought some durian mooncakes from a seller known as Duria Singapore 榴冠王 - 新加坡总代, and she shared her experience:

"What a scammer. Received a call from Lily today for tomorrow delivery. To my surprise, she told me the factory had people catching COVID and the factory was required to do disinfectation and will be closed for the month. There was no promise when they can do the delivery, and I asked for a refund."

According to the user, the problem arose when the seller required her to download an app to process the refund, but it's available only on Android phones.

She stated, "I'm an iPhone user, so (it) couldn't be done. (Lily) mentioned that she was going to check for me. On the next day, she deleted all the messages she had sent and blocked me. She even blocked me on Facebook Messenger."

The user called for others to be aware when making purchases from Facebook merchants.

Facebook user posted on Tuesday in the Facebook Group, Complaint Singapore that she had bought some durian mooncakes from a seller known as Duria Singapore 榴冠王 - 新加坡总代

Facebook user posted on Tuesday in the Facebook Group, Complaint Singapore that she had bought some durian mooncakes from a seller known as Duria Singapore 榴冠王 - 新加坡总代 (PHOTO: Screengrab/Facebook/Complaint Singapore)

Police offer precautions and actions to safeguard finances and devices

To protect against falling victim to such scams, the police advise taking several precautionary measures.

These include installing the ScamShield app, enabling two-factor or multifactor authentication for bank apps, and setting transaction limits on internet banking transactions.

Additionally, it is important to ensure that devices have updated antivirus/anti-malware applications and to disable the "Install Unknown App" or "Unknown Sources" phone settings.

Furthermore, police said the public should download and install applications only from official app stores and to exercise caution when asked to download unknown apps to make purchases on social media platforms.

Should they encounter fraudulent transactions, the police urge them to report to their banks immediately and inform the relevant authorities, family and friends about the scams.

If they suspect that their phones may be infected with malware, they can take the following steps:

•     Switch your phone to "flight mode" and check that wi-fi is switched off. Do not switch it on.
•     Run an antivirus scan.
•     Check your bank, Singpass, and Central Provident Fund accounts for unauthorised transactions on other devices.
•     Report the issue to the bank and relevant authorities, and file a police report.

For additional scam information, the public can visit www.scamalert.sg or contact the anti-scam helpline at 1800-7226688.

Source: https://sg.news.yahoo.com/mooncake-scam-singapore-swindles-victims-losses-051741496.html

Archive: https://archive.ph/oNlg6

[Admin]

10 suspects, including three teenagers, arrested for banking-related malware scams in Singapore
Vihanya Rakshika | 09 Sep 2023

SINGAPORE: Six men, one woman, and three teenagers – aged between 16 and 28 – have been arrested for their alleged involvement in a spate of banking-related malware scams.

The 10 individuals were nabbed following island-wide operations conducted by the Commercial Affairs Department and Police Intelligence Department from Aug 28 to Sept 8.

Another two men and two women, aged between 20 and 49, are assisting in the investigations.

The suspects allegedly facilitated the scam cases by relinquishing their bank accounts, Internet banking credentials, and Singpass credentials for monetary gains.

Since January 2023, there has been an increase in reports of malware compromising Android devices, leading to unauthorised transactions from victims’ bank accounts.

Victims responded to advertisements on social media platforms like Facebook, downloaded Android Package Kit from unofficial app stores as instructed by the scammers, and were convinced to turn on accessibility services on their phones.

This weakened the phones’ security, enabling scammers to take control of the devices to steal banking credentials, access banking apps, add money mules, raise payment limits, transfer money, and delete notifications to cover their tracks.

The offence of acquiring benefits from criminal conduct carries a jail term of up to 10 years, a fine of up to $500,000, or both.

Deceiving banks into opening accounts not meant for personal use and relinquishing account login details are punishable offences, carrying a jail term of up to three years, a fine, or both.

Disclosing Singpass credentials can lead to a jail term of up to three years, a fine of up to $10,000, or both.

The police have been warning the public against downloading apps from third-party websites or unknown sources, as these could contain malware. They also advise the public to download apps only from official app stores and to be wary of requests for Singpass and banking credentials or money transfers.

The police further advise the public to reject attractive money-making opportunities that involve the use of their Singpass accounts or bank accounts for illegal activities.

For more information on scams, the public can visit www.scamalert.sg or call the anti-scam helpline on 1800-722-6688. Anyone with information on such scams may call the police hotline on 1800-255-0000, or submit information online at www.police.gov.sg/iwitness.


Source: https://www.thestar.com.my/aseanplus/aseanplus-news/2023/09/09/10-suspects-including-three-teenagers-arrested-for-banking-related-malware-scams-in-singapore

Archive: https://archive.ph/3g7Yk

[Admin]

Password-stealing Linux malware served for 3 years and no one noticed
Dan Goodin | 9/13/2023

A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday.

The site, freedownloadmanager.org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg.org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored.

After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved.

“This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure),” the researchers wrote in a report on Tuesday. “After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers’ infrastructure.”

After searching social media posts that discussed Free Download Manager, the researchers found that some people who visited freedownloadmanager.org received a benign version of the app, while others were redirected to one of the following malicious domains that served the booby-trapped version.

    2c9bf1811ff428ef9ec999cc7544b43950947b0f.u.fdmpkg.org
    c6d76b1748b67fbc21ab493281dd1c7a558e3047.u.fdmpkg.org
    0727bedf5c1f85f58337798a63812aa986448473.u.fdmpkg.org
    c3a05f0dac05669765800471abc1fdaba15e3360.u.fdmpkg.org

It’s unclear why some visitors received the non-malicious version of the software and others were redirected to a malicious domain. The malicious redirects ended in 2022 for unknown reasons.

The backdoor is an updated version of malware tracked as Bew, which was published in 2014. Bew was one of the components used in an attack in 2017. The stealer called by the backdoor was installed in a 2019 campaign after first exploiting a vulnerability in the Exim Mail Server.

