Enough is enough: nearly $2.2 million lost within weeks, and the method is alarmingly simple. A wave of impersonation scams riding on Apple6s iMessage has targeted Singapore residents and small businesses, pretending to be familiar couriers such as NinjaVan, J&T Express and SPX Express, and even mimicking government and bank communication. The result is financial devastation, confusion and a sense of violation that cuts deep for owners already stretched thin.
What the scam looks like
Messages arrive from phone numbers with foreign country codes or from addresses made of random alphanumeric strings. They look legitimate at first glance, often containing links that mimic real courier or agency URLs. In some cases recipients are coaxed into replying with a single character such as ‘Y’ or ‘1’. That reply, deceptively trivial, can remove iMessage6s built-in protections and let links become active.
Click the link and the trap snaps shut. A convincing fake website appears, almost identical to the real courier or financial institution portal. The visitor is told to pay a small fee to release a package or settle a fine. Payment requires credit card details, internet banking credentials and authorization with digital tokens. After that, cards can be added to Google Pay or Apple Pay, bank tokens can be set up on unfamiliar devices, and unauthorised transactions and logins follow.
Anecdote that hits home
A small bakery owner in Bedok received a message one morning: ‘Your parcel could not be delivered. Click to pay S$3.50.’ The owner, juggling orders and staff, asked an assistant, ‘Did you click on that link?’ The assistant replied, ‘Yes, it looked like NinjaVan.’ Within hours the bakery6s business account showed multiple unrecognised authorisations, and a credit card linked to the account was found in a digital wallet on a phone that had never been seen before. The emotional fallout was worse than the numbers. Panic, sleeplessness, and the erosion of trust between staff and management followed—because the attack exploited everyday haste.
Why this is particularly dangerous for SMEs
- Operational stress lowers vigilance. Staff respond quickly to parcel messages, price quotes and urgent notices; attackers count on that.
- Small businesses often share payment instruments across staff and systems, so a single compromise can ripple wide.
- Incident response resources are scarce. Calling a bank, freezing cards, and reissuing tokens is time-consuming and costly.
Concrete actions that must be taken immediately
This is not optional. Every business must adopt these defenses now:
- Treat every unsolicited iMessage about parcels, fines or account problems as suspicious. Government agencies and couriers do not use iMessage to collect payments or verify credentials.
- Never reply with ‘Y’ or ‘1’ to unknown messages. That single keystroke is a common trick to enable malicious links.
- Verify via official channels. Call the courier’s published number, log in through a bookmarked official website, or contact the relevant agency through the contact points listed on official sites.
- Disable automatic payment method linking and monitor the digital wallet for additions or new devices. If a card appears in Google Pay or Apple Pay without consent, notify the bank immediately and request a freeze.
- Review banking device authorisations. Remove unfamiliar devices and reset digital tokens if there is any hint of compromise.
- Train staff with short, practical simulations. A 10-minute weekly briefing beats a day of damage control later.
When compromise happens
Act fast and act calmly. Contact the bank to block or cancel affected cards, revoke device authorisations, and request an investigation for unauthorised transactions. Report the incident to the police via 1800-255-0000 or at www.police.gov.sg/i-witness. Document every step: screenshots, timestamps, and the exact message text. These records matter.
Longer-term hardening
Security is not a luxury; it6s part of doing business. Implement two-factor authentication that does not rely solely on SMS or on easily cloned tokens. Maintain separate payment cards for staff and vendors with strict permissions. Apply the principle of least privilege: give staff only the access required for their role. Budget for simple controls: regular backups, device inventories, and an incident playbook. Insurers and banks increasingly ask for demonstrable security measures before providing fraud relief—so prevention pays.
Final note: refuse complacency
Allowing a message to dictate action is a vulnerability. Every quick click, every casual ‘yes’ typed to an unknown sender, is an invitation to theft. The recent spike in impersonation scams on iMessage is not a momentary wave; it6s a pattern that will be iterated and refined until businesses harden their practices. Spread this knowledge. Run the drills. Tighten the controls. Do not hand over credentials or tokens through links, no matter how convincing. For help, report incidents to the police at 1800-255-0000 or via www.police.gov.sg/i-witness, and involve banks and payment providers immediately.
Confront the problem with urgency and discipline. That is the only honest way to keep operations running and financial losses from spiralling.