Adoption Rate and Effectiveness of ScamShield in Preventing Scams

Mr Derrick Goh asked the Minister for Home Affairs (a) what is the public adoption rate of ScamShield since its launch; (b) what is the Ministry’s assessment of the effectiveness of ScamShield; and (c) whether ScamShield complements malware detection apps used by banking customers.

The iOS and Android versions of the ScamShield mobile app were launched in November 2020 and September 2022 respectively. As of October 2023, there have been about 750,000 downloads. We do not track the number of unique users. A user may download the ScamShield app on multiple devices.

ScamShield has been effective in protecting users from scam calls and SMSes. Since March 2022, about 80,000 unique scam-tainted phone numbers have been blacklisted and blocked by ScamShield and about five million SMSes have been flagged to users as potential scams.

On top of phone calls blocked by ScamShield, the Police work closely with telecommunication companies (telcos) to block mobile lines suspected to be involved in scams. In the first half of 2023, more than 3,700 mobile lines which were believed to be used in scams were flagged by the Police for termination. In addition, telcos blocked about 180 million suspected scam calls at the network level during this period.

The Government Technology Agency of Singapore (GovTech) team is making enhancements to the ScamShield app so that users can more easily report scams. It is also working to improve the accuracy of scam SMS detections and to help users more easily set up the correct permission settings.

Mr Yip Hon Weng asked about measures to identify and block scammers from using social media, e-commerce platforms and messaging mobile applications. While ScamShield is not designed to block scammers on these platforms, it serves as an additional layer of defence and has a reporting function that allows users to alert the authorities about the scam calls and messages they receive. It also complements the Government’s efforts to combat scams. For example, the Police, upon detecting or receiving reports from the public on scammers who are using social media, e-commerce or messaging apps, will ask the platform operators to remove these accounts. In the first half of 2023, more than 10,000 WhatsApp lines and 1,500 online monikers and advertisements that were believed to be used in scams were flagged out by the Police for termination.

The Online Criminal Harms Act, which will be operationalised progressively from the first quarter of 2024, will allow the Police to tackle online scam activities more effectively. Specifically, it provides the Police powers to direct online services to prevent suspected scam accounts or content from interacting with or reaching Singapore users. Police can also require designated online services to implement systems, processes or measures to counter scams, such as requiring the verification of user identities against Government-issued identification documents.

Mr Derrick Goh asked whether ScamShield complements the malware detection apps used by banking customers. The short answer is yes.

Major retail banks have introduced anti-malware security features on their banking apps, which seek to protect banking customers by detecting the presence of malware on their devices, and triggering actions such as blocking access to the banking app. While ScamShield is not designed to detect or block malware, it complements the anti-malware security features on banking apps by protecting users from other attack vectors, namely scam calls and scam SMSes, hence, further mitigating the risk of users falling prey to scams.

Thank you, Mr Speaker. I thank the Minister of State for her reply. I have two supplementary questions. First, to encourage usage of ScamShield, would the Ministry consider working with the Ministry of Communications and Information and have the app pre-loaded on all new handphones? If the app is pre-loaded on new handphones, it would be easier for us to roll out educational campaigns to encourage all to use ScamShield, especially for our seniors.

Second, I understand that the Minister of State has shared that for scammers using social media, e-commerce and messaging applications such as WhatsApp, Facebook and Instagram, the Ministry of Home Affairs actually works with the developers to remove these accounts from these platforms. So, my question is, are they given a timeline as to how fast they are supposed to remove such scam accounts?

I thank the Member for his two supplementary questions. On the first question about pre-loading ScamShield, we have considered this before, but we have decided not to proceed. The reasons are as follows.

Firstly, not all users may consent to having ScamShield pre-loaded on their mobile devices.

Secondly, for ScamShield to work effectively, users actually have to set up permission settings. So, even if we were to pre-load the app, if the user does not know how to execute the permission settings, ScamShield will not be able to work effectively.

Thirdly, there is always a possibility that mobile users could deactivate or delete the app after we pre-load it.

So, for these considerations, we decided not to pre-load the ScamShield app, but we will keep this option open if our efforts to further encourage the download of the ScamShield app does not make progress.

