SINGAPORE - A nightclub bouncer confessed to hatching an elaborate plot to trick women into sending him their nude photographs, by masquerading as their friends on social media.

To do so, Muhammad Rostam Rahim, 28, exploited a loophole involving deactivated Hotmail accounts.

Hotmail accounts are terminated after 270 days of inactivity, or if the user does not log in within 10 days after signing up. Rostam would look for Facebook accounts linked to Hotmail IDs that had been terminated, and register new Hotmail accounts with these IDs.

Court documents did not state how Rostam identified such accounts.

He would then ask to reset the password on Facebook, which would send an e-mail to the linked Hotmail account - which now belonged to him - that allowed him to change the password and take control of the account.

In other cases, he would use phishing links to snag log-in credentials of unsuspecting Facebook users. Phishing links attempt to steal sensitive data such as social media passwords by posing as legitimate institutions.

On Tuesday (May 22), Rostam pleaded guilty in a district court to 46 charges, which included cheating by personation, and unauthorised modification of the contents of a computer.

This makes him the first person to be charged under Provision 8B of the Computer Misuse and Cybersecurity Act, said Deputy Public Prosecutor Thiagesh Sukumaran, for retaining the log-in credentials of Facebook accounts to be used to access these accounts without authorisation.

Another 117 charges will be considered for sentencing.

Between October 2015 and February 2018, Rostam accessed the victims' social media accounts to contact people listed as their friends.

He would then pretend to represent either a modelling agency or a breast cancer campaign, and ask the friends for nude photographs. The victims cannot be named due to a gag order.

DPP Sukumaran told the court that on Feb 7, 2016, Rostam gained access to a 23-year-old woman's Facebook account without her consent.

About two months later on April 17, he messaged her friend, a 20-year-old woman, and asked if she wanted to be a bridal model, to which she said yes.

Rostam asked for her nude photographs so he could "know her sizes" to determine which bridal gowns best fitted her.

Believing him to be her friend, she complied.

Rostam also took control of her aunt's account and asked for pictures of her nude and in her underwear, claiming that these would be used to get her modelling contracts.

She found nothing unusual as her aunt knew of her interest in modelling, and sent over the photographs.

After finding out that she had not been communicating with her aunt, she lodged a police report.

Rostam has been diagnosed with fetishism by a medical officer from the Institute of Mental Health.

For cheating by personation, Rostam could be jailed for up to five years, fined, or both.

If convicted for unauthorised access to computer material, he could be sentenced to two years' jail, slapped with fine, or both. For a second or subsequent conviction, he could see a jail term of up to three years, a fine, or both.