The Immigration & Checkpoints Authority (ICA) has identified about 80 cases of unauthorised attempts to change residential addresses registered with ICA via ICA’s electronic change of address (eCOA) service. The perpetrators succeeded in changing the addresses in about 75% of these attempts.

2.             To implement additional security measures, ICA has suspended the eCOA service from today for review. We will likely resume this service on 14 January 2025.

3.             Under the National Registration Act, all NRIC holders are required to report a change of residential address to ICA within 28 days. 

4.             Introduced in 2020, the eCOA service allows Singapore residents (Singapore Citizens and Permanent Residents), including those who reside overseas, to report a change of residential address to ICA online.  Please see Annex A for the process. Individuals can make a change to their own, or others’ residential address, by logging into the eCOA service with their Singpass under one of the following three modules:

 

• “Myself” 

• “Myself and my family members” 

• “Others”

5.             The “Others” module was introduced to help those who are not digitally savvy, so that they can get assistance from a proxy with a Singpass account, to update their residential address online on their behalf. This way, they would not have to make a trip to the ICA Building to do so. The proxy would log in to the eCOA service using his own Singpass, and input the NRIC Number and Date of Issue of the NRIC of the individual who requires the change of residential address. An average of 900 Singapore residents change their residential address through a proxy every month.

6.             From September 2024, ICA started investigating cases of unauthorised changes of residential addresses. Initially, there were only a few cases that appeared unconnected, but more cases surfaced recently. By December 2024, our investigations uncovered how the unauthorised changes of residential address were effected, and what they were used for. We have found about 80 unauthorised attempts to date, 75% of which resulted in successful changes to residential addresses.

7.             The perpetrators used stolen or compromised Singpass accounts to change the residential address of the victims through the “Others” module of the eCOA service. To do so, they would have had previously acquired both the NRIC number and Date of Issue of the NRIC of the victims, to input these details into the eCOA service. The eCOA service would then send a verification PIN mailer to the registered residential address set by the perpetrator, where he could access the mailer to confirm the change of address. 

8.             Once the registered residential address of the victim was changed, it was used to set a new password for the victim’s Singpass account. This was done by requesting the Singpass service to mail a new PIN to the registered residential address set by the perpetrator. It is likely that the perpetrators are using stolen or compromised Singpass accounts and letter boxes of third parties to generate more mule accounts to use for scams and other cybercrimes. 

9.             ICA has therefore temporarily disabled the eCOA service this morning, to implement additional security measures to prevent further abuse. We will conduct a review in the next two days and will likely bring up the service on 14 January 2025. The “Others” module will remain unavailable until ICA has implemented further measures to safely allow the change of address by a proxy.

10.            The additional security measures include integrating face verification technology into the Singpass login for the eCOA service, which minimises the risk that a perpetrator can use the stolen Singpass account of a third party to access the service to change a victim’s address. 

11.            In the meantime, those who require proxy assistance may approach the IC Unit at Level 3, ICA Building for assistance from Mondays to Fridays, 8am to 4.30pm. 

12.            ICA is working closely with the relevant agencies to assist affected individuals. We are in the midst of contacting all the known affected individuals. ICA will assist them with a NRIC replacement (which has the same NRIC number but a different Date of Issue), and to revert their registered address to the correct one. For those whose Singpass account may have been compromised, ICA will work with GovTech to reset the account. The Police are investigating the cases to identify the perpetrators and accomplices.

13.             Members of the public may check their registered address on ICA’s website and ensure its accuracy.  Please refer to Annex B for steps on how to do so. Any inaccuracies should be reported to ICA immediately via https://go.gov.sg/reportunauthorisedchange. 

14.             We apologise for the inconvenience as we work to reinforce the security of the eCOA service.