Two mobile phone shop employees arrested over scheme to compromise Singpass accounts

SINGAPORE: Two Malaysian men aged 25 and 47 were arrested on Tuesday (Aug 25) for their suspected involvement in a coordinated scheme that compromised the Singpass accounts of Singapore citizens and work permit holders.The police said in a news release issued on Wednesday that since early March, at least 20 Singapore citizens and work permit holders have been investigated for their alleged involvement in registering LiquidPay accounts that reportedly received S$110,063 linked to various scams.Preliminary investigations suggest that a number of these individuals may not have been aware of the account creation or its intended use, it added.Police said that officers from the Cyber Command, with support from the Singpass Trust and Safety team at the Government Technology Agency of Singapore (GovTech), launched an operation to identify the syndicate members and take enforcement action against them. The operation, which took place between Aug 21 and Aug 25, led to the arrest of the two men, who are suspected of obtaining the Singpass login credentials of Singapore citizens and work permit holders.Investigations revealed that both suspects were employees of a mobile phone shop in Singapore. "They allegedly exploited opportunities arising from their work to access customers' Singpass accounts," police said. In one instance, when a customer was purchasing a new SIM card, one of the men allegedly offered to help update the mobile number linked to the customer's Singpass account. He then used the opportunity to create a LiquidPay account without the customer's knowledge, police said. LiquidPay is a mobile payment and e-wallet app operated by the Singapore-based fintech company Liquid Group.Further investigations identified another 171 Singapore citizens and foreign workers whose Singpass accounts were linked to the same activity. These fraudulently obtained Singpass accounts were used to register over 160 additional LiquidPay accounts without the account holders’ knowledge. All affected LiquidPay accounts have been frozen, according to the authorities. Police arrested a suspect on Aug 25, 2026. (Photo: Singapore Police Force) The suspects will be charged in court on Thursday with assisting another to retain benefits from criminal conduct.If found guilty, they could face a jail term of up to ten years, a fine not exceeding S$500,000 (US$393,000), or both.Investigations into Singapore citizens and work permit holders who voluntarily relinquished their Singpass credentials are ongoing. Under the Computer Misuse Act, those convicted of disclosing Singpass credentials to facilitate an offence can be fined up to S$10,000, be jailed up to three years, or both punishments.Police urged members of the public not to accept offers of quick monetary gains in exchange for their Singpass accounts or credentials. Singpass passwords or two-factor authentication (2FA) details should never be revealed to unknown people, as these may be misused to access various digital services, including the opening of bank accounts, e-wallets, crypto accounts, and mobile phone lines for illegal activities.