Readers beware: Scammers using fake ST pages, articles that depict prominent figures

SINGAPORE – Fake news articles, misusing the branding of The Straits Times and other news outlets and falsely attributed to their journalists, have been used in a long-running series of cryptocurrency scams.

The spoofed articles quote prominent figures like Prime Minister Lawrence Wong or OCBC Bank’s group chief executive Helen Wong singing praises about obscure cryptocurrency platforms that are likely to be phishing sites instead.

These sites convincingly replicate ST’s logo and layout, and lead users to create an account and disclose their identification and banking details.

CNA’s branding was also misused in fake articles promoting a supposedly government-endorsed investment platform, which claimed a return of $15,500 on a $350 investment within one month.

Ms Ho Ching, wife of former prime minister Lee Hsien Loong and chairwoman of Temasek Trust, has also

long been impersonated on scam advertisements

that misuse the branding of ST and other outlets in fake articles.

Since 2023, at least 27 such fake sites have been reported to CheckMate, a

free fact-checking service available

on WhatsApp. The service allows users to upload suspicious content for crowdsourced fact-checking. More than half of the reports on fake sites came in January alone, with most of them falsely using the branding of local news outlets, CheckMate founder Tan Bing Wen said.

Another fact-checking outfit, Black Dot Research, encounters an estimated 100 similar fake sites yearly. These often mimic ST and CNA, said its founder and managing director Nicholas Fang, who believes the number is far higher in reality.

“Clicking on elements on these pages usually directs users to the scammer’s sign-up form,” said Mr Fang.

ST editor Jaime Ho said such scams capitalise on the trust that people have in personalities, brands and organisations, and will continue to evolve. 

“The Straits Times is not immune to those who would want to impersonate us with criminal intent. We will continue to call out the most egregious examples,” he said.

“But in the long term, the best antidote is for us to continue working with our community to deepen online literacy, to strengthen our distinct voice and recognised credibility, and ultimately help readers establish habits and a healthy scepticism that lead them to always check back on ST on the web, app and all our social media and messaging platforms.”

Spoofed news scam sites have been popping up for several years now, said Google Threat Intelligence regional lead adviser Lim Yihao, adding that they have grown in numbers since generative artificial intelligence tools became widely available in 2022.

Many sites look similar, promoting cryptocurrency and promises of fast cash, but they are most likely gathering data for scams, Mr Lim said.

Unlike typical phishing scams, these sites are designed to avoid detection by showing different versions of the website based on the user’s device and network.

ST’s checks found that a site might show food-related or other content when accessed on an office-issued device with stronger security settings, yet the same link displayed a fake ST article when opened on a personal device.

Cyber-security firm Zscaler chief security officer Deepen Desai said that in such cases, scammers use a common technique called traffic direction systems to redirect users to the scam site based on factors like their internet protocol addresses, platform and location.

“By filtering traffic, attackers can ensure that only their intended targets – often users from specific regions or device types such as mobile devices – are exposed to harmful content, while avoiding security researchers and automated security solutions,” he added.

Threat intelligence platform FortiGuard Labs’ director of threat intelligence Jonas Walker said the programs might also avoid users of more niche browsers like Opera or Brave, as these are more likely to be alert to scams and report the fake sites. 

The filters can also target devices with more cookies – a data trail left by default on a web server while a user is browsing a website, he said.

The more cookies, the lower the chance the user has deployed security measures like ad-blockers or firewalls, allowing scammers to identify the likely weakest link.

Police said in reply to ST that they are not aware of any scams related to this mode of operations.

They urged the public to be alert to fraudulent sites containing false information to promote investments, and to check the platform’s background through official resources before investing.

Scammers have also been quick to exploit current events.

A fake website impersonating a government voucher claims portal was circulated online after PM Wong announced a series of vouchers during

his Budget 2025 speech on Feb 18

. Unsuspecting users are lured into providing their full names and contact numbers to claim a $2,000 relief voucher, purportedly from the Government.

Most of the rebates and vouchers announced by PM Wong will be distributed progressively after April 2025, typically claimed via Singpass.

Cyber-security experts urged users to check the links of suspicious websites and cross-reference claims and investment platforms with reliable sources on the internet before divulging personal details or approving a transaction.

Users should report scam sites to the authorities’ ScamShield app or safebrowsing.google.com to prevent others from stumbling upon them.

ScamShield flags suspicious sites on mobile and callers based on a blacklist of known scam contacts reported from its user base. Similarly, Google’s reporting platform consolidates scam reports, which Google can use to alert other platforms.