How do scammers exploit government directories, and how can they be stopped?

Scammers' Tactics Exposed

Scammers typically masquerade as officers from the Singapore Police Force, the Immigration and Checkpoints Authority, and the Ministry of Law, alerting victims to supposed unauthorised bank or telco applications, unpaid taxes, or potential criminal liabilities. They would then pressure victims to disclose personal details and passwords or transfer money to a bank account to assist with official investigations.

Exploiting Government Directories

Having a real officer's name, designation, agency, and contact number adds credibility to government impersonation calls. Victims who verify the details online against an online directory would likely let down their guard. 'In reality, they have only verified that the officer exists, but they didn't pause to think that the person on the phone may not be that officer,' said Andy Prakash, the founder and chief executive of IT security company Privacy Ninja.

Risks of Corporate Espionage

The risk of corporate espionage is why most private-sector organisations do not publish staff directory information online. Similarly, an agency's directory can reveal its organisational structure, including the names and contact details of officers in the same department. This allows a scammer to pose as a senior officer using a lookalike e-mail address and instruct subordinates to send confidential documents or trick them into opening malicious files or clicking on malicious links.

Is the Public Safer Now?

While scams will not dry up completely, scammers will have less data to exploit. Over time, as more rank-and-file public officers leave their organisations, what has already been harvested by scammers will also become outdated, said Anthony Lim, a senior research fellow at the Centre for Strategic Cyberspace and International Studies think-tank.