“While the campaign is currently inactive,” the researchers wrote, referring to the recent incident, “this case of Free Download Manager demonstrates that it can be quite difficult to detect ongoing cyber attacks on Linux machines to the naked eye.” They added:

    The malware observed in this campaign has been known since 2013. In addition, the implants turned out to be quite noisy, as demonstrated by multiple posts on social networks. According to our telemetry, victims of this campaign are located all over the world, including Brazil, China, Saudi Arabia and Russia. Given these facts, it may seem paradoxical that the malicious Free Download Manager package remained undetected for more than three years.

        As opposed to Windows, Linux malware is much more rarely observed;
        Infections with the malicious Debian package occurred with a degree of probability: some users received the infected package, while others ended up downloading the benign one;
        Social network users discussing Free Download Manager issues did not suspect that they were caused by malware.

The post offers a variety of file hashes and domain and IP addresses that people can use to indicate if they’ve been targeted or infected in the campaign, which the researchers suspect was a supply chain attack involving the benign version of Free Download Manager. The researchers said people running the freedownloadmanager.org site didn’t respond to messages notifying them of the campaign. They also didn’t respond to an inquiry for this post.

Source: https://arstechnica.com/security/2023/09/password-stealing-linux-malware-served-for-3-years-and-no-one-noticed

Archive: https://archive.ph/c1c9I

[Admin]

Cyber insurance claims spiked in first half of 2023 as ransomware attacks surged: report
James Reddick | September 22nd, 2023

A cyber insurance firm reported a significant jump in the number of claims during the first half of the year, adding that damages caused by attacks has also increased.

An analysis from San Francisco-based Coalition found that ransomware was the “largest driver of the increase in claims frequency,” which was up 12% on last year through the end of June. Overall, ransomware was involved in nearly 1 in 5 cyber incidents involving insurance claims, with Royal, BlackCat and LockBit 3.0 the three most common variants.

May was a particularly busy month, involving “the most ransomware claims in a single month in Coalition history.”

“After trending downward for 18 months, ransomware appeared to have fallen out of favor among threat actors,” the report’s authors wrote. “However, recent spikes in both the frequency and severity of ransomware claims indicate threat actors are unwilling to pass up on such highly lucrative attacks.”

Ransomware victims reported an average loss of more than $365,000, a huge jump from the previous record amount of more than $227,000 in the second half of last year.

While it’s typically impossible to know how much companies end up paying ransomware groups, Coalition’s data does help to get a sense of the amount and frequency of payments. The average ransom demand was $1.62 million — up 74% over the past year. According to the report, 36% of Coalition’s policyholders facing an attack did pay ransoms “when reasonable and necessary,” which through negotiations were lowered on average to 44% of the original amount demanded by the attackers.

Large companies with more than $100 million in revenues bore the brunt of the ransomware spree, seeing a 20% rise in the frequency of overall cyber incidents. That corresponded with a rise in claims severity of more than 70%, to $236,779.

Funds transfer fraud

Also highlighted in Coalition’s cyber insurance claims data was the prevalence of funds transfer fraud (FTF) — when cybercriminals redirect an online money transfer towards their own coffers. Overall, transfer fraud claims were up 15% in the first half of the year, with severity increasing 39% to an average loss of just under $300,000. That amount is still less than the record of $410,000 in the first half of 2021.

“The growing sophistication of threat actors and their tactics is a contributing factor in the upward trend in FTF claims severity,” they wrote. “The longer a threat actor remains in an email account after compromise, the more difficult it becomes to recognize and report abnormal activity — and they appear more willing to wait for the right moment to intercept or redirect large payments.”

One of the lone bright spots thus far is the decrease in claims related to business email compromise (BEC). Their frequency dropped 15% and their severity 7%, to an average loss of $21,000.

As cyberattacks have grown in frequency and cost for targeted organizations, the cyber insurance industry has expanded dramatically. The insurance group Howden recently predicted the cyber insurance market would expand to $50 billion by 2030. That market has been volatile in recent years, with premiums skyrocketing, but 2023 has seen cyber premiums remain largely stable.


Source: https://therecord.media/cyber-insurance-claims-spike-as-ransomware-soars

Archive: https://archive.ph/AfZ1X

[Admin]

Woman loses over $110,000 after downloading third-party app to buy durian tour ticket
Ms Lie had chanced upon an offer for a durian day tour, and was instructed to download a third-party app to browse the tour offers. PHOTO: MS LIE
Sherlyn Sim | 27 Sep 2023

SINGAPORE – A part-time bakery worker lost over US$81,000 (S$110,960) to scammers who siphoned money from her two DBS bank accounts after infecting her Android phone with malware.

Ms Lie, 52, had on Sept 10 chanced upon a Facebook advertisement for a $28 durian day-tour ticket to Kulai, Malaysia, from a tour agency called “GD Travel & Tour”.

She was attracted by the offer as she had enjoyed a durian tour in 2022 and contacted the seller on Facebook.

The seller texted Ms Lie on WhatsApp and instructed her through voice messages to download a third-party app called EG Store on her phone to browse the tour offers.

“I wasn’t suspicious of him. He had a strong Malaysian accent and sounded very sincere. He was patient and helpful with my questions about the tour so I believed him,” she told The Straits Times.

Ms Lie eventually did not buy the tour ticket as her friends did not want to go. She did not provide him with her banking details or address.

She did not think much about the incident until a week later when she was trying to pay her credit card bills. She noticed that she could not log into her Internet banking app after multiple attempts.

Her son, who wanted to be known as Mr Teo, called DBS immediately, thinking its digital banking services were disrupted.

It was only when a bank officer told Mr Teo that his mother’s account was locked on Sept 13 due to large transfers of US dollars that they realised something was amiss.

The scammers had raised her transaction limit and transferred over $110,000 out of two DBS savings accounts to five different bank accounts.

Ms Lie said she had set aside that money for her retirement and Mr Teo’s wedding in 2024.

