On an island-wide raid held between June 26th and 30th, Singaporean authorities arrested 13 individuals, with ages ranging from 16 to 35, linked to a series of Android malware scams.
The Commercial Affairs Department (CAD) and Police Intelligence Department (PID) led the crackdown as part of a heightened enforcement operation.
“Since January 2023, the Police have received increasing reports informing that malware was used to compromise Android mobile devices, resulting in unauthorized transactions made from the victims’ bank accounts even though they did not divulge their Internet banking credentials, One-Time-Passwords (OTPs) or Singpass credentials to anyone,” say the Singapore police.
Individuals were lured by ads on social media platforms like Facebook, offering services ranging from cleaning to pet grooming and various food items.
The scammers then directed victims to download Android Package Kit (APK) from unofficial app stores. This resulted in the installation of malicious software on the victims’ devices.
After the installation, the victims were then convinced, usually via phone calls or text messages, to enable accessibility services on their phones. This action gives the scammers control over a victim’s devices and the power to log every keystroke.
With these privileges, the scammers could remotely log into victims’ banking apps, add accomplices as payees, adjust payment limits, and divert funds to these accomplices or “money mules”.
The scammers further covered their tracks by deleting SMS and email notifications of illicit bank transfers.
Seven men, two women, and a 16-year-old had allegedly facilitated the scam cases by willingly offering their banking info and credentials for monetary gain.
The remaining three male suspects, aged 20 and 35, are suspected of withdrawing money from the accounts of money mules and passing the funds to unidentified third parties.
Those found guilty of such crimes could face severe penalties under Singapore law, including up to 10 years imprisonment, a massive fine of up to $500,000, or both.
In the wake of these incidents, the Singapore Police Force has cautioned the public against downloading apps from unverified sources and to be highly skeptical of giving out banking credentials.