Carousell phishing scam! — At least 72 victims have fallen for it since Jan, over $109,000 lost

The Singapore Police Force (SPF) reminds the public to practise extra caution amid the re-emergence of a phishing scam variant.

Families have lost their life savings to such phishing scams, sparking a call for extra vigilance. Just last week, scammers tried enticing POSB customers to reveal personal information through an email “survey”, promising them a cash reward. DBS has since confirmed that the email is not legitimate.

In a release on Thursday (Mar 4), SPF said that scammers would now pose as buyers on the e-commerce platform Carousell.

Victims would be told to complete the transaction on CarouPay after receiving emails phishing URL links from scammers purportedly impersonating Carousell.

SPF said that there had been at least 72 victims with losses amounting to at least S$109,000 since January 2022.

Scammers would typically approach victims on Carousell, expressing interest in purchasing items the victims are selling.

After agreeing to the sale of the item, the scammer would ask to pay via CarouPay to the victim’s PayNow account.

The victims would then receive an email purportedly from Carousell indicating that the payment was made. However, it includes a phishing URL link informing the victims that they need to click it to receive the payment.

The phishing URL links would redirect the victims to fraudulent websites impersonating various bank websites, tricking them into providing their banking details, including a One-Time Password to receive the payments.

The scam would only be discovered after the victims discover unauthorised transactions made by their bank accounts.

SPF provided the following crime prevention measures to protect members of the public:

• Carousell Protection (previously known as CarouPay) will never require users to confirm payment via email or require them to reveal any online banking login credentials through third-party websites.
• Sellers are reminded to always verify the buyer’s profile on online marketplaces by checking the account’s verification status, creation date, reviews and ratings.
• Do not click on URL links provided in unsolicited emails and text messages.
• If in doubt, always verify the authenticity of the information with the e-commerce platform directly or with the banks.
• Never disclose personal or Internet banking details and OTPs to anyone.
  Report any fraudulent transaction to the bank immediately.

If you have any information relating to such crimes, call the Police Hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. If you require urgent police assistance, dial ‘999’.

For more information on scams, members of the public can visit www.scamalert.sg or call the Anti-Scam Hotline at 1800-722-6688. Visit the ‘Spot the Signs. Stop the Crimes’ infotainment website at https://scamalert.sg/spotthesigns and share them with your family and friends. Together, we can help stop scams and prevent our loved ones from becoming the next victim. /TISG

Best online security practices to protect yourself from scammers