News
Mediacorp reports that financial comparison site MoneySmart had names, emails and some reward reference numbers copied by an unauthorised third party.
Reported by
MediacorpMoneySmart, the financial comparison site used across Singapore and Hong Kong, has had customer data copied by an outside party. As reported by Mediacorp, names, email addresses and, for some customers, shipping addresses and reference numbers were taken. If MoneySmart contacts you about this, do not click any link in that message; go to its website directly or call your bank using the number on your card.
The breach itself did not take money. It took the material a follow-up scam needs to sound convincing. MoneySmart discovered on October 29 that an unauthorised third party had accessed some of its internal IT systems. Those systems held names and email addresses that customers share when comparing or applying for financial products. For customers who had submitted reward claims, the shipping address and the application or policy reference number for that product were copied too.
That reference number is the detail that matters most. A stranger emailing about a delivery is easy to ignore. A message that quotes the exact product someone applied for, or the exact reward they claimed, reads as legitimate because it has information a random sender should not have. The scam this data enables does not need to guess. It can open with a fact that is already true, then ask for something false: a confirmation of details, a small fee to release a delivery, a click to track a reward.
MoneySmart chief executive Vinod Nair said the company is contacting affected customers directly to explain what was taken and what to do next. That direct contact is itself a target for impersonation. Anyone can send an email that looks like it comes from MoneySmart once the company has publicly confirmed a breach happened and reward claims were involved. The safest response is to treat any message about this incident as unverified until checked through MoneySmart's own website, not through a reply, link or number the message itself provides.
MoneySmart has informed Singapore's Personal Data Protection Commission and engaged independent cybersecurity and forensics experts. CNA asked the company how many customers were affected; the company responded by forwarding the same public statement, which does not answer that question.
Received something like this? Paste it into the Flggd message checker before you reply, click or pay.
