SINGAPORE: Business development manager Chan Si Yong, 29, used to pick up calls from numbers starting with +65 because he thought the Singapore country code meant it was a legitimate local call.
But on every occasion, he would hear an automated voice in heavily accented English saying they were from official businesses or government agencies. He immediately hung up. “It’s obviously a scam,” he said.
Mr Chan has grown tired of these calls – he used to get them once or twice a month – and now never picks them up. “They always turn out to be fake, so I just gave up on answering them,” he added.
The “+” prefix is in fact an anti-scam measure telcos implemented since April 2020 for incoming overseas calls, after overseas scam syndicates spoofed local numbers to get potential victims to pick up.
These scam calls then began showing up with overseas prefixes. So the scammers changed tact and began spoofing numbers to show up with Singapore’s country code, “+65”.
While many people know better and continue to reject +65 calls, overseas scam calls remain a problem.
The 23,391 scam cases reported in 2021 – making up about half of all crime cases that year – was a 53 per cent jump from the year before. China officials impersonation scams, usually conducted over the phone, also increased by about 70 per cent.
Further complicating matters is the fact that some +65 calls are legitimate.
In July 2021, MP Saktiandi Supaat (PAP-Bishan-Toa Payoh) asked in Parliament if authorities could “limit” +65 scam calls.
Senior Minister of State for Communications and Information Janil Puthucheary responded that the public should not pick up such calls if they are not expecting anyone calling from overseas.
The Infocomm Media Development Authority (IMDA) will continue to work with telcos to improve how they detect and block suspected scam calls while ensuring “genuine calls” go through, he said.
In February, after the high-profile OCBC phishing scam raised multiple questions in Parliament, Communications and Information Minister Josephine Teo said telcos already block around 15 million suspicious overseas calls, or one in seven of all incoming overseas calls to Singapore, every month.
“Our telcos plan to incorporate additional analytics to block more of these suspected scam calls. We estimate that up to 55 million calls will be blocked each month,” she said in a ministerial statement, adding that the number of scam calls is expected to rise as scammers change tactics.
While telcos have been reluctant to offer details of these additional measures so scammers do not gain the upper hand, experts said it could involve using technology to analyse incoming overseas calls in greater detail for tell-tale signs of scams.
IMDA told CNA on Wednesday (May 4) that beyond the “+” prefix, it has worked with telcos on building up “in-network capabilities” to block scam messages and calls, including robocalls and those spoofing numbers of local government agencies and emergency services.
“We are currently working with telcos on additional measures, including enhancing measures to further block numbers spoofing domestic fixed-line and mobile numbers,” a spokesperson said. “We will announce these measures once ready.”
LEGITIMATE +65 CALLS
Still, it is worth noting that some +65 calls are legitimate.
In May 2021, MP Murali Pillai (PAP-Bukit Batok) asked in Parliament whether IMDA would consider directing telcos to block overseas calls that carry the “misleading” prefix +65, after a “significant increase” in spoofed calls from scammers based overseas.
In response, then-Minister for Communications and Information S Iswaran said in a written reply that IMDA had considered this, but found it “unfeasible” due to legitimate international incoming calls that carry the +65 prefix.
“Such examples include Singapore-based callers who travel overseas and call Singapore using mobile roaming services, as well as overseas call centres of local businesses who hold local numbers for their hotlines,” he wrote.
Some businesses use overseas call centres, many of which are located in India and the Philippines, because the labour costs in these countries are much lower.
Forum threads discussing +65 calls said they could also be from legitimate companies that use cloud-based Voice over Internet Protocol (VoIP) services to make voice calls using a broadband Internet connection instead of a regular phone line.
VoIP calls are cost-effective and can intentionally spoof a +65 number to make them appear more legitimate locally.
Mr Kevin Reed, chief information security officer at cybersecurity firm Acronis, said VoIP calls work using “from” and “to” entries.
“They resemble ‘from’ and ‘to’ on plain old letters – sender can write almost anything there and receiver may not even check the ‘from’ part because only ‘to’ is needed to actually deliver the (call),” he told CNA.
CallHippo, one such VoIP service, said on its website that its virtual Singapore phone number is affordable and creates “an illusion of local existence for your business”.
