Award Banner
Award Banner

NRIC numbers can be used to reveal home address, clinic records

NRIC numbers can be used to reveal home address, clinic records
Experts said the risks highlight how an NRIC number in the wrong hands can pose risks to individuals, who need to be vigilant against scams.
PHOTO: Lianhe Zaobao

SINGAPORE - Individuals whose full NRIC numbers were exposed on the Accounting and Corporate Regulatory Authority's (Acra) database earlier in December face potential cyber-security risks, as organisations frequently rely on NRIC numbers to retrieve personal information.

Checks by The Straits Times also found that NRIC numbers can serve as a key to collecting information about individuals, which can be used for targeted scams or mischief.

Cyber-security experts cautioned that NRIC numbers can be used by bad actors to trick victims into believing they are authority figures or to commit crime. The exposed NRIC numbers can also be used to collect further information for scams.

The experts said the risks highlight how an NRIC number in the wrong hands can pose risks to individuals, who need to be vigilant against scams, even as changes in how NRIC numbers are used in the private sector are afoot.

The concerns come after NRIC numbers belonging to key representatives of companies registered under Acra's database were revealed by mistake on its new Bizfile web portal on Dec 9. As a result, anyone could freely search and view the full NRIC numbers of registered individuals, including business' public representatives - some of whom are also politicians.

Acra apologised for the incident and disabled the feature on Dec 13, but experts said fraudsters could still use simple algorithms to collect the NRIC numbers exposed during this window at scale, increasing the threat of scams.

Acra said the incident was caused by a misunderstanding of an internal message distributed by the Ministry of Digital Development and Information (MDDI) some time in 2024, which informed agencies of plans to move away from the use of masked NRIC numbers for better security.

It did not reveal how many NRIC numbers were exposed during the incident.

The authorities are accelerating public education efforts on the use of NRIC numbers and consultation with the private sector on their use, said Minister for Digital Development and Information Josephine Teo at a press conference on Dec 19.

In the meantime, she urged private-sector organisations to stop relying on NRIC numbers as proof that a person is who he or she claims to be, such as to authenticate fund transfers.

Leaked NRIC numbers a key to personal data

Organisations are still relying on NRIC numbers as a key to retrieve personal data.

At e-kiosks in local healthcare institutions, checks by ST in the past week have found that entering an NRIC number can reveal its owner's registered address, contact number, recent appointment records and medical bills.

Bad actors could potentially cause mischief by cancelling appointments or collecting prescriptions fraudulently, said cyber-security expert David Siah, executive vice-president of South-east Asia-Australia at the Centre of Strategic Cyberspace + International Studies, a London-based think-tank.

Privacy Ninja co-founder Andy Prakash said such information can make scams more convincing, as fraudsters can include more unique details, such as a person's medical condition.

Scammers are unlikely to collect such information at scale due to the presence of security cameras and the difficulty in ensuring if an individual is a patient there, but the information can be used in a one-off targeted attack against specific individuals, he said.

The Registry of Marriages, a national database, allows users who have logged in via national authentication tool Singpass to look up to whom an individual is married. Users are limited to two free searches a year.

Some banks accept NRIC numbers to quickly identify customers who need help to block transactions, as a measure to thwart scams.

Such a feature has surfaced a debate on the balance between security and convenience, in the light of a report on Dec 9 that a couple's credit cards were blocked while they were on holiday after an impersonator used their NRIC numbers and personal details to freeze their accounts.

Read Also
singapore
Banks and insurers say not using NRIC number for high-risk activities, but reviewing its use

Local banks said the ability of quickly freeze an account is part of their protocol and an important anti-fraud measure.

For other requests, banks typically require callers to identify themselves by entering their NRIC numbers during the call, followed by a one-time password sent to their phone before services or privileged information are provided.

Calls by ST found that transactions over the phone are limited to fund transfers between the customer's own accounts with the bank and not to anyone else for security purposes.

Insurance companies are known to lock documents sent to customers behind automated passwords made of a combination of a customer's birthdate and partial NRIC number.

