SINGAPORE – Nine people will be charged on Tuesday for their suspected involvement in money laundering activities linked to a recent spate of phishing scams involving malware-infected apps.

Six adults, aged 19 to 30, and three teenagers, aged 16 to 18, had bank accounts that were used to launder the criminal proceeds from scams.

They had handed over their banking login details or their Singpass credentials to others in exchange for cash or to be used for putative investment opportunities.

They were arrested after being identified as money mules linked to recent scams the police were investigating.

Victims of the scams had reported unauthorised transactions and losses from their bank accounts, even though they did not divulge their Internet banking credentials, One-Time-Passwords or Singpass credentials to anyone.

In these cases, victims responded to advertisements for cleaning services and food items via WhatsApp and Facebook. Scammers then instructed them to install apps downloaded from non-official app stores to facilitate the purchase, causing malware to be installed on the victims’ mobile devices.

The scammers would convince the victims via phone calls or text messages to turn on accessibility services on their Android phones, weakening the phones’ security.

Scammers then took full control of the phones – logging every keystroke, stealing banking credentials stored on the phones to remotely access the victims’ banking applications, adding money mules as payees, raising payment limits and transferring money out to money mules.

The scammers could also delete SMS and e-mail notifications of the bank transactions to cover their tracks.

The police said the nine suspects’ involvement as money mules were revealed through follow-up investigations. They were subsequently arrested by Commercial Affairs Department officers.

In July, a 16-year-old male teenager responded to an advertisement on messaging platform Telegram offering fast cash. He later opened a bank account and disclosed his Internet banking credentials to an unknown person.

That same month, a 27-year-old man handed over his Internet banking credentials and ATM card to an unknown person who had offered him cash in return for using his bank account.

A 19-year-old woman also agreed to disclose her Singpass credentials to a friend on Instagram who requested it to open an investment account. Five new bank accounts were later opened without her knowledge.

Between July and August, a 28-year-old man responded to online job advertisements which offered fast cash in return for using his bank accounts. He then handed his existing Internet banking credentials to an unknown person on Telegram, and three new bank accounts were later opened without his knowledge.

He also opened three more bank accounts online and disclosed the Internet banking credentials to an unknown person on Telegram.

In August, a 22-year-old man agreed to disclose his Singpass credentials to an unknown person on Telegram after responding to an online advertisement for a fast cash opportunity. Four new bank accounts were later opened without his knowledge.

A 19-year-old man responded to a similar advertisement on Telegram that month and opened a bank account online. He then disclosed his Internet banking credentials to an unknown person on Telegram and three new bank accounts were opened without his knowledge.

In September, a 30-year-old man handed over his Internet banking credentials and ATM card to an acquaintance who offered him cash in return for using his bank account.

A 17-year-old girl also handed over her Internet banking credentials and ATM card to an unknown person who also offered her cash in return for using her bank account.

Another case that month involved an 18-year-old woman who disclosed her Singpass credentials to an unknown person on Telegram after responding to an advertisement for a cryptocurrency investment. She later received several SMS notifications from the banks, and three new bank accounts were opened.

For disclosing Singpass credentials, first-time offenders can be jailed up to three years, or fined up to $10,000, or both.

Those found conspiring to cheat banks into opening bank accounts can be jailed up to three years, fined, or both.

First-time offenders who assist unknown individuals in gaining access to banks’ computer systems can be fined up to $5,000, jailed up to two years, or both.

The police advised the public to always reject seemingly attractive offers promising fast and easy payouts for the use of their Singpass and bank accounts.