MyRepublic Mobile discussion thread

[lkneo66]

They lost IC numbers, but they didn't lose front+back images of your NRIC. It's not the same thing. Having the image implies they have the physical NRIC on hand (in order to take the photos), so that is taken as a higher level of checking.

With the actual image, a lot of things can happen. They can sign up for the most expensive plans online with it, might even be able to go to a loan shark and make out crazy loans. It's crazy, the range of activities that having your NRIC images can open up for them - not to mention they have your actual data - DOB and address are on the NRIC, credit card info is on file and was likely compromised, your mobile number is also compromised...

Hypothetically, they could probably even call in to terminate your line, or just set up a number porting out to the most expensive plans on other telcos on a 2year contact, for example. That's enough disruption for you. Then navigating all the hassle that comes with having to terminate the contact, to go to the police and to court and all - all could have been avoided if they didn't store the NRIC images on their server! This is something that having the NRIC number alone cannot do - you need the front/back image to do this.

Exactly. This is so scary. And we don't know when we will receive the surprise. It could happen after 6 months or 10 years later. How is the 6 months credit monitoring going to help? Pure irresponsible from Myrepublic!

 

[007Mi6]

They lost IC numbers, but they didn't lose front+back images of your NRIC. It's not the same thing. Having the image implies they have the physical NRIC on hand (in order to take the photos), so that is taken as a higher level of checking.

With the actual image, a lot of things can happen. They can sign up for the most expensive plans online with it, might even be able to go to a loan shark and make out crazy loans. It's crazy, the range of activities that having your NRIC images can open up for them - not to mention they have your actual data - DOB and address are on the NRIC, credit card info is on file and was likely compromised, your mobile number is also compromised...

Hypothetically, they could probably even call in to terminate your line, or just set up a number porting out to the most expensive plans on other telcos on a 2year contact, for example. That's enough disruption for you. Then navigating all the hassle that comes with having to terminate the contact, to go to the police and to court and all - all could have been avoided if they didn't store the NRIC images on their server! This is something that having the NRIC number alone cannot do - you need the front/back image to do this.

Well said.

My friend even can say that we all have digital footprint so no big deal. The last time I lost my NRIC, ah long, SH and others come and disturb me and it lasted for a good 5-6 years before it stopped.

One can even use your NRIC pictures to open trading account and do money laundering.

 

[firesong]

Exactly. This is so scary. And we don't know when we will receive the surprise. It could happen after 6 months or 10 years later. How is the 6 months credit monitoring going to help? Pure irresponsible from Myrepublic!

After this incident, I think IMDA should mandate that no storage of NRIC is to be done. and that all verifications must be done by Singpass MyInfo. A staff is to physically verify in person the ID card and the person, but not capture and store that data.

The NRIC number is unique and for life, unlike the passport that changes every 10 years now. So foreigners might still be able to use passport data as that has a 10 year validity and is not for life.

Most people have a Singpass account because it's near impossible to function in modern Singapore without one - and if you're signing up for a mobile line, you probably should use one of those. If no Singpass, then no mobile line or internet service.

 

[firesong]

Well said.

My friend even can say that we all have digital footprint so no big deal. The last time I lost my NRIC, ah long, SH and others come and disturb me and it lasted for a good 5-6 years before it stopped.

One can even use your NRIC pictures to open trading account and do money laundering.

It's this lackadaisical attitude towards security that is the inherent problem in Singapore and carries over to a lot of user habits. There is absolutely no concept of user privacy - as long as it's not their own being compromised. It's fine as long as it is someone else. There is no realisation that we're all in this together - it could very well be themselves or someone they know.

If it were their own data, they would be the first in line crying foul and demanding compensation and restitution.

Just look at all the chain posts/emails circulating, the information that people so joyfully put on TikTok and YouTube and Instagram and Facebook - it's why they want to support this lifestyle of being "influencers". But when you dig carefully, all that info can be used to answer typical security questions like : "What is your first car? Where is your first job? Where did your parents meet? Which street did you grow up on?" and so on... Anyway, it's their conscious choice - if they choose to put their lives out for everyone, we won't judge. However in this lapse, the majority of the victims do not want their info out there like this, trusting the company to protect their data because they have an obligation and duty to do so.

