Apple iMessage Phishing Scams Singapore: At Least S$31,000 Lost to Fake Courier and Polyclinic Messages

Phishing messages sent over Apple's iMessage have cost victims in Singapore at least S$31,000 since 31 October, AsiaOne reported, citing a police news release issued on Saturday, 14 November. The messages pose as courier firms or SingHealth polyclinics and link to fraudulent websites.

The report doesn't say how many people lost money.

Two lures: a failed delivery and an unpaid bill

The courier version claims there are issues with the recipient's parcel delivery. Its link leads to a site that wants personal, banking or credit card details, or a payment.

Others say there are outstanding outpatient bills at a SingHealth polyclinic. ScamShield's alert list had flagged this version a week before the police release, on 7 November: "Apple users! Watch out for iMessages that appear to be from SingHealth Polyclinics".

iMessage scams since June

In August the police said Cyber Command had disrupted more than 30,000 Apple iMessage accounts since June. Courier lures had cost about S$2.2 million by then. Some messages asked people to reply "Y" or "1", which the police believe is meant to get round iMessage keeping links from unknown senders unclickable. The same advisory states that "Government agencies and courier companies do not use iMessage in their communications with the public."

What the police advise

The police ask recipients not to reply, and to check a courier message in the ScamShield app or on the courier's official website and contact the courier through official channels before giving details or paying. On the iPhone, they ask users to switch on "filter unknown senders" and "filter spam", report suspicious messages with iMessage's in-app reporting and install the latest iOS update.

For bank accounts, the police recommend two-factor authentication on banking apps and e-wallets and the bank's Money Lock feature. Anyone who has been scammed is asked to contact their bank to block the transactions and make a police report. The ScamShield Helpline, 1799, runs 24 hours a day.