OCBC phishing scam: Police say they rushed to take down fake bank websites, trace lost cash

SINGAPORE: Deputy Assistant Commissioner of Police (DAC) Aileen Yap remembers how in early December last year, reports on the OCBC SMS phishing scam started trickling in.

In that period, there were about one or two cases a day, said DAC Yap, assistant director of the Anti-Scam Division. Then in the days leading up to Christmas and beyond, the reports suddenly spiked.

“When all these reports came in, obviously there'll be corresponding bank accounts (of victims),” Assistant Superintendent of Police (ASP) Lim Min Siang, a senior investigation officer in the division, told reporters during a briefing at the Anti-Scam Centre on Thursday (Jan 27).

“That's where the sense-making deep dive has to be done. Considering that the reports just kept coming in, it’s basically a race against time.”
 

The police said on Dec 30 that at least S$8.5 million was lost in phishing scams involving SMSes impersonating OCBC that month, with at least 469 victims since Dec 1.

Between Dec 8 and Dec 17, 26 customers reported they had lost about S$140,000 to phishing scams, OCBC said. The attacks grew “aggressive” during the Christmas weekend, the bank said, with 186 customers losing about US$2.7 million from Dec 24 to Dec 26.

Victims received unsolicited SMSes purportedly from OCBC claiming that their accounts had issues, and that these issues needed to be resolved by clicking on a link.

They were redirected to fake bank websites that requested they key in their iBanking account log-in details. They then received actual notifications on unauthorised transactions in their accounts – which is when they found out they had been scammed.

ASP Lim said on Thursday that the priority for officers was to take down the phishing websites. The ongoing investigation into the OCBC scam is being handled by officers from the Criminal Investigation Department (CID).

“Basically for the scammer, it’s very easy, they cast the net (wide),” he said. “So the idea (for us) is to take down the link as fast as possible, and prevent such links from being activated again.”

The other urgent task was to trace the lost cash, he said, pointing out that the money will be routed through several accounts to evade detection.

“Once the funds go to X account, it will definitely go to Y and Z, so there's also this race to trace it down and try to recover as much as possible,” he added. “Because once the money goes out (of Singapore), it's usually very challenging to get it back.”

The police have successfully recovered cash that was transferred overseas, but this is not a guarantee, especially as some jurisdictions could require victims to go through complicated and expensive legal processes.

Even if the money stays in Singapore, DAC Yap said tracing it is “not a very easy job”. She highlighted that scammers would break down the funds into smaller tranches, and distribute these across multiple bank accounts.

This is why a key strategy for the police is to freeze the bank accounts of suspected money mules as quickly as possible.

On Dec 26 last year, which was a Sunday, the police worked with the banks to trace the money lost in the OCBC scam, DAC Yap said, although she acknowledged that bank employees were not legally obliged to come into the office that day.

“You know, it’s Boxing Day after Christmas, so there are post-Christmas sales,” she said. “At the end of the day, everything (the banks did) was out of goodwill.”

ASP Lim said the banks could also have their own challenges, and these could affect police investigations.

“Because if we want to have some information and they're unable to give, or they take time to give, then that will also prolong the analysis and the investigation,” he said. 

While DAC Yap said the local banks were committed in providing information and gave “a lot of support”, some of the money had gone elsewhere.

“So, that is when the lead sort of died. The information on where the money went to subsequently came in much later. By then, all the money would either be withdrawn already or went to other countries,” she said.

“Our role at that point of time is really on fund recovery, up till now also. But the entire investigation is still ongoing. (We are) not giving up yet, because we can see our CID colleagues working very hard on this.”

ASP Lim said officers definitely felt “overwhelmed” when the OCBC scam reports came flooding in, but stressed that they remained “professional”.

“When all these cases are happening, we are all here,” he said, referring to the Anti-Scam Centre, a low-ceilinged room with workstations and multiple TV screens that is the police’s nerve centre for investigating scam-related crimes.

“We are away from our family, friends and what not. But we have a job to do, so we just do it to the best of our abilities and try to at least prevent more victims from suffering from scams, or the victims from suffering even more losses.”