“I cry every day and cannot sleep. This was my money saved over three decades. I deleted all the banking apps in my phone because I’m so scared,” said Ms Lie, who has three children.

Ms Lie sought help from DBS and reached out to Jalan Besar GRC MP Wan Rizal to waive the amount that was drawn from the bank accounts. She made a police report on Sept 18.

The police confirmed that investigations are ongoing.

When contacted, DBS said it has dedicated resources to “act swiftly and assist” customers who are scammed, including a dedicated fraud hotline – 1800-339-6963 (from Singapore) or (+65) 6339-6963 (from overseas). It also has a safety switch function on the digibank app, which would temporarily block access to funds.

“We will assist these customers with necessary follow-up actions, which include making a police report, or replacing their cards/re-securing their accounts,” DBS said.

“While we continue to adopt multi-pronged measures to strengthen fraud prevention and recovery, customers remain the first line of defence in safeguarding against scams.”

Ms Lie questioned how the large sums in foreign currency were transferred out of her accounts without any notifications sent to her.

“Why didn’t I get any e-mails or one-time passwords (OTPs) from the bank (to verify the transactions)? What if I hadn’t checked my bank account? I wouldn’t have known that my money was stolen,” she added.

There have been similar scams recently in which “sellers” send victims payment links that download malware into their phones, enabling scammers to control their devices remotely and drain their bank accounts.

Following OCBC Bank’s lead, UOB and DBS recently announced greater controls aimed at protecting customers against malware-enabled scams.

DBS will be pushing out a new anti-malware tool on its DBS/POSB digibank app progressively from September. The anti-malware tool will restrict DBS users’ access to their DBS/POSB digibank app if it detects the presence of malware, apps downloaded from unverified app stores with accessibility permissions enabled, or ongoing screen sharing on a customer’s device.

Once a known malware is detected, customers will receive a pop-up notification requesting that they secure their devices. They can do so by disconnecting their mobile devices from the Internet and deleting suspicious apps to regain access to their banking app.

Android phone users who had downloaded apps from other portals instead of an official store found that they were unable to access their OCBC online banking services. They would need to delete these apps to use OCBC app banking services again.

UOB will be progressively rolling out two new security features on its UOB TMRW banking app from Wednesday. The first update will restrict customers’ access to their UOB TMRW app once any apps or tools that are sharing their mobile devices’ screens are detected.

The second update will restrict access to the banking app upon detection of any apps that were downloaded from third-party or unauthorised sites with risky permissions on customers’ mobile devices.

Source: https://www.straitstimes.com/singapore/woman-loses-over-110000-after-downloading-third-party-app-to-buy-durian-tour-ticket

Archive: https://archive.ph/andVL

[Admin]

74-year-old man loses $70k after downloading third-party app to buy Peking duck
Sherlyn Sim | 30 Sept 2023

SINGAPORE – For six hours, a 74-year-old man chatted online with a friendly roast duck seller he met on Facebook, only to find his life savings almost wiped out soon after.

The elderly man, who wanted to be known only as Mr Loh, lost about $70,000 to scammers who siphoned money from his DBS and POSB credit card and bank accounts after infecting his Android phone with malware.

He had chanced upon a Facebook advertisement for a Peking duck from a supplier called “Xiao Xiao Ya Zi” on Aug 26.

He was enticed by the deal that offered $23.80 for a 1.5kg Peking duck with $5 shipping and contacted the seller on Facebook.

The seller texted Mr Loh on WhatsApp and instructed him through voice messages to download a third-party app called Grab&Go on his phone. The app prompted him to make a $5 payment through PayNow as a “deposit” before his order could be placed.

Mr Loh, who used to work as an importer, was initially suspicious of the ad but let his guard down when the seller convinced him that the promotion was not a scam.

“I asked him: ‘Is this a scam?’ He said that no one would be cheated of $5 and that this was a small thing. He told me that I had a lot of wisdom and experience. I agreed to proceed since this was a matter of only $5,” he told The Straits Times.

Within minutes, while he was still chatting with the seller, he noticed that his phone screen had gone blank.

When his phone restarted multiple times within 30 minutes, Mr Loh tried to close the third-party app and turn off his phone but failed.

Panicking, Mr Loh reached out to the scammer, who then reassured him that the phone reset was normal.

His wife, who overheard the conversation, realised something was amiss and called their daughter. She then got her brother to call DBS Bank immediately.

The bank officer told the family that the scammers had raised Mr Loh’s transaction limit, which was set at $3,000. They transferred about $59,000 out of his DBS current account and POSB savings account. The scammers also took a credit advance of about $11,000 using his DBS credit card.

He said he had set aside that money for his retirement and medical expenses.

“I couldn’t believe the news. I thought: Why am I so stupid? I was so angry at myself for being cheated of my life savings. My family is frustrated and I ended up quarrelling with my wife,” said Mr Loh, who has three children.

His daughter, who wants to be known only as Ms Ang, said that she had warned her parents about such scams.

“As his children, we are all heartbroken that he was scammed even after we educated our parents about such scams. We thought we had done enough to minimise the risk,” she added.

Mr Loh sought help from DBS and made a police report on Aug 27.

The police confirmed that a report had been made and investigations are ongoing.

Mr Loh also questioned why he did not receive any notifications when his transaction limits were increased.

“I know that some banks require a 12-hour cooling-off period when there is an increase (in funds transfer limits). But my credit limit was changed immediately without my permission and knowledge,” he said.

When contacted, DBS said it has dedicated resources to “act swiftly” to help customers who are scammed. They can call the anti-fraud hotline on 1800-339-6963.

DBS also has a safety switch function on its digibank app, which can temporarily block access to funds.

“As we intensify efforts to protect our customers, heightened vigilance and collective effort are crucial in combating scams and fraud,” said DBS, which also runs POSB.

Mr Loh has since changed his mobile phone and deleted his Facebook and Internet banking apps.

