Jail for man linked to syndicate that abused govt-related systems to take over Singpass accounts
Source: Straits Times
Article Date: 18 Mar 2026
Author: Shaffiq Alkhatib
As part of his job, Koh Hong Yan used his own Singpass account to approve transactions by clicking on ICA hyperlinks which the alleged mastermind behind the scheme sent him.
A man who was looking for job opportunities ended up working for the mastermind of a syndicate that exploited loopholes in government-related systems to take over Singpass accounts.
As part of his job, Koh Hong Yan used his own Singpass account to approve transactions by clicking on Immigration and Checkpoints Authority (ICA) hyperlinks that the alleged mastermind behind the scheme, Ng Wei Chang, sent him.
In late 2024, the account was used to apply for the registered addresses of eight people to be changed via ICA’s electronic change of address (eCOA) system.
Koh also used his Singpass account to verify the change of addresses for five people. He knew none of these individuals, the court heard.
On March 17, Koh, 27, who told investigators that he received $500 in total for all the Singpass transactions that he approved, was sentenced to a year and three months’ jail.
He had pleaded guilty to offences including two charges involving the misuse of a computer system. The case involving Ng, 31, is pending.
Deputy public prosecutors Hon Yi, Jonathan Tan and Janessa Phua stated in court documents that Singpass credentials are used to access highly personal and sensitive information.
They added: “By exploiting loopholes in government systems... the syndicate’s actions had a detrimental impact on the Government’s push for more services and transactions to be conducted online.”
In 2020, ICA introduced the eCOA service on its website, which members of the public can use to update their registered addresses.
An applicant can access the eCOA system by logging in and verifying his or her identity by using Singpass. The applicant can then input his or her new address into the system.
After that, a unique personal identification number (PIN) is sent to the applicant’s new address by mail.
The applicant can then log into the eCOA system and input the PIN to verify the change of address.
Once the change is verified, the applicant’s new registered residential address is reflected across all government services.
The DPPs said that those who were unable to submit applications through the eCOA service could appoint proxies to do so.
This option has since been permanently disabled after the syndicate’s activities came to light.
Previously, a proxy could log into the eCOA system by using his or her own Singpass details.
The proxy had to also provide information such as the applicant’s identity card number to access the eCOA service and obtain the PIN mailer.
An applicant could use one proxy to apply for the PIN mailer and another proxy to verify the change of address, said the prosecutors.
Singpass also has a similar electronic service for members of the public to reset their password online.
Applicants could also appoint proxies to submit applications on their behalf.
Investigations revealed that in 2024, Ng allegedly masterminded a syndicate that exploited the eCOA system to take over Singpass accounts.
The perpetrators used compromised or relinquished Singpass accounts to access the eCOA system.
After gaining access, they used information such as the identity card number of a victim, whose Singpass account they wanted to take over, to apply for the victim’s registered residential address to be changed.
The perpetrators would then change the victim’s registered address to one belonging to a syndicate member. A PIN mailer would then be sent to the syndicate member’s home.
The perpetrators would use the mailer and verify the change of address via the eCOA system.
They would also apply to reset the password to the victim’s Singpass account.
The DPPs said: “The Singpass password mailer containing the one-time-password would be sent to the new residential address... The perpetrators would use (it) to confirm the password reset of the victim’s Singpass account.”
Around November 2024, Koh asked an acquaintance for job opportunities and the latter introduced him to Ng.
Court documents stated that Koh was then tasked to use his Singpass account to approve some transactions in exchange for payment from Ng.
Between Nov 23 and Dec 7, 2024, Koh used his Singpass account to verify the change of addresses for five people.
Ng then managed to take over the Singpass account of one of the victims, identified in court documents as V3.
According to court documents, Ng later used V3’s Singpass account to access nine government services on 59 instances between Dec 7, 2024, and Jan 7, 2025.
The DPPs said that Ng also applied for 12 financial products with different banks and financial institutions in December 2024.
For an American Express card registered to V3, there were unauthorised charges totalling more than $14,000.
Separately, Ng also told Koh that it would be more “efficient” for him to take over Koh’s Singpass account.
Koh, who agreed to do so, then received $100 from him, the court heard.
On Dec 14, 2024, a 50-year-old woman alerted the police, stating that her identity card details could have been compromised.
ICA temporarily suspended the eCOA service on Jan 11, 2025, and disabled the option of submitting applications by proxies after detecting unauthorised attempts to change residential addresses.
The eCOA service was restored three days later, and the option to submit applications by proxies was permanently disabled.
Source: The Straits Times © SPH Media Limited. Permission required for reproduction.
2