Even SMS 2FA is not secure now, since in Singapore we've had recent cases of numbers being hijacked (Singtel was one prominent one that made the news). But we don't see local companies and banks move to FIDO2 hardware tokens like the Yubikey and Google Titan or Feitan much. Some try using Webauthn but only to their own proprietary apps. They don't embrace existing security best practises fast enough, if at all.

And our government is not doing enough to tighten this kind of cybersecurity lapses. It's far too lax imo. The punishments need to be harsh if NRIC data is leaked, and even more so if full copies of the NRIC is leaked due to lapses. Right now it's not existent at all. Where are the regular security audits?

 

[007Mi6]

After this incident, I think IMDA should mandate that no storage of NRIC is to be done. and that all verifications must be done by Singpass MyInfo. A staff is to physically verify in person the ID card and the person, but not capture and store that data.

The NRIC number is unique and for life, unlike the passport that changes every 10 years now. So foreigners might still be able to use passport data as that has a 10 year validity and is not for life.

Most people have a Singpass account because it's near impossible to function in modern Singapore without one - and if you're signing up for a mobile line, you probably should use one of those. If no Singpass, then no mobile line or internet service.

The NRIC card is not unique, but the number is.

What we can do to mitigate would be to go to ICA and make a new NRIC card which have a new issue date.

 

[firesong]

The NRIC card is not unique, but the number is.

What we can do to mitigate would be to go to ICA and make a new NRIC card which have a new issue date.

They don't really verify the issue date

Most just look at your number and photo to check it is who you are. That's why in person verification can be done using any government photo ID, including the driver's license and Senior Citizen cards. If the MyInfo check already clears, turning up in person with a photoID is only a supplementary verification to confirm that. The MyInfo app checking is more the real deal imo, and since we're talking about real-time digital transactions here.

With the notifications sent to you that your MyInfo has been accessed each time, it is harder to run away from a fraudulent transaction.

This proposal already tightens a lot of existing loopholes while taking advantage of advances in government technology. Or rather, we're still doing sign ups the same way my dad signed up for his first mobile line in the 1980s - photocopy and store on file. Of course, if we're dealing with James Bond style espionage, there's a whole different ballgame to that. But this also far exceeds the normal levels of security.

 

[007Mi6]

They don't really verify the issue date

Most just look at your number and photo to check it is who you are. That's why in person verification can be done using any government photo ID, including the driver's license and Senior Citizen cards. If the MyInfo check already clears, turning up in person with a photoID is only a supplementary verification to confirm that. The MyInfo app checking is more the real deal imo, and since we're talking about real-time digital transactions here.

With the notifications sent to you that your MyInfo has been accessed each time, it is harder to run away from a fraudulent transaction.

This proposal already tightens a lot of existing loopholes while taking advantage of advances in government technology. Or rather, we're still doing sign ups the same way my dad signed up for his first mobile line in the 1980s - photocopy and store on file. Of course, if we're dealing with James Bond style espionage, there's a whole different ballgame to that. But this also far exceeds the normal levels of security.

Well, that’s the whole point of having a new NRIC issued. If they didn’t check and I am able to show my current new NRIC with new issue date, I am not accountable.

 

[hfngshnll]

Singtel also outsource to third party storage.

The personal information taken includes about 129,000 customers' NRIC numbers and a combination of names, dates of birth, mobile numbers and addresses, said Singtel.

https://www.channelnewsasia.com/sin...reach-customer-information-stolen-nric-356131

another earlier case was even more shocking. singtel own subsidiary in malaysia.

https://www.channelnewsasia.com/sin...sia-call-centre-singtel-jail-sell-data-631996
https://www.channelnewsasia.com/sin...entre-worker-customer-data-loan-sharks-264446
syrian & pakistani nationals working as customer care officers team leaders in malaysia call center selling singapore customer data that ended up with loan shark activities.