He said: “What I learnt was to not trust people online so easily. I’m not familiar with technology, so it would be best to ask my children to help me buy something online rather than do it myself.”

In the first half of 2023, at least $10 million in total was lost by more than 750 scam victims due to unauthorised banking transactions performed by malware, which also resets the victims’ phones.

Scammers, under the guise of “selling” everything from moon cakes to fish and durian day tour tickets on social media, have been instructing interested buyers to click on links to download third-party apps, which then allow the crooks to take control of the victims’ phones.

OCBC, UOB and DBS have recently announced greater controls aimed at protecting customers against malware-enabled scams.

For example, DBS is progressively pushing out a new anti-malware tool on its DBS/POSB digibank app, starting in September.

The anti-malware tool restricts users’ access to the DBS app if it detects the presence of malware, apps downloaded from unverified app stores with accessibility permissions enabled, or ongoing screen sharing on a customer’s device.

Once a known malware is detected, customers will receive a pop-up notification requesting that they secure their devices. They can do so by disconnecting their mobile devices from the Internet and deleting suspicious apps to regain access to their banking app.

Source: https://www.straitstimes.com/singapore/74-year-old-man-loses-70k-after-downloading-third-party-app-to-buy-roast-duck

Archive: https://archive.ph/21C41

[Admin]

Fake FairPrice and Sheng Siong apps leave victims $403k poorer
October 06, 2023 | By Ian Cheng

SINGAPORE - There is a variant of malware scams that involves fake Sheng Siong and FairPrice Group, the chain of supermarket and department stores, mobile applications, the police warned on Friday (Oct 6).

At least 11 victims have lost a total of $403,000 or more since September, the police added.

In such cases, victims would click on online advertisements - many of which are posted on Facebook - promoting food items such as rice, cookies and ducks.

The victim would then be directed to the WhatsApp messaging platform, where the "sellers" tell them to download an Android Package Kit (APK) - an app created for Android's operating system - over WhatsApp, so that the victims could place their orders. The victims may also be told to download the APK via third-party websites, instead of an official app store such as Google Play Store. The downloaded app would resemble the FairPrice Group or Sheng Siong apps.

Scammers can then access the victim's device remotely to steal banking credentials and passwords after the victim installs the APK file, as the installation includes granting the app accessibility services.

Victims would also be instructed to make a PayNow or bank transfer to pay for or make a deposit for their order, or to sign up as a member, or to pay for delivery. They would then discover unauthorised transactions from their bank accounts.

The police advised those who have already downloaded and installed such apps, or suspect that their phones are infected with malware to take the following steps:

o Switch the phone to "flight mode". Ensure that Wi-Fi is switched off.
o Run an anti-virus scan on the phone.
o Check bank accounts, Singpass and CPF accounts for any unauthorised transactions via another device.
o Report unauthorised transactions to the bank and relevant authorities, and lodge a police report.
o Consider resetting your phone to factory settings and changing important passwords.

The police also urged the public to adopt the following measures:

o Add the ScamShield and anti-virus applications to your device, and ensure its operating system and applications are updated regularly.
o Disable "Install Unknown App" or "Unknown Sources" in your phone's settings and do not grant permission to pop-ups that request for access to your device's hardware or data.
o Check for signs of scams with official sources such as the ScamShield Whatsapp bot, the Anti-Scam Helpline on 1800-722-6688 or visit www.scamalert.sg
o Download and install applications from only official app stores, such as the Google Play Store for Android users. Be wary if you are asked to download unknown apps to buy items or services on social media platforms.
o Report suspicious content or advertisements on social media sites. Block and report numbers linked to scams on Whatsapp.
o Report fraudulent transactions to banks immediately.

Those with information on scams may call the police hotline on 1800-255-0000, or visit www.police.gov.sg/iwitness

For more information on scams, the public can visit www.scamalert.sg or call the Anti-Scam Helpline.

Source: https://www.asiaone.com/singapore/fake-fairprice-and-sheng-siong-apps-leave-victims-403k-poorer

Archive: https://archive.ph/8hqeI

[Admin]

Gone in 15 minutes: Woman loses $72.5k after downloading third-party app to sell used kitchen items
The scammer posed as a buyer on Facebook and instructed the victim to download a third-party app on her mobile phone.
Sherlyn Sim | 10 Oct 2023

SINGAPORE – A 68-year-old woman lost more than $72,500 from her POSB bank account in 15 minutes after she downloaded a third-party app in a bid to sell her pre-loved kitchen appliances online.

What she downloaded turned out to be malware that enabled scammers to control her Android phone and drain money from her POSB savings account.

The victim, who wanted to be known only as Madam Abdul, a customer service officer, saw a Facebook advertisement on Sept 23 by a purported recycling company called E-Recycle that wanted to buy pre-loved furniture and electronics.

She was enticed by the deal, which offered between $30 and $100 for each pre-loved item, with free pick-up.

Hoping to sell several pre-loved kitchen appliances, including a steamboat set and grill, she contacted the so-called buyer through Facebook Messenger.

Unacquainted with e-commerce platform Carousell and reluctant to sell the electronics to the karung guni (rag-and-bone collectors) at a low price, she felt the Facebook advertiser offered convenience and more attractive rates.

The next day, she spoke to the buyer on the phone and asked if he would also like to buy a leather suitcase of hers.

While on the phone, he said he transferred her $50 through PayNow, and would pay the remaining amount upon collection and valuation of her items.

He asked her to open her POSB digibank app to check if she received the payment. She followed his request but did not see the money.

Madam Abdul thought the payment transfer would require some time, so she did not think too much of it.

With the digibank app still running in the background, he then instructed her to download a third-party app called I-Recovery to list the items for a staff member to collect.

While on the phone with him, she received another call and wanted to hang up on him to answer it.
Madam Abdul saw a Facebook advertisement by a purported recycling company called E-Recycle that wanted to buy pre-loved furniture and electronics.

Her mobile phone screen began flickering, so she tried to decline the call, but all the buttons on her touchscreen were unresponsive. She tried to uninstall the app, but was unable to do so.

