ST Explains: How do scammers exploit government directories, and how can they be stopped?

AI generated

SINGAPORE – An online directory containing the names, phone numbers, e-mail addresses and job titles of Singapore public officers has been pared down in ongoing attempts to counter government impersonation scams.

The move comes after government official impersonation scams more than doubled to 3,363 cases in 2025 from 1,504 cases the year before.

While the governments of Canada, Hong Kong and Australia also publish similar directories in their communications with the public, most private-sector organisations do not reveal such information online.

How do scammers exploit government directories, and what else can be done to stop such scams? The Straits Times explains.

How government impersonation scams work

Scammers typically masquerade as officers from the Singapore Police Force, the Immigration and Checkpoints Authority and the Ministry of Law, alerting victims to supposed unauthorised bank or telco applications, unpaid taxes or potential criminal liabilities. The scammers would then pressure victims to disclose personal details and passwords, or transfer money to a bank account to assist with official investigations.

In 2025, victims lost $242.9 million to fake government official scams, up from $151.3 million in 2024. This is the second-highest amount lost among all scam types in 2025, with the largest amount lost to investment scams at $336.2 million.

Scammers have also impersonated bank and telco staff, claiming to have detected suspicious transactions on victims’ credit cards or phone line applications. Victims were then directed to fake government officials to get them to transfer money into “safe accounts”.

How scammers exploit government directories

Having a real officer’s name, designation, agency and contact number adds credibility to government impersonation calls. Victims who verify the details online against an online directory would likely let down their guard.

“In reality, they have only verified that the officer exists, but they didn’t pause to think that the person on the phone may not be that officer,” said Andy Prakash, the founder and chief executive of IT security company Privacy Ninja.

Fraudsters had spoofed local numbers, including those from government agencies, to make their scams look more convincing.

But since 2019, telcos have blocked the spoofing of emergency hotlines and government agencies.

Since April 2020, telcos have also added the “+” prefix for all incoming overseas calls to alert users to calls that do not originate in Singapore.

In December 2022, telcos started to block all overseas calls that spoof local fixed and mobile line numbers.

Scammers have now moved to messaging apps like WhatsApp to spoof local numbers, which can include government agency numbers, as the apps sit outside the control of Singapore’s telcos, said Aaron Ang, regional director at Singapore-based cybersecurity and AI consultancy CWG Innovations.

On WhatsApp, scammers may also use profile pictures bearing official logos, or even appear in uniform against an office backdrop during video calls, to make the ruse more convincing.

“No Singapore agency handles case matters over WhatsApp,” said Ang. “The platform itself is the red flag. You don’t even need to work out whether the officer is real.”

To protect themselves against scam calls on WhatsApp, users can adjust their privacy settings to silence unknown callers.

They can also call the national ScamShield helpline on 1799 if they are unsure, or download the ScamShield app where they can submit suspicious phone numbers for screening.

Ang said that it would not make sense for the Government to change all contact details at this point as informing the public of the change could itself create opportunities for scams. “It’s a bit like changing your house number to stop junk mail,” he said.

Risk of corporate espionage

The risk of corporate espionage is why most private-sector organisations do not publish staff directory information online.

Similarly, an agency’s directory can reveal its organisational structure, including the names and contact details of officers in the same department. This allows a scammer to pose as a senior officer using a lookalike e-mail address and instruct subordinates to send confidential documents, or trick them into opening malicious files or click on malicious links.

“The scam is far more believable because the names and organisational relationships are accurate,” said cybersecurity expert Steven Wong from the Singapore Institute of Technology.

Officers working in procurement, licensing or grant administrators are common targets.

Is the public safer now?

While scams will not dry up completely, scammers will have less data to exploit.

Over time, as more rank-and-file public officers leave their organisations, what has already been harvested by scammers will also become outdated, said Anthony Lim, a senior research fellow at the Centre for Strategic Cyberspace and International Studies think-tank.

While online government directories still contain the information of politicians or very senior officers, it will be harder to convince victims that someone who is very senior has called them, said Lim.

What else can be done to stop government impersonation scams?

Mr Matthias Yeo, chief executive of Singapore-based cybersecurity research company CyberXCenter, suggested that agencies use a general e-mail address to communicate with the public instead of publishing individual officers’ e-mail addresses.

“When people are used to communicating through a generic official e-mail, they are more likely to question an e-mail that suddenly claims to come from a specific officer,” said Yeo.

Prakash also suggested a live verification system that allows the public to verify their caller.

It works by allowing government officers to generate a dynamic one-time code, which a member of the public can enter on a government website. The website would then display the officer’s name and agency and confirm that the dynamic code, which will expire in a few minutes, had just been generated.

“This can help verify the live interaction, rather than merely verifying that the officer exists,” said Prakash.

Public education should continue to stress that government officials will never ask people to transfer money or valuables, disclose banking login details, or install apps from unofficial sources.