At least $180k lost to Carousell buyer phishing scam: Police

Scammers have swindled at least $180,000 from Carousell sellers since July, with at least 63 cases reported.

The police warned in a statement on Friday (Oct 23) that scammers are posing as interested buyers to trick victims into giving their personal banking details.

First, victims are persuaded to continue the conversation on other messaging platforms including WhatsApp and Telegram.

Then, scammers send a "Carousell invoice" in a PDF file format, containing a QR code and a link to supposedly facilitate payment or to confirm the transaction.

In some cases, scammers sent an additional link using the "carousell.app.link" domain to create a sense of trustworthiness.

Once victims scan the QR code or click the link in the file, they would be directed to a fake Carousell website and guided by a chatbot to supposedly verify their bank account to receive payments.

Victims would subsequently be directed to a phishing website mimicking a bank's website and prompted to provide their internet banking credentials, card details, OTP and/or approve digital token notifications.

They would later discover unauthorised transactions made from their card or bank accounts, including transfers to overseas cards.

Members of the public are advised to remain vigilant and adopt the ACT (Add, Check, Tell) framework, which includes adding the ScamShield app and enabling security features.

Those who suspect they have fallen victim to a scam should contact their bank immediately to report and block fraudulent transactions and lodge a police report.

For more information on scams, members of the public can visit the ScamShield website at www.scamshield.gov.sg

lim.kewei@asiaone.com

自 7 月以来，诈骗分子已从 Carousell 卖家手中骗取至少 18 万美元，目前已报告至少 63 起案件。

警方在周五（10 月 23 日）的一份声明中警告说，诈骗分子冒充感兴趣的买家，诱骗受害者提供个人银行详细信息。

首先，受害者会被说服在其他通讯平台（包括 WhatsApp 和 Telegram）上继续对话。

然后，诈骗者会发送一个 PDF 格式的“Carousell 发票”，其中包含一个二维码和一个链接，据称是为了方便付款或确认交易。

在某些情况下，诈骗者会使用“carousell.app.link”域名发送额外的链接，以营造一种值得信赖的感觉。

受害者一旦扫描二维码或点击文件中的链接，就会被引导到一个虚假的 Carousell 网站，并由聊天机器人引导他们验证银行账户以接收付款。

受害者随后会被引导至一个模仿银行网站的钓鱼网站，并被要求提供他们的网上银行凭证、银行卡详细信息、一次性密码和/或批准数字令牌通知。

他们后来会发现自己的银行卡或银行账户被进行了未经授权的交易，包括向海外银行卡转账。

建议公众保持警惕，并采用 ACT（添加、检查、告知）框架，其中包括添加 ScamShield 应用程序并启用安全功能。

怀疑自己成为诈骗受害者的人应立即联系银行，举报并阻止欺诈交易，并向警方报案。

如需了解更多有关诈骗的信息，公众可访问 ScamShield 网站 www.scamshield.gov.sg。

lim.kewei@asiaone.com