Alarmed, she told the buyer about it. He assured her that her phone was faulty. She became suspicious as her phone was not faulty before their call.

“I asked him: ‘Are you a scammer?’ He said he was not a scammer and not to offend him by comparing him to scammers that had posed as mooncake sellers,” she said.

Realising something was amiss, she told her roommate about the incident. Her roommate advised her to immediately turn her phone off and to call POSB.

The bank officer told Madam Abdul that the scammers raised her transaction limit, which was originally set at $3,000. They transferred about $68,500 out of her POSB savings account and another $4,000 shortly after.

Madam Abdul, who works at a training school, said she had set aside that money for her retirement, insurance and medical expenses.

“When I heard that almost 90 per cent of my savings was lost, I wanted to cry but no tears came out. That was my money saved over four decades. I knew about scam cases but still got tricked. I felt frustrated and foolish,” said Madam Abdul, who has one son.

Her son, who wanted to be known only as Mr Hakim, said that while he was heartbroken to hear that his mother was scammed, he understands that anyone could have fallen for the scam.

“We had read news about such scams, but didn’t realise that the threat was so close to us. She thought scammers would pose as sellers, not buyers. This is probably a new tactic and she wasn’t aware of it,” the 43-year-old educator added.

The mother and son said they hope to put aside their worries to focus on recovering the money. Madam Abdul sought help from POSB to have her account frozen and a new ATM card issued. She made a police report on Sept 24.

The police confirmed that a report had been made and investigations are ongoing.

POSB did not respond to a request for comment.

Madam Abdul has since changed her mobile phone and had her ATM card replaced as a precaution.

She said: “I have learnt to be more careful online. I was too eager to sell the items quickly.”

In the first half of 2023, at least $10 million was lost by more than 750 scam victims due to unauthorised banking transactions performed by malware, which also reset the victims’ phones.

There has been a series of scams recently in which “sellers” instruct interested buyers to click on links to download third-party apps that download malware into their phones, enabling scammers to control their devices remotely and drain their bank accounts.

Amid mounting mobile security threats, Singapore’s cyber-security watchdog Cyber Security Agency of Singapore has released a list of recommended antivirus apps, with features like malware and phishing detection.

OCBC Bank, UOB and DBS Bank have also recently announced tighter controls aimed at protecting customers against malware-enabled scams.

For example, DBS is progressively pushing out a new anti-malware tool on its DBS/POSB digibank app, starting in September. The anti-malware tool restricts users’ access to the DBS app if it detects the presence of malware, apps downloaded from unverified app stores with accessibility permissions enabled, or ongoing screen sharing on a customer’s device.

Source: https://www.straitstimes.com/singapore/woman-loses-725k-after-downloading-third-party-app-to-sell-pre-loved-kitchen-appliances

Archive: https://archive.ph/zkqCw

[Admin]

Ransomware Infection Times Fall From 5 Days to 5 Hours
Attackers now need less than a day to infect your system with ransomware.
Matthew Humphries | October 10, 2023

The amount of time it takes an attacker to infect a system with ransomware has fallen dramatically over the past 12 months.

As The Register reports, the median dwell time (the time from when an attack starts to when ransomware is deployed) was 5.5 days in 2021, then 4.5 days in 2022. However, this year the dwell time has fallen to less than 24 hours. According to the Secureworks annual State of the Threat Report, "in 10% of cases, ransomware was even deployed within five hours of initial access."

You may be surprised to hear that the reason for this huge reduction in infection time is due in no small part to the cybersecurity industry becoming much better at detecting the activity that precedes a ransomware infection. As a result, Secureworks explains, "threat actors are focusing on simpler and quicker to implement operations, rather than big, multi-site enterprise-wide encryption events that are significantly more complex."

Add to that the emergence of "several new and very active threat groups," which has led to significantly more ransomware victims and data leaks this year. So not only are the attacks happening more quickly, there's also more of them.

The ransomware groups are using three main attack vectors to try and infect systems. The first is scan-and-exploit, which looks for known vulnerabilities in a system that can be taken advantage of. Stolen credentials are also taken advantage of when discovered, and phishing emails are used to try and trick individuals into offering the attackers an easy way into secure systems.

Sony is the most recent high-profile target of a ransomware group, but the company has yet to confirm the extent of the infection or data stolen. We've also seen a Danish cloud hosting firm lose the majority of its customer data in a ransomware attack, and the LockBit ransomware gang stole the data of 8.9 million dental insurance customers earlier this year. On the bright side, the FBI has managed to dismantle the notorious Qakbot botnet used in many ransomware attacks and was found to be controlling 700,000 infected computers.

Source: https://www.pcmag.com/news/ransomware-infection-times-fall-from-5-days-to-5-hours

Archive: https://archive.ph/tgLKf

Reference (Ransomware decryption toolkits): https://www.nomoreransom.org/en/decryption-tools.html

[Admin]

Google beefs up Android security to better detect malicious apps amid spike in malware scams
Ashley Tham | 19 Oct 2023

SINGAPORE: Google is strengthening its Play Protect malware protection system to better detect whether an Android app may be infected with malware by "adding real-time scanning at a code level".

"This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection," said Google on Thursday (Oct 19).

Polymorphic malware can change its identifiable features, avoiding detection from Play Protect's current security scans. According to Google, Play Protect, which was launched in 2017, currently scans 125 billion apps daily.

The update comes amid a spike in Android malware scams in Singapore - more than 750 such cases were reported in the first half of 2023, with total losses amounting to at least S$10 million (US$7.2 million).

Previously, Play Protect conducted real-time checks and warned users when an app was known to be malicious from existing scanning intelligence or was identified as suspicious from on-device machine learning, said Google.

"Google Play Protect will now recommend a real-time app scan when installing apps that have never been scanned before to help detect emerging threats," added the tech giant.