On the second question, we work with the app developers as well as the platforms whenever we are informed about scams that are being perpetuated on social media platforms as well as other messaging applications. There is no fixed timeline in place, but we require the operators to remove the content as soon as possible. Sometimes, some of these platforms tell us that they require some time to investigate to make sure that on their end, it adheres to their community standards or that truly, they have conducted their investigations and that, it is, indeed, potentially a scam, and they would then need to go through their processes to remove the advertisement or the otherwise potential scam message.

So, because of these factors, there is no specific timeline that the Police has set out, but depending on the likely harm and impact, the Police would do what is within their powers to encourage the platforms to remove those scam messages as soon as possible.

Thank you, Mr Speaker. Can I ask the Minister of State to share if there are plans to upgrade ScamShield protection to cover other channels like emails, WhatsApp messages and, perhaps, malware, which the Minister of State said do not help in protection so far? The reason is, Mr Speaker, the Police have reported that we have already seen losses of $660 million last year and $330 million in the first half of the year. Apart from these losses are the emotional stress on victims. So, a positive reply would be appreciated.

I thank the Member for his question. We should see the use of ScamShield vis-à-vis all the other efforts that the Police together with stakeholders are implementing to prevent the scourge of scams from further impacting our community and society. ScamShield largely performs the function of crowdsourcing so that we know what are the reported scam numbers and scam messages that the Police would verify backend and then, block. But, as we know, there are other stakeholders who are involved. I have talked about how the telcos at the network level have effectively blocked 180 million scam calls at their level in the first half of 2023.

So, we have to look at the use of ScamShield together with all these other channels that we are using to prevent the scourge of scams from further impacting our community.

On the point of malware, the Member would note that in recent times, the major retail banks have already rolled out anti-malware applications via the digital banking apps. The Cyber Security Agency (CSA) has also shared a list of anti-malware security apps that members of the public could download on their own. Some of these apps are for free. So, we need to consider, apart from the ScamShield app, all these other initiatives that would be helpful to the public in preventing scams from further impacting society.

Mr Speaker, Sir, not every user of mobile phones are banking customers or mobile app users. So, to this point, would the Minister of State consider looking at a potential upgrade of ScamShield? And secondly, would the Minister of State consider further upgrades to ScamShield if further monitoring of existing initiatives do not work out as well?

I thank the Member for his questions. I shared in my main reply that, indeed, the GovTech team, specifically, is working on improving the ScamShield app. The current area that they are looking to improve is to increase the value proposition of the ScamShield app to users. For instance, a feedback we have received is that users are not aware if the ScamShield app is actually working in the background of their phones. The reason for that is because currently, ScamShield does not actively inform the user how many calls and SMSes have been blocked. The app works silently in the background. So, that is something that the GovTech team is working on.

Other potential improvements are about in-app reporting of malicious calls and SMSes to make it more user-friendly for users of ScamShield to be able to use it, rather than have to copy and paste the scam messages and to have additional steps when it comes to reporting.

These are the areas that the GovTech team is working on. We feel that it is through improvements in the features, functionality and the user experience of the app which would be key to enhancing the app's download rate.

On the point of malware, indeed, we are not just relying on the actions of the banks, we are not just relying on the digital banking apps of the banks to prevent malware. Indeed, I am aware that there could be mobile users who, unfortunately, download malware unsuspectingly, for instance, when they click on links that are tainted APK files, for instance.

From the perspective of cyber hygiene, this is something that the CSA is working on actively on the ground, together with digital ambassadors and the Infocomms Media Development Authority, to encourage better cyber hygiene practices, so that our members of society do not unwittingly download malware. We also promote messages such as ensuring that any downloads of apps should be done from the official App Store or Google Play Store, for instance.

You would also have read that there are other stakeholders such as the Central Provident Fund (CPF) Board, which has recently announced the default daily withdrawal limits, the CPF withdrawal lock, so on and so forth – all of which are other ways to prevent our population, our society and our members from losing their monies through scams.

I do not think we should see the use of the ScamShield app as the only channel and the only app that would prevent our members of society from becoming victims of scams. I would urge all of us to look at the suite of measures in its totality.