Your phone rings. The caller knows your full name, your bank, and the last four digits of your NRIC. They sound official. They have just enough detail to seem legitimate. That detail almost certainly came from data you never knowingly shared. In Singapore, this is not a hypothetical. Targeted scams are growing more precise because the raw material , your personal data , is already circulating online, often without your knowledge.
Scammers do not guess. They research , and your data may already be their starting point.
- Data breaches, public records, and social media posts feed into detailed personal profiles that scammers trade and exploit.
- Attacks like SIM-swap and spear-phishing rely on knowing specific details about you, not just targeting random people.
- Auditing your own digital footprint is the first concrete step to cutting off that information supply before damage is done.
How Scammers in Singapore Build a Profile on You
Most people imagine scammers sending mass emails hoping someone clicks. That still happens. But the more damaging attacks are the targeted ones, where the scammer already knows who you are before they make contact.
The building blocks come from three main sources. There are data breaches. Singapore has seen numerous breaches over the years, from healthcare platforms to e-commerce sites. Each breach can expose email addresses, passwords, phone numbers, and sometimes even identification numbers. Public records also play a bigger role than most people realise. Property transaction data, company directorship records, and court filings are often accessible to anyone who knows where to look. Social media fills in the gaps. A LinkedIn profile reveals your employer, job title, and career history. Facebook might show your family connections, neighbourhood, and recent travel. Instagram can tell someone where you eat, where your kids go to school, and roughly when your home is empty.
Put those three together and a scammer has enough to craft a message that feels personal. That is exactly what makes modern social engineering so effective.
The Types of Data That End Up in the Wrong Hands
Not all leaked data carries the same weight. Some categories open doors to financial fraud immediately. Others are used to make a scam message sound credible. Knowing what is out there helps you understand your actual risk level.
- Credentials: Email and password combinations from old breaches are bought and sold on dark web marketplaces. If you reused a password, a breach from five years ago can still compromise accounts you use today.
- Contact details: Phone numbers and home addresses are used to initiate calls, send SMS phishing messages, or verify identity during SIM-swap attempts.
- Financial identifiers: Partial card numbers, bank names, and account details surface from breaches of retail or payment platforms and give scammers the credibility hook they need.
- Government ID fragments: NRIC numbers or partial identification details can be used in impersonation scams targeting government services or financial institutions.
The Cyber Security Agency of Singapore has documented multiple cases where aggregated personal data was the foundation for targeted phishing campaigns against both individuals and businesses. The pattern is consistent. Attackers piece together what is publicly available before they ever make contact.
Running a Scan to See What Is Already Out There
Most people avoid this step because they fear what they might find. That fear is understandable, but ignorance does not protect you. Knowing what is exposed gives you the power to act before a scammer does.
A practical starting point is to run a personal data scan to see what information is already circulating about you online. This kind of tool checks your digital footprint across various data sources and gives you a clearer picture of your exposure. Think of it as looking at yourself the way a scammer would.
Beyond that, check whether your email address has appeared in known data breaches. Search your own name across different search engines, including image search, and see what surfaces. Look at what your social media profiles reveal to someone who does not follow you. Many people are surprised by how much is visible to strangers by default.
Pay close attention to what combinations of information appear together. A phone number alone is inconvenient. A phone number paired with your bank name and employer is what gives a scam call its dangerous credibility.
How Scammers Turn Leaked Data into Specific Attacks
Three Common Attack Types and Their Data Requirements
| Attack Type | Data Scammers Need | How to Reduce Your Risk |
|---|---|---|
| Spear-phishing email or SMS | Name, employer, bank name, recent transaction or account details | Remove or restrict what is publicly visible on LinkedIn and social media profiles |
| SIM-swap attack | Phone number, NRIC fragment, date of birth, answers to common security questions | Add a SIM lock with your telco and never post your full date of birth publicly |
| Impersonation scam (government or bank caller) | Name, partial NRIC, bank or insurance provider, home address | Submit data removal requests to people-search sites and use a secondary contact number where possible |
Each of these attacks depends on data that is often already available through breaches or public sources. The scammer’s advantage is that most people do not know what is out there about them. That information gap is precisely what you close by auditing your own footprint first.
What to Do Once You Find Exposed Data
Finding that your data is exposed is not the end of the story. It is the beginning of a remediation process. The goal is to reduce both the amount of information available and the damage a scammer could do with what remains.
Start with your accounts, because compromised credentials are the most immediate threat. Change any password tied to an email address that has appeared in a breach, and stop reusing passwords across services. Turn on two-factor authentication using an authenticator app rather than SMS where possible, since SMS-based codes are vulnerable to SIM-swap attacks. Review which apps and services have access to your primary accounts, and revoke anything you no longer use actively.
Next, address the public-facing data. Review your social media privacy settings on every platform you use. Lock down your profile so strangers cannot see your contact details, workplace, or family connections. Delete old posts that contain personally identifying information, such as a photo of your NRIC, your home address in a delivery complaint, or a phone number posted years ago.
- Request data removal: Contact data broker sites that aggregate personal records and submit removal requests. This is tedious but genuinely reduces the pool of data available to bad actors.
- Contact your telco: Ask them to add a verbal PIN or SIM lock to your account. This makes it significantly harder for someone to port your number using stolen identity details.
- Set up breach monitoring: Use services that alert you when your email or credentials appear in a new data leak. Early warning gives you time to act before the damage reaches your live accounts.
- Fix your security questions: Change the answers on any account that uses security questions to random strings rather than real personal details. The answer to “what was your first school” is often findable through public posts. A random string is not.
None of these steps require technical expertise. They require time and deliberate attention. The return on that time is meaningful, because each step removes one more lever that a scammer could pull against you.
Your Exposure Is a Moving Target, Not a Fixed State
Here is the uncomfortable truth. Data exposure is not a one-time problem you fix and forget. New breaches happen regularly. Old data gets resold and repackaged into fresh databases. The social media post you made three years ago is still indexed somewhere. Your details can re-enter circulation through a new service you signed up for or a third-party vendor your bank or insurer uses.
Checking your exposure should be a habit, not a one-off task. Build it into your calendar the same way you would a password update or a device software check. Quarterly works for most people. For higher-risk individuals such as business owners, public figures, or anyone who has experienced identity theft before, monthly checks are more appropriate.
The scammer’s advantage is always speed and information. They move fast once they have what they need. Reducing the volume and freshness of your exposed data slows them down and often redirects them toward easier, less-prepared targets.
Turn the Tables Before the Call Comes
The most effective moment to act is before any scammer reaches out. Waiting until after a suspicious call, a strange login attempt, or a bank alert means the attacker already has a head start. The steps covered above shift that dynamic. You assess your own exposure, close the obvious gaps, and put monitoring in place so you receive the alert instead of dealing with the aftermath.
Singapore’s scam environment is sophisticated. The people behind these schemes are patient, methodical, and often very well informed about their targets. But that information did not appear from nowhere. It came from somewhere you touched digitally, sometimes years ago. Taking control of that footprint is how you take back the advantage.
Start with the scan. See what is out there. Then work through the remediation steps, item by item. You do not need to complete everything at once. Progress is what matters, because every piece of data you pull back is one less tool in a scammer’s hand the next time your phone rings.