Real-time scanning will "extract important signals from the app and send them to the Play Protect backend infrastructure for a code-level evaluation".

Once the real-time analysis is complete, users will be notified if the app is safe to install.

It added that the security protections and machine learning algorithms learn from each app submitted to Google for review, and the company also looks at thousands of signals and compares app behaviour.

The enhanced scanning feature has already started rolling out in select countries, starting with India, and "will expand to all regions in the coming months". 


Source: https://www.channelnewsasia.com/singapore/google-security-android-malware-scam-app-scanning-3857226

Archive: https://archive.ph/wip/JNHgC

[Admin]

Deepfaked Voice Enabled $35 Million Bank Heist in 2020
October 15, 2021 | By Martin Anderson

An investigation into the defrauding of $35 million USD from a bank in the United Arab Emirates in January of 2020 has found that deepfake voice technology was used to imitate a company director known to a bank branch manager, who then authorized the transactions.

The crime took place on January 15th of last year, and is outlined in a request (PDF) by UAE to American state authorities for aid in tracking down a portion of the siphoned funds that were sent to the United States.

The request states that the branch manager of an unnamed victim bank in UAE received a phone call from a familiar voice, which, together with accompanying emails from a lawyer named Martin Zelner, convinced the manager to disburse the funds, which were apparently intended for the acquisition of a company.

The request states:

‘According to Emirati authorities, on January 15, 2020, the Victim Company’s branch manager received a phone call that claimed to be from the company headquarters. The caller sounded like the Director of the company, so the branch manager believed the call was legitimate.

‘The branch manager also received several emails that he believed were from the Director that were related to the phone call. The caller told the branch manager by phone and email that the Victim Company was about to acquire another company, and that a lawyer named Martin Zelner (Zelner) had been authorized to coordinate procedures for the acquisition.'

The branch manager then received the emails from Zelner, together with a letter of authorization from the (supposed) Director, whose voice was familiar to the victim.

Deepfake Voice Fraud Identified

Emirati investigators then established that deepfake voice cloning technology had been used to imitate the company director's voice:

‘The Emirati investigation revealed that the defendants had used “deep voice” technology to simulate the voice of the Director. In January 2020, funds were transferred from the Victim Company to several bank accounts in other countries in a complex scheme involving at least 17 known and unknown defendants. Emirati authorities traced the movement of the money through numerous accounts and identified two transactions to the United States.

‘On January 22, 2020, two transfers of USD 199,987.75 and USD 215,985.75 were sent from two of the defendants to Centennial Bank account numbers, xxxxx7682 and xxxxx7885, respectively, located in the United States.'

No further details are available regarding the crime, which is only the second known incidence of voice-based deepfake financial fraud. The first took place nine months earlier, in March of 2020, when an executive at a UK energy company was harangued on the phone by what sounded like the employee's boss, demanding the urgent transfer of €220,000 ($243,000), which the employee then transacted.

Voice Cloning Development

Deepfake voice cloning involves the training of a machine learning model on hundreds, or thousands of samples of the ‘target' voice (the voice which will be imitated). The most accurate match can be obtained by training the target voice directly against the voice of the person who will be talking in the proposed scenario, though the model will be ‘overfitted' to the person who be impersonating the target.

The most active legitimate online community for voice cloning developers is the Audio Fakes Discord server, which features forums for many deepfake voice cloning algorithms such as Google's Tacotron-2, Talknet, ForwardTacotron, Coqui-ai-TTS and Glow-TTS, among others.

Real-Time Deepfakes

Since a phone conversation is necessarily interactive, voice cloning fraud cannot reasonably be effected by ‘baked' high-quality voice clips, and in both cases of voice cloning fraud, we can reasonably assume that the speaker is using a live, real-time deepfake framework.

Real-time deepfakes have come into focus lately due to the advent of DeepFaceLive, a real-time implementation of popular deepfake package DeepFaceLab, which can superimpose celebrity or other identities onto live webcam footage. Though users at the Audio Fakes Discord and the DeepFaceLab Discord are intensely interested in combining the two technologies into a single video+voice live deepfake architecture, no such product has publicly emerged as yet.

Source: https://www.unite.ai/deepfaked-voice-enabled-35-million-bank-heist-in-2020

Archive: https://archive.ph/AM0Sg

[Admin]

Transcript from the Youtube video titled "Innocent Social Posts Turned Into Deepfake Porn"

"40 students who graduated from this high school say they were targeted by a
former classmate who put their faces on pornographic images it's called Deep
fake porn and this young woman was one of the victims she says when she learned
who authorities say was behind it she was shocked Lisa Guerrero has more why
is this young woman in tears I think you guys need to know what pain looks like
because this is it her name is QT Cinderella she's a YouTube star and she
says somebody stole her face that is they put her face on someone else's body
to create fake porn videos online this is what it looks like to see yourself
naked against your well-being spread all over the Internet it's called Deep fake
pornography for years Hollywood celebs Like Scarlett Johansson and Kristen Bell
have spoken out after finding fakes of themselves online this is my face
belongs to me today deep fakes are easy to create check it out we uploaded a
picture of me and within a matter of moments look, I'm Wonder Woman
it can be almost impossible to tell what's real and what's not everyone is
at risk ability to create and manipulate content is startling if you have video
on Tick Tock if you have your image of yourself on Instagram or on Facebook or
you created a video on YouTube or somebody else took your photo and put it
online you now are at risk that's right celebrities aren't the only ones in
danger I just received an email from an unknown email address that said
effectively FYI there's a deep fake porn video of you Australian activist Noelle
Martin says because of deep fake videos she's been forced to tell friends and
family even employers it is a life sentence potentially for people who have
to experience this so this is absolutely a form of sexual abuse she now speaks
out about her experience around the world I just don't want anyone to
experience what I've had to go through this Long Island woman says it also
happened been to her it was hard to look at but I had to look at it she says her
life was turned upside down after innocent selfies she posted on social
media were deep faked into sexual scenes to humiliate us I think that's really
what he wanted why her how did she become a victim of deep fake porn more
than a dozen young women who attended this New York High School say they were
targeted in a Twisted plot created by none other than their very own classmate
that's right the Deep baker has been identified as 22 year old Patrick Carey
and he also went to MacArthur High School in Levittown New York with 40
former classmates who the D.A says became his victims I would never have guessed it
was him at all her father is outraged they're walking out with a picture of my daughter
in their wallet mentally she's going to carry this the rest of her life
remarkably in New York state district attorney Ann Donnelly says there are no
laws against deep bakes to prosecute him for these deep fakes we need to change
the law because it doesn't exist our laws have not kept up with the
technology she says they were able to charge Kerry with posting a real photo
of a naked underage girl she's now proposing new legislation to hold deep
Bakers accountable you sit behind your computer you remain anonymous and you
torture other people that's a cowardly act this parent is
furious that Carrie was only sentenced to six months behind bars he didn't get
what he deserves you know that we tried to speak to Kerry on his way into court
why did you create images of young women in pornographic films and video
as part of a sentence Kerry will now have to register as a sex offender."

