How scammers move a victim across apps before anyone can stop them

According to Mediacorp, Singapore's Minister for Digital Development and Information Josephine Teo laid out how a scam actually travels across a person's devices and accounts before anyone intervenes. The description, given at Singapore International Cyber Week, is less about a single trick than about a route.

A victim may first encounter a scam on social media. From there the contact moves to a messaging platform. Then comes a phone call. The final step is a transfer of money through a financial institution. Mrs Teo said each stage offers a chance to intervene, but no single defender sees the whole chain.

The handoff is the mechanism

This is what the scam depends on: no platform sees more than its own piece of the interaction. The social media company sees the first contact and nothing after. The messaging app sees the conversation but not the social media origin or the eventual bank transfer. The bank sees a transfer but not the months of messages that led to it. A scam built to cross four different systems exploits the fact that none of those systems talks to the others.

Mrs Teo said this is why stopping scams one organisation at a time is not enough. Her words: “It is therefore not enough to make every organisation better at stopping scams. We must also connect our defences so that a single signal detected on one part of the ecosystem can trigger action elsewhere.”

What Singapore is building against it

GovTech is working with Google DeepMind on real-time detection of AI scams directly on a person's device, aiming to catch signs of manipulation without needing to read or store a person's private messages elsewhere. Mrs Teo said this could offer stronger protection while keeping personal messages on the device itself: “If our devices can recognise signs of manipulation early, we can help potential victims avoid financial or credential loss, while keeping their personal messages on their devices.”

Separately, GovTech and the Singapore Police Force already run the Scam Analytics and Tactical Intervention System, which uses AI to scan and assess more than 600,000 websites every day. It disrupts around 20,000 malicious websites every month and has expanded to cover suspicious mobile numbers and online platforms as well.

The tell for a reader

The pattern described is a conversation that migrates. It starts somewhere public, like a social media comment or message. It then asks to continue somewhere more private, like a messaging app. It builds over time before any money is mentioned. Only at the end does a phone call or a payment request arrive. That migration itself, being moved off the platform where contact first happened, is the point in the sequence where a stranger's intent is hardest for any single company to see and easiest for a person to notice.

Mrs Teo also flagged a longer-term risk: quantum computers that could eventually break current encryption protecting financial transactions and sensitive communications. She said bad actors may already be stealing encrypted data now, to decrypt later once the technology catches up.