Local banks and insurers are reviewing their use of NRIC numbers and may change their practices soon.

MDDI told the media on Dec 19 that full NRIC numbers should be used only in situations requiring higher authenticity checks, such as during hotel check-ins, medical appointments and subscribing to a new phone line. They should not be used to sign up for retail memberships or lucky draws, among other scenarios.

Cyber-security consultant Shane Chiang from Momentum Z said much of the onus lies on organisations to shore up cyber-security measures and ensure that NRICs are no longer relied on for authentication. NRICs should be used only for identification purposes, he said, adding that individual vigilance is vital during this transition.

Individuals should enable two-factor authentication on online services and anticipate targeted phishing attempts, which are likely to be more convincing when more personal data is exposed.

Mr Chiang added: "Individuals should verify the legitimacy of communications before sharing further personal information or engaging with unfamiliar parties."

ALSO READ: Govt apologises for causing anxiety, confusion over unmasking of NRIC numbers

homepage

trending

trending
    Online voting not feasible due to 'voter impersonation' risks: ELD
    'She should be with her family': Employer gives maid plane ticket, $800 to return to Myanmar and search for missing mum
    Nintendo Switch 2 to launch in June with US$449.99 price tag
    'Blessed beyond measure': Desmond Tan and wife expecting second child
    Gossip mill: Chantalle Ng dating longtime friend, ex-TVB actress now sells chicken feet, Leslie Cheung's partner pays tribute on his 22nd death anniversary
    Probe finds former Smap idol Masahiro Nakai committed sexual assault, victim says 'What I've lost will never be recovered'
    Woman rescued from top of overhead bridge near Nex mall, detained under Mental Health Act
    MaNaDr admits to lapses, introduces 1-minute minimum teleconsultation rule
    New bus interchanges in Woodleigh and Pasir Ris to open in late April
    Life-sized dinosaurs, pre-historic plants: Gardens by the Bay to transform into Jurassic World this May
    How this Singaporean went from volunteer to CEO of a non-profit
    19 years' jail for mum who abused 4-year-old girl, whose body was burned after she died

Singapore

Singapore
    • 'Don't cheat, don't be greedy': Elderly couple in their 90s share secret to longevity with DPM Heng in viral clip
    • Singaporean girl, 15, who wanted to fight for ISIS is first female teen to be given ISA restriction order
    • 'He needed something to help him fight,' says man who bought Hokkien mee for dying patient
    • MOH to allocate $800m for active ageing centres as part of new initiatives to improve seniors' access to activities
    • Shanmugam's views on Israel-Palestine conflict 'sharply different' from that of former NMP Calvin Cheng's
    • GE2025: WP's likely replacement for Raeesah Khan outlines plans for improvements in Sengkang
    • Vivian says he did not 'like' FB post offering to relocate Singaporeans to Gaza; Meta investigating
    • Sports car driver allegedly high on laughing gas arrested on Orchard Road
    • GrabCab becomes Singapore's 6th taxi operator, plans to launch '100% green fleet'
    • 'Irresponsible parents': Man flips middle finger at driver after near accident with child at City Hall

Entertainment

Entertainment
    • Gossip mill: Diana Ser's son to enlist, Takeshi Kaneshiro back after 3 years, agency says late Sulli wasn't forced to film nude scene
    • 'I was right there just 3cm behind her': Exo's Kai recalls joys of simple life during military service, meeting commuter checking him out online
    • E-Junkies: The Click Five will consider making new music if upcoming tour goes well
    • Former NCT idol Lucas to make acting debut in Taiwan
    • Jim Carrey pays tribute to Val Kilmer's 'grace and courage'
    • Val Kilmer reportedly discussed reprising his role as Batman before his death
    • Sum 41 releases final music video before splitting up
    • Brad Pitt to return for Once Upon a Time in Hollywood follow-up on Netflix

