Singpass compromise scheme investigation (August 2026)

On 25 August 2026, the Singapore Police Force (SPF) arrested two men in a suspected coordinated scheme involving the compromise of Singpass accounts. SPF said the operation was conducted from 21 to 25 August with support from GovTech’s Singpass Trust & Safety team, following investigations into accounts linked to suspicious LiquidPay registrations (SPF, 26 August 2026). The release describes allegations and an ongoing investigation; an arrest or charge is not a conviction.

Alleged method and account scope

SPF said the suspected actors allegedly exploited mobile-phone-shop interactions to access customers’ Singpass credentials. In one example, a person allegedly offered to help update a mobile number linked to Singpass and then used the opportunity to create a LiquidPay account without the customer’s knowledge (SPF, 26 August 2026). The police identified at least 20 Singapore citizens and work permit holders under investigation for involvement in registering LiquidPay accounts that had reportedly received S$110,063 from various scams since early March 2026. These are investigation figures, not a finding that every person knew about or benefited from the activity.

Further investigation identified 171 Singapore citizens and foreign workers whose Singpass accounts were linked to the activity, and more than 160 additional LiquidPay accounts were reportedly registered without the account holders’ knowledge. SPF said all affected LiquidPay accounts had been frozen as of the release (SPF, 26 August 2026). The figures have different denominators: people under investigation, accounts linked to the activity, and additional e-wallet accounts; they must not be added together or read as a count of confirmed victims.

Charges and credential warning

SPF said the two arrested men were to be charged on 27 August 2026 for allegedly assisting another person to retain benefits from criminal conduct under section 51 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992. The release states that the offence carries imprisonment of up to 10 years, a fine of up to S$500,000, or both, subject to the court process and exact charge (SPF, 26 August 2026). SPF also warned that voluntarily disclosing Singpass credentials to facilitate an offence can carry a fine of up to S$10,000, imprisonment for up to three years, or both under section 8A(1) of the Computer Misuse Act.

The practical lesson is to protect Singpass passwords and two-factor-authentication details, and never allow an unknown person to use an account or credentials in exchange for quick money. Singpass is an authentication credential, not a permission to open an account or obtain a benefit; the destination service still applies its own checks. Users who suspect compromise should use official Singpass recovery and support channels and report suspected scams through ScamShield or the Police’s official reporting routes (SPF, 26 August 2026; GovTech, Singpass).

Status and interpretation

The police release says investigations into Singapore citizens and work permit holders who voluntarily relinquished Singpass credentials were ongoing. It does not establish that all 171 linked account holders were suspects, that every linked account was used fraudulently, or that the investigation represents all Singpass-related scams in Singapore (SPF, 26 August 2026). This event note records the dated enforcement update and its scope; the enduring role of Singpass belongs in national digital identity.