Singapore Police Warn of Telegram Account Takeovers Using Fake Public Transport Voucher Scheme
Singapore Police have warned of a resurgence in Telegram account takeovers linked to messages falsely promoting a “Public Transport Voucher Scheme”, with scammers using phishing pages to steal Telegram verification codes and seize control of victims’ accounts.
According to the Singapore Police Force, victims receive a Telegram message containing an infographic that claims to verify eligibility for a public transport voucher. The message includes a fraudulent link which directs users to a page requesting personal details including their name, mobile number, NRIC number and Telegram verification code, or one-time password.
Once a victim provides the verification code, scammers can take control of the Telegram account. The compromised account is then used to send similar phishing links to the victim’s contacts or to add contacts to chat groups promoting fraudulent investment schemes. Police said victims typically realise their accounts have been compromised after friends report receiving unexpected messages from them or when they notice unauthorised Telegram activity.
SPF stressed that Singapore’s Ministry of Transport will not contact members of the public through Telegram or ask them to click links to claim public transport vouchers. Legitimate voucher information is communicated through official Ministry of Transport channels, including its website and authorised social-media accounts.
Police advised Telegram users to enable Two-Step Verification and never share verification codes or OTPs. They also urged members of the public to inspect the full URL before clicking links, noting that official Singapore government websites end in “.gov.sg”. Suspicious messages, phone numbers and websites can also be checked through ScamShield.
The scam illustrates how account-takeover attacks can create a second layer of risk after the initial phishing event: once a trusted social-media account is compromised, scammers can reuse the victim’s identity and contact network to distribute further phishing links or promote fraudulent investments.