Lifestyle

Lifestyle
    • A first look: Blue Bottle Coffee's cafe at Raffles City, here's what to expect
    • 'The menu is a reflection of us': Singaporean woman and American husband open restaurant selling soul food
    • Life after death: Guide to be launched to help parent caregivers plan for autistic children's future
    • Tea, drums and rangoli: These stewards of culture and heritage are being honoured for preserving tradition in Singapore
    • What to do this weekend (April 4 to 6)
    • Long-range cruiser: GAC E9 luxury MPV with over 1,000km of range now in Singapore
    • Deepal officially arrives in Singapore with opening of new showroom
    • We ask parents how they keep their children's screen time low - here's the lowdown
    • The best new-launch condo layouts we've seen so far in 2025
    • Where to find 999-year landed homes by the sea in Singapore: Touring Ponggol 24th Avenue

Digicult

Digicult
    • A $500 wake-up call: How the Samsung Galaxy Ring made me realise my stress
    • Monster Hunter Wilds producer explains how game has remained unique and fresh over 20 years
    • Games in April: RPGs, racing and Ronaldo in a fighting game
    • Is it time to get a MacBook at a good price? The M4 MacBook Air says yes
    • China's Baidu launches 2 new AI models as industry competition heats up
    • China's top universities expand enrolment to beef up capabilities in AI, strategic areas
    • International Women's Day: Meet the Singapore women levelling up in gaming
    • US indicts slew of alleged Chinese hackers, sanctions company over spy campaign
    • Meet the women powering innovation in tech in Singapore and beyond
    • Games in March: JRPGs, co-op games and wrestling

Money

Money
    • Giant deal: Malaysian company to acquire Cold Storage and Giant supermarket chains in Singapore
    • Australia says US tariffs 'not act of a friend' but rules out reciprocal move
    • South Korea's acting president calls for talks with US over tariffs
    • Southeast Asian nations, hit particularly hard by US tariffs, prep for talks with Trump
    • China urges US to immediately lift tariffs, vows retaliation
    • Trump's tariffs stoke global trade war as China and EU vow response
    • HDB to launch 3,000 balance flats in July 2025: What homebuyers need to know
    • With 61 years left on its lease, this Bishan maisonette matches national record at $1.5m
    • Why are homebuyers choosing pricier new launch 2-bedders over resale options in 2025?
    • Looking to live near JB? Here are the cheapest condos by the Causeway in Woodlands

Latest

Latest
  • US South, Midwest face 'generational' flood threat after severe storms, two dead
  • Hungary says it is withdrawing from ICC as Israeli leader Netanyahu visits
  • Daily roundup: New bus interchanges in Woodleigh and Pasir Ris to open in late April — and other top stories today
  • Philippines assures China potential F-16 purchase not intended to harm any nation
  • Musk will stay until he completes Doge mission, White House says
  • Thousands of Haitians take to streets to protest surging gang violence
  • Tornadoes and heavy rains rip across central and southern US
  • Danish PM pledges to support Greenland against Trump pressure
  • Taiwan details surge in Chinese activity on last day of war games

In Case You Missed It

In Case You Missed It
  • Thai woman struggles to evacuate during earthquake while her dog sleeps unfazed
  • Workers painting exterior of Geylang block discover man's skeletal remains in flat
  • 'New, younger' PAP team vows to reclaim WP-controlled Sengkang GRC, says Lam Pin Min
  • New face Jackson Lam 'very good on the ground' and will be asset to Parliament, says Shanmugam
  • Woman who publicised tips on how she evaded GST for luxury purchases fined $18k
  • Powerful quake in Southeast Asia kills several, 81 trapped in Bangkok building rubble
  • Dog dies after being skinned alive in Malaysia, animal welfare group condemns 'barbaric' act
  • Blue for seafood, red for meat: Case partners Koufu to have colour-coded price labels at 'cai fan' stalls
  • WP will campaign for 'responsible and loyal opposition' in GE2025 to earn seats in Parliament, says Pritam
This website is best viewed using the latest versions of web browsers.