SINGAPORE – Thirteen people, including a 16-year-old, were arrested for their suspected involvement in the recent spate of banking-related malware scams.

Preliminary investigations showed that 10 of the 13 suspects, aged between 16 and 27, had allegedly facilitated the scams by sharing their bank accounts, Internet banking credentials and/or disclosing Singpass credentials for monetary gains.

The rest – three men aged between 20 and 35 – are believed to have withdrawn cash from some of the money mules’ bank accounts and handed it to unknown persons.

They were arrested in an islandwide anti-scam enforcement operation conducted between June 26 and 30 by officers from the Commercial Affairs Department (CAD) and Police Intelligence Department (PID), the police said in a statement on Saturday.

Investigations are ongoing. Another 10 people – nine men and a woman, aged between 17 and 65 – are assisting in the investigations.

Since January, the police have received an increasing number of reports about malware being used to compromise Android mobile devices, resulting in unauthorised transactions made from the victims’ bank accounts even though they did not share any sensitive information regarding their bank or Singpass accounts.

The victims were instead found to have responded to advertisements for cleaning services, pet grooming and food items on social media platforms such as Facebook.

The scammers later instructed the victims to download an “Android Package Kit” from an unofficial app store to facilitate the purchase, leading to malware being installed on the victims’ mobile devices.

The scammers also told the victims via phone calls and text messages to turn on accessibility services on their Android phones.

By doing this, a phone’s security features are weakened, and this allows the scammers to control the phone, such as being able to log every keystroke and steal banking credentials stored in the phone and to remotely log in to the victim’s banking apps, add money mules as payees, raise payment limits and transfer monies out to money mules.

The scammers can further delete SMS and e-mail notifications of that bank transfer to cover their…