Govt agencies exploring use of AI to block scam websites quickly

Government agencies are looking at using artificial intelligence (AI) to quickly detect and block scam websites through telco networks to protect the public from being scammed.

To complement this, the National Crime Prevention Council will also launch a WhatsApp channel by the third quarter of this year to source information on scam websites from the public.

These measures come in the wake of SMS phishing scams that targeted OCBC Bank customers recently.

Announcing the new moves yesterday, Minister for Communications and Information Josephine Teo said in Parliament that one of the Government's upstream measures to combat scams is to disrupt the ability of scammers to reach potential victims through communications infrastructure like telco networks.

A key part of that is blocking scam websites because of how such sites allow scams to be "processed with greater scale and speed" than through phone calls or SMS texts, she said. No direct human interactions are needed when phishing through a scam website, in contrast to phishing for victims' credentials and personal data by phone or SMS.

Mrs Teo, who is also Minister-in-Charge of Smart Nation and Cybersecurity, was delivering one of three ministerial statements addressing the Government's approach to fighting scams, in response to 39 parliamentary questions filed on the matter.

The Infocomm Media Development Authority (IMDA) and police work with Internet service providers to block scam websites.

In 2020, about 500 suspected scam websites were blocked, but this jumped last year to 12,000.

Fake sites played a large part in the scams that caused 790 OCBC customers to lose $13.7 million from December to January. Crooks had spoofed OCBC's name to send SMSes to victims, claiming there were issues with their banking accounts. This caused the scam texts to be grouped with legitimate SMSes from the bank, which many victims said led them to think the fake messages were genuine.

The scam SMSes prompted victims to click a link to a fake OCBC website, where they were asked to key in their banking details.

Mrs Teo said that in the OCBC cases, more than 350 scam websites had been blocked, with around 52 sites blocked in a single day at the peak.

However, she said that the crooks were quick to create new websites over the course of their scam campaign.

So, using AI to help detect and block such sites, as well as having the new WhatsApp scam channel, could help the Government strengthen its ability to tackle scam sites and be more responsive.

Another important measure to upset scammers' plans is to block suspected calls made by them, mostly from abroad.

To address such scam calls, Mrs Teo said that the telcos here plan to build additional analytics capabilities to block more of these calls.

IMDA told The Straits Times it expects the telcos to do this by the end of the year.

The Government estimates that up to 55 million calls will be blocked each month by the telcos as a result, up from 15 million currently or one in seven of all incoming overseas calls to Singapore.

To a query by Mr Melvin Yong (Radin Mas) on whether scam calls made over the Internet, such as through WhatsApp, can be blocked, Mrs Teo said that these are currently not blocked. Still, she said the Government is "constantly looking at what channels are being exploited for scams to be perpetrated".

As for criminals spoofing legitimate organisations' names to send scam SMSes, like what happened in the OCBC scam, Mrs Teo reiterated that the Government will consider requiring all users of SMS sender names to register with the Government's anti-SMS spoofing registry.

This should mean that scammers will not be able to use an SMS sender name, such as another organisation's, unless they sign up with the registry.

IMDA will engage the industry on this later this year.

The Singapore SMS SenderID Protection Registry was set up by IMDA and the Monetary Authority of Singapore (MAS) in August last year as a pilot scheme to register and protect from misuse names used for sending SMSes.

Currently, MAS has decided that all major retail banks must register their SMS sender names. The Government has said that all its agencies will do the same.

SMS service providers and telcos have also been required by IMDA to check SMS senders against the registry, so SMSes sent by spoofed names will not be delivered if the sender details do not match registry records.

To help the police with investigations when a scam occurs, all organisations that send SMSes using registered names here must also have a valid unique entity number for identification.

To plug the gap for unregistered and therefore unprotected SMS sender names, IMDA told The Straits Times last month that it is considering making it mandatory for all organisations to join the anti-SMS spoofing registry to register sender names they want to use.

If implemented, companies that do not register their SMS sender names will have their SMSes appear only with their phone number instead of the company's name. The firms' customers could save these numbers in their contact lists so as to recognise such numbers later.

Due to these implications, Mrs Teo said IMDA will study the matter carefully.

But she also urged organisations to rethink how they use SMS to communicate with customers, adding that SMS is old technology and "never designed for secure communications".

Mrs Teo said more restraint is needed when SMSes have or lead to confidential information or high-value transactions.