[Admin]

With AI now driving cyber attacks, best to fight fire with fire
Brett Chase | 31 October 2023

In September 2022, Singtel’s Australian subsidiary Optus, one of Australia’s largest telecommunications providers, suffered one of the country’s largest data breaches and cyber attacks affecting 9.8 million Australians.

The attack also resulted in a 2 per cent drop in share price and a A$1.2 billion (S$1.04 billion) brand hit, with 10 per cent of all customers leaving within six weeks.

In Asean, research by IBM Security and the Ponemon Institute has found the average cost of a data breach now tops US$3.05 million (S$4.17 million). Another research report by Cybersecurity Ventures shows the average cost of a ransomware attack globally is 10 to 15 times the ransom demand.

The costs of cyber attacks are massive for countries, businesses and individuals. With artificial intelligence (AI) actively being utilised by cyber criminals, cyber attacks and data breaches are set to not only become more sophisticated but costly too.

In its latest Singapore Cyber Landscape report, the Cyber Security Agency of Singapore (CSA) highlighted the potential for deepfakes to result in identity and data theft, business fraud and impacts on a company’s share price or reputation.

In the same report, the CSA also emphasised that phishing attacks and ransomware continue to be attack vectors of choice for cyber criminals, who are looking to increase the sophistication of their deceptive tactics and techniques.

The CSA’s report also revealed that the Singapore Police Force handled more than 7,000 reported cases, and 132 ransomware incidents were directly reported to the CSA.

Ease of access and use spurring AI’s role in cyber attacks

The growing accessibility and usability of AI and machine learning (ML), through large language models (LLMs) such as ChatGPT, have made it significantly easier for cyber criminals looking to create large scale or more sophisticated cyber attacks, by reducing the amount of technical nous or resources previously required.

AI and ML also provide attackers with the ability to probe technology and IT infrastructure continuously until a vulnerability is found and, unlike a human, do not require time away from a computer or to be paid for delivering outcomes.

Two examples of LLM-based attacks include WormGPT and FraudGPT, which have been advertised on Dark Web forums for as little as $800. They can be used to produce malicious code at speed and for sophisticated phishing attacks such as business e-mail compromise, where leaders responsible for financial decisions or sensitive data are often impersonated.

In fact, the authorities around the world have warned of the potential of LLM- and generative AI-based cyber attacks, including the likes of the CSA, the United States Federal Bureau of Investigation, Europol and Britain’s National Cyber Security Centre.

Importance of cyber resilience in an AI-driven world

Private and public organisations now operate in a world where cyber attacks are a “when” and not “if” reality, which means that being able to protect and secure data, detect cyber threats and attacks and respond with automated data recovery processes is vital.

These capabilities are core to establishing and maintaining cyber resilience, which, put simply, is the ability to maintain business continuity despite suffering an adverse cyber event such as a cyber attack or systems failure.

Recently, Cohesity conducted a data security and management survey, which found that 80 per cent of global respondents made up of information technology and SecOps (security and operations) decision-makers expressed concerns about their company’s cyber-resilience strategy and whether it can “address today’s cyber challenges and threats”.

This was of little surprise given respondents’ views on how quickly their organisation could recover data and business processes after a cyber attack, with 95 per cent saying their organisation would need more than 24 hours. Within that number, 71 per cent said they would need more than four days, while 41 per cent of all respondents said it would take more than a week.

How companies can establish and maintain cyber resilience with AI and ML

To remain cyber resilient, companies need to employ a strong mix of people, processes and technology.

At the people level, this starts with regular employee education and training in every function, especially given the increasing sophistication being driven by AI-based phishing attacks.

At the technology and process level, companies can benefit from utilising the latest data security, management and recovery technology that is increasingly being enhanced by the integration of AI and ML.

Crucial AI-powered and modern data security capabilities that organisations can leverage to give them an edge against cyber threats include:

• Immutable backup snapshots: Cyber criminals’ increasing sophistication has seen backups become a prime target for attackers. Unlike traditional systems where backups can be updated or deleted, these unmodifiable backup snapshots offer a secure data copy for recovery, forensics, compliance and data integrity.
• AI-enabled multi-factor authentication (MFA): MFA provides an additional layer of security that helps to ensure only authorised users gain access to sensitive information. Integrating AI into MFA extends the capability to include authentication that adapts based on data risk levels, and fraud detection mechanisms that automatically block users if their access behaviour deviates from normal patterns.
• AI retirement of inactive data: AI can help organisations determine what data has become dormant and can be archived. This helps reduce recovery time by eliminating the unnecessary recovery of unused data, as well as creating efficiency and cost reduction in data storage.

Many modern data security and recovery technologies have offered AI and ML powered capabilities for several years that automate voluminous and time-consuming tasks. For example, there is anomaly detection, where unplanned and abnormal changes in the size or format of data trigger an alert given they are often an early indication of malicious activity.