In 2017, Adnan's colleague, named only as Amy, told him that there was "an easy way to make money" and instructed him to send an email to an address and tell the recipient that he worked for Singtel.

both of them jailed in singapore, but this criminal syndicate mole Amy and her outside syndicate boss was never charged. maybe this syndicate is now buying data again.

imagine what else unknown is going on in all the companies, big telcos & small MVNOs. porting around to more companies mean even more risk exposures.

 

[firesong]

Well, that’s the whole point of having a new NRIC issued. If they didn’t check and I am able to show my current new NRIC with new issue date, I am not accountable.

The issue date is not a required field to check. The staff have no way of knowing or checking that the NRIC you are holding is the latest one issued to you.

This is actually why I said that Singpass MyInfo remains the only way to have real-time verification for the latest info since it polls your central records. It reduces the dependency on the PhotoID document because that becomes secondary, only in confirming that you are the person.

 

[Pocoyoz]

MAS should allow ppl to apply credit freezes and fraud alerts for free.
cbs sg option looks primitive

 

[Ctrl_Alt_Del]

For one, apply for Telco plans with device?? Maximum 5 lines per NRIC.... then run road upon receiving the device without paying monthly subscription, ruining your credit ratings meanwhile.

Apply new line need to verify physical nric with delivery man or at telco counter for the sim card?

 

[SibehHL]

Apply new line need to verify physical nric with delivery man or at telco counter for the sim card?

Can apply online and deliver to POP Station..... Ah Long also don't care as long as you give NRIC photocopy when borrowing $$ but anyway, if one think its no problem then it will be no problem... until problem comes the kpkb

 

[firesong]

Can apply online and deliver to POP Station..... Ah Long also don't care as long as you give NRIC photocopy when borrowing $$ but anyway, if one think its no problem then it will be no problem... until problem comes the kpkb

The popstations are monitored by camera though... But I suppose a person who does not want to be caught could be wearing a darth vader suit or something to collect the phone.

I think the point is, current systems are not secure enough, and we can easily think up ways to get around the checks because of the compromised NRIC photos. I'm sure people can think up more ways to abuse it.

Which goes back to the roots of the problem - it should never have been leaked.

 

[Ctrl_Alt_Del]

Can apply online and deliver to POP Station..... anyway... Ah Long don't care as long as you give NRIC photocopy when borrowing $$

My experience with apply new line or port number online, submit photo of nric online but all required to verify physical nric to collect Sim card.

 

[crystalnox]

My experience with apply new line or port number online, submit photo of nric online but all required to verify physical nric to collect Sim card.

Some MVNOs which provide SIM deliveries, don't really bother even though they are suppose to.

 

[GuiGuZi]

MAS should allow ppl to apply credit freezes and fraud alerts for free.
cbs sg option looks primitive

Myrepublic should offer lifetime credit alerts. They should also monitor the dark web forever and do whatever possible to prevent the spread. Their cybersecurity team and internal audit should be punished or sacked for not doing their job.

All these are reasonable to me as a victim, as the potential harm is lifetime and there is nothing I can do to prevent it other than constantly monitoring my accounts for the rest of my life. But to them as a company, they just want to pay 6 months credit monitoring service, and maybe a fine from PDPC and continue their businesses with it. I hope they have their own karma.

 

[Pocoyoz]

Read HWZ Forum Rules!

 

[Ctrl_Alt_Del]

Some MVNOs which provide SIM deliveries, don't really bother even though they are suppose to.

Is there anyway for us to check how many lines registered with our nric?

 

[Pocoyoz]

do they provide cbs subscription to all those whose info had been leaked or the service is only for current subscribers?
seems like they also leak the previous owner detail if one had change the ownership when port in.

has anyone receive confirmation after accepting the offer?

 

[Habrosus]

Is there anyway for us to check how many lines registered with our nric?

My guess would be existing users can use their app, while the rest will have to call?