While trying to claim an attractive deal for Peking duck, a 74-year-old man was tricked by scammers into downloading a malicious app on his phone to place the order.

However, after he made a S$5 PayNow "deposit" via the app, the scammers took over his Android phone and raided his DBS and POSB bank accounts instead.

The victim, surnamed Loh, lost about S$70,000 of his life savings that very afternoon.

Asked to download app to place order, make S$5 PayNow deposit

Loh told Shin Min Daily News that on Aug. 26, he came across a Facebook advertisement by a roast duck supplier named "Xiao Xiao Ya Zi", promoting the Chinese delicacy.

The deal offered him 1.5kg of Peking duck for a price of S$23.80, with an additional S$5 delivery fee.

Loh shared with Shin Min that he wanted to order the dish for a family meal, as his grandsons liked eating it.

As such, he reached out to the seller on WhatsApp to indicate his interest.

The seller subsequently texted him on WhatsApp and instructed him through voice messages to download a third-party app called "Grab & Go" on his phone.

Loh complied and accessed the app, which apparently displayed pictures of the dishes he could order.

He was prompted on the platform to make a S$5 payment through PayNow as a "deposit", before he could place the order.

'No one would be cheated of S$5': Scammer

Loh, who used to work as an importer, also told The Straits Times that he had his suspicions about the ad, and raised them to the seller.

However, the other party assured him that the promotion was not a scam.

"He said that no one would be cheated of S$5 and that this was a small thing. He told me that I had a lot of wisdom and experience," Loh told ST.

As such, Loh decided to go ahead and make the deposit, thinking "this was a matter of only S$5".

Phone restarted many times, unable to access functions

However, within minutes, Loh's phone screen went blank.

Over the next half an hour, it restarted multiple times.

Loh attempted to close the app and turn off his phone, but was not able to access those functions.

Anxious, he reached out to the scammer, but the person reassured him that the phone reset was "normal".

Lost S$70,000 life savings to scammers

At this stage, Loh's wife overheard their conversation.

Suspecting something was wrong, she called their daughter and then roped in her brother to call DBS Bank urgently.

However, it was too late.

The bank told the family that scammers had raised Loh's transaction limit, from its original limit of S$3,000.

According to the bank, the scammers transferred about S$59,000 out of Loh's DBS current account and POSB savings account.

They also made a credit advance of S$11,000 on his DBS credit card.

This was money that he had set aside for retirement and medical expenses, Loh said.

He reached out to DBS for help and also lodged a police report the next day on Aug. 27.

According to ST, the police confirmed that a report was lodged and investigations are ongoing.

Angry about being cheated: Victim

Loh blames himself for falling into the scammer's trap.

"These were my hard-earned savings I accumulated over more than 10 years. At that point [when I knew I had been scammed], I was so angry at myself." Loh admitted to Shin Min.

"I used to be a businessman and got to see the world, so I never thought I would get tricked like this," he added.

Loh also claimed he did not receive any notifications after the scammers raised his funds transfer limits.

"I know that some banks require a 12-hour cooling-off period when there is an increase in funds transfer limits. But for my case, they were changed immediately without my knowledge," he said.

Mothership also understood that when scammers seize control of a victim's phone, they may be able to delete such notifications or prevent them from appearing on the screen.

Since the incident, Loh has changed to a new mobile phone, and deleted his Facebook and internet banking apps.

He also told Shin Min that he does not dare to pick up calls from unknown numbers in the future.

New anti-malware tool rolled out: DBS

In response to Mothership's queries, a DBS spokesperson stated that the bank has since rolled out a new anti-malware tool that prevents scammers from fraudulently logging into customers’ digibank accounts.

The tool restricts access to the banking app when it detects potential security risks, such as unverified or malicious apps, or ongoing screen-sharing on the customer's phone.

Customers will not be able to access DBS and POSB digibank until they have taken the necessary steps to secure their phones, the spokesperson added.

Customers can call fraud hotline, freeze accounts: DBS

The spokesperson also highlighted two ways that customers can protect themselves from a suspected scam.

One is to call the DBS dedicated fraud hotline at 1800-339-6963 (from Singapore) or (+65) 63396963 (from overseas) and speak to a customer service officer.

Another way is to activate the safety switch function via digibank to temporarily block access to their funds.

"When a customer falls prey to a scam, we have dedicated resources in place to act swiftly and assist. We will assist these customers with necessary follow-up actions, which include making a police report, or replacing their cards and resecuring their accounts," the spokesperson said.

Rise in malware scams

Malware-enabled scams, where victims are cheated after downloading malicious software onto their phones, are on the rise in 2023.

Victims are typically tricked into downloading apps to pay for goods and services advertised on social media, which range from durians to beer.

There were more than 750 of such cases in the first half of 2023, resulting in at least S$10 million lost.

In August 2023, OCBC Bank rolled out a new security update that prevents customers from accessing the OCBC digital banking app if unofficial third-party apps are installed on their phones.

And in September, DBS, UOB and Citibank followed suit with similar security measures to combat scams.

Top image adapted from Shin Min Daily News.