In fact, AI and ML can now be leveraged to derive intelligence throughout data estates, automate risk management and security controls and process vast volumes of data for classification or identification in real time.

As threat actors look to gain any advantage they can to hit pay dirt through ransom payments, it is vital for companies to turbocharge their data security prowess and cyber resilience with AI, ML and modern data security capabilities that help them fight fire with fire.

Brett Chase is director of systems engineering at Cohesity APJ, a data management firm.

Source: https://www.straitstimes.com/opinion/with-ai-now-driving-cyber-attacks-best-to-fight-fire-with-fire

Archive: https://archive.ph/IAeoc

Reference 1 on WormGPT: "WormGPT – The Generative AI Tool Cybercriminals Are Using to Launch Business Email Compromise Attacks", https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks

Reference 2 on WormGPT: "Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’", https://krebsonsecurity.com/2023/08/meet-the-brains-behind-the-malware-friendly-ai-chat-service-wormgpt

Reference 3 on FraudGPT: "What Is FraudGPT?", https://hackernoon.com/what-is-fraudgpt

Reference 4 on FraudGPT: "FraudGPT: The Latest Development in Malicious Generative AI", https://abnormalsecurity.com/blog/fraudgpt-malicious-generative-ai

[Admin]

Mother of 2 loses $320k life savings in scam: 'Everything fell apart'
Khoo Yi-Hang | November 15, 2023

She didn't just lose her money in this encounter - she lost her faith in humanity as well.

Adeline (not her real name) shared with AsiaOne on Nov 10 that she had fallen for an investment scam in October, one which caused her to lose more than $320,000 in just a month.

She was first approached by an individual through Instagram, who presented himself as a high-flying businessman.

The scammer chatted with Adeline about their hobbies and work life, before asking her to switch to WhatsApp to continue their conversation.

After two weeks of interaction, the two became 'friends' and the 'businessman' allegedly offered Adeline an opportunity - to invest in trading gold commodities through a "seed" investment platform, purportedly based under a larger, reputable investment company.

Seed investment refers to financing startups in order to aid their development.

He then showed her detailed information to convince her, and although Adeline wasn't keen on taking the plunge, she eventually acquiesced.

Her first foray into this 'investment' platform was funded by this scammer who gave her US$2,000 (S$2,721) to experiment with.

After turning a quick profit through the platform, the scammer then invited Adeline to invest a larger sum of US$10,000.

However, the amount was too daunting for Adeline, who admitted to AsiaOne that she had no interest in the subject and didn't know much about investments.

In response to her rejection, the scammer told her that he would pay the majority of the 'investment', convincing Adeline to put in US$2,500.

"So in that incident where we put in US$10,000, the investment grew to $190,000," she recalled. "So that's when the problem started."
'I'm very stupid'

Adeline said she tried to withdraw the money she had invested from the platform but was met with multiple barriers.

First, she was told to pay a tax of US$48,000, and that the amount was only a deposit and would be refunded.

What the scammers didn't tell her before she took out a loan and went ahead with the decision was that the refund would go into her platform's account wallet instead of her bank.

She then tried using cryptocurrency to retrieve her money, but that failed too. The scammer allegedly told her she needed to have a verified account with "enough flow in the crypto world" to do so.

The scammers then offered her a way to verify her account, albeit at a price: US$70,000, which would also be refundable.

"Of course I put in the money because I'm very stupid," Adeline said with a pained sigh, explaining that this was another loan from the bank.

"They refunded the money but I never got it back, because it went into the platform."
A downward spiral

Once her account was verified, the scammers then told her that she could pull her money out from their Singapore office.

But because such a large sum of money being transferred would no doubt raise eyebrows, they told her to make multiple smaller transactions for the administrative cost of US$20,000 - this led to another bank loan for Adeline.

That wasn't the end, as she was charged a further custody fee because of the large amount of money that was transferred, costing her US$50,000.

Next, because the money was held for so long, she had to pay another US$50,000 for the delays on Nov 2, racking up a total loan of more than $320,000.

When she was then told to pay another US$140,000, she gave up entirely.
'Everything fell apart'

"By then I saw that something wasn't right… they kept saying that they would give me back my money, but they didn't," Adeline said. "So I finally came clean with my husband."

Last Monday (Nov 6), she finally reached out to others for help.

She told her husband that she was "muddleheaded" and was too focused on trying to get the money back that she wasn't thinking straight, further confessing that she should have told him about this earlier.

"But it was just like… everything fell apart," she said defeatedly.

They said they then contacted the banks for help and filed a police report that same day but have not heard back from either entities since.

Adeline is still in contact with the 'friend', who she said is still asking her for payment.

She also shared that she had remained unwilling to invest throughout the entire month as the scam was taking place, but her 'friend' somehow had a way with words and always convinced her.

She explained: "I was like, 'I don't really want to do this', but later on - I don't know how - I somehow got coerced into it."
This dark cloud's silver lining

This experience has scarred her in more ways than one, Adeline told AsiaOne.

"This has really burned my trust in human beings in general… Everything is fake," she said.

However, there's also some good amid the bad, as she feels that this will give her and her family prudence.

"And maybe this won't be so bad for the kids, in that they won't grow up feeling so entitled, because we can't afford to give them as much as we used to be able to," she said.

"We have to cut the luxuries, but I hope they learn to be humble or grow up being a bit more humble because of that. If you don't have so much growing up, then you'll tend to cherish what you have a little more, right?"

She also expressed that her husband's support of her through this period - despite his anger - was something she appreciated as it also solidified their marriage.

"In Chinese we have this saying: amid disaster, true bonds are revealed," Adeline said, thanking her friends and family that have stuck by her and comforted her through these tough times.

Although things are "really bad" for her right now, they could have been worse, she said.

She added: "But it isn't going to be easy."

Source: https://www.asiaone.com/singapore/mother-2-loses-320k-life-savings-scam-everything-fell-apart

Archive: https://archive.fo/UosJS