At least S$12 million lost in fake friend call scams since January; new variant involving Android malware

SINGAPORE: At least S$12 million (US$8.9 million) has been lost in fake friend call scams since January 2023, the police said on Wednesday (Jul 5), warning of a new variant involving malicious Android links.

At least 3,700 victims have fallen prey to such scams since the beginning of the year.

They would receive text messages or phone calls from unknown numbers - with or without the +65 prefix. Scammers would claim to be a friend or an acquaintance and ask the victims to guess their real identity. 

Once a name is provided, the scammer would assume the identity of the victim's friend and ask them to update their contact details.

"The scammers would contact the victims subsequently to ask for a loan and would claim that he or she is unable to perform a banking transaction or is experiencing financial difficulties," said the police. 

Victims would then be provided with a local bank account to transfer the money.

While there has been a "persistent trend" of such scams, the police said they have seen a new variant where scammers would send victims malicious links, asking them to help with simple tasks such as making purchases, reserving seats at a restaurant or tracking a missing phone. 

"These malicious links will lead victims to either phishing sites and/or the download of an Android Package Kit (APK) file, an application created for Android's operating system," said the police, adding that victims would discover unauthorised transactions after keying in their banking credentials or card details. 

"Once victims download and install the app containing malware, the malware will allow scammers to access the victims’ devices remotely and steal passwords stored in the devices," added the police. 

Scammers could also use malware with keylogging capabilities to capture credentials keyed into fake bank application login sites through the Android app. 

"The police would like to remind members of the public of the dangers of downloading applications from third-party or dubious sites that can lead to malware being installed on victims’ mobile phones, computers, and other Information Communications Technology devices," said the Singapore Police Force. 

"Scammers will trick victims into installing malware-infected applications that are outside the app store. Members of the public are advised not to download any suspicious APK files on their devices as they may contain phishing malware."

For more information, the public can visit www.scamalert.sg or call the Anti-Scam Hotline at 1800-722-6688.

Those with information relating to scams can call the police hotline at 1800-255-0000 or submit online. 

The public can also visit CSA's singCERT advisory to find out more about malware and the steps they can take to protect their mobile devices.