Restaurant reservation service Chope told CNA that calls from its automated reservation confirmation service come with the +65 prefix as it works with international calling services.
“Through this service, our restaurant partners can automatically get diners to confirm their upcoming online reservations without having to deploy staff to manually make those calls,” Chope’s head of operations Irving Tang said.
While Mr Tang acknowledged that some customers hang up on these calls, many restaurants still opt for these calls as they get a “very high response rate” from diners.
“We identify the purpose of the call quickly, plus do not ask for any personal information which could differentiate us from a typical scam call,” he said, adding that restaurants can opt for an SMS to be sent instead.
If diners do not pick up the +65 calls, Mr Tang said their reservations will remain, although restaurants can choose whether they keep these “unconfirmed” reservations.
“We are aware of the potential pitfalls of having the +65 prefix, and are currently exploring alternative ways to allow diners to confirm their reservations,” he added.
Citibank is another business that uses +65 calls, sometimes to offer additional banking services to clients in Singapore.
“Citi uses an international telephone numbering system that allows phone calls and text messages to be correctly routed to individual phones in different countries,” a spokesperson said.
“The security of our customers is highly important to us, thus we constantly review how we can improve the safety and effectiveness of our telephone services.”
BLOCK THEM ALL?
Despite some legitimate uses of +65 calls, Mr Reed said he would prefer such calls be blocked entirely and accept those from overseas call centres as “collateral damage”.
“I don’t think roaming users are really the problem, because they register at HLR (home location register) and thus can be distinguished,” he said, referring to the main database of permanent subscriber information for a mobile network.
Mr Reed said the introduction of the “+” prefix did not help much as scammers will always find a way to work around the “basic” solution, and have already done so in this case.
“It’s important to stress – this is a non-stop competition. Each side invents new ways to detect scams, while the other improves their scamming technique,” he said.
Telcos currently filter out and block suspected overseas scam calls by looking at what is called their signalling attributes, including where the calls come from and the numbers dialled, Mr Reed explained.
This is similar to how email services fight spam, by looking at attributes like Internet protocol (IP) addresses and deciding whether the emails are legitimate.
“You can have static rules – for example accept email from gmail.com if it is sent by Google IPs – or you may have more advanced rules, even machine learning, which could be used in this case (for telecommunications) too,” Mr Reed added.
This kind of machine learning and data analytics could be used to detect signs of overseas scam calls, including their frequency, quantity and duration, said Mr Sachin Mittal, head of telco research at DBS bank.
For instance, an overseas number making hundreds of calls to different numbers in Singapore every day could be considered suspicious, he told CNA, adding that telcos must use data analytics to handle the sheer volume of calls.
With authorities targeting the blocking of up to 55 million overseas calls each month, Mr Mittal said telcos must “invest a lot” in such tools and might look for financial support from regulators.
TELCOS ALREADY USING DATA ANALYTICS
In response to queries from CNA, an M1 spokesperson said the telco is already using analytics to deal with scam calls, and that its network can identify international incoming calls posing as Singapore numbers.
“To combat the increasingly sophisticated scam efforts, M1 is also looking at other network-based analytics and end-user device technology solutions that could complement our efforts against scam calls,” the spokesperson said.
“Thus far, the addition of the ‘+’ prefix has been effective in making scam calls easier to identify, as we have not seen a significant increase in cases flagged by customers.”
StarHub told CNA it works closely with relevant authorities to identify and block commonly spoofed numbers, and was the first operator to add a default “+” prefix to all incoming international voice calls at its gateway.
During an anti-scam briefing organised by the police in April, a Singtel official said the telco will not stop at introducing the “+” prefix for overseas calls.
“We are also continuously trying to introduce new technology using artificial intelligence and machine learning to really intercept some of these calls in real time,” said Mr Cheong Hai Thoo, Singtel’s vice-president for its mobile network engineering and consumer division in Singapore.
The telcos also stressed the importance of educating consumers and ensuring they practise discretion when picking up calls from unknown numbers.
Acronis’ Mr Reed said consumers can use apps that block known scam call numbers from abroad, but cautioned that these are only useful if the numbers “do not change often”.
“But no one can block all the calls; it’s better to teach people to not pick up calls from the numbers they do not know or do not expect,” he added.
