Android users who come across Facebook or TikTok advertisements for goods and services that offer them an option to leave their contact details to indicate their interest have to be careful.

It could be scammers looking to lure victims into installing malicious apps on their devices, the police said in a release on April 17.

At least 128 cases of a new variant of e-commerce scams have been reported in Singapore since February 1 this year, with victims losing at least $2.4 million in total, police said on Monday, April 15.

Android users who come across Facebook or TikTok advertisements for goods and services that offer them an option to leave their contact details to indicate their interest have to be careful. It could be scammers luring victims into installing malicious apps on their devices, police said in a release on Monday.

After victims leave their contact details to indicate their interest in particular goods or services on a Facebook or TikTok advertisement, scammers would contact their victims through WhatsApp messaging and request a token sum as membership fee payment or an upfront deposit to be made via a URL link.

After the victims enter the payment website and key in their credit or debit card or i-banking login details, they would encounter payment issues.

To resolve the problem, scammers would deceive the victims into downloading a malicious app, in an Android Package Kit (APK) file format, sent through WhatsApp.

The malware would allow scammers to remotely access the victims’ devices to steal sensitive information such as SMS OTPs when the victims try to make payment for the membership fee or deposit.

After having obtained the victims’ card details and access to their SMS OTPs, scammers would perform unauthorised card transactions either from the victims’ mobile devices or their own.

In some cases, before downloading the malicious APK file, victims would also be guided to disable their Google Play Protect that helps to prevent harmful downloads.

Once Google Play Protect is disabled, victims would not receive alerts that there is malware introduced into their mobile phones.

Victims may also be asked to download virtual private network (VPN) apps to circumvent the bank’s anti-malware measures.

Scammers would then be able to bypass the banking anti-malware measures and remotely access the victims’ banking accounts with the phished i-banking login credentials.

To prevent falling victim to such scams, members of the public are advised to disable “Install Unknown App” or “Unknown Sources” in your phone settings and do not grant permission to persistent pop-ups that request access to hardware or data on your devices.

Download and install apps only from official app stores like the Google Play Store and be wary if you are asked to disable Google Play Protect or download unknown apps.

In 2024, scam victims in Singapore lost a record high amount of $1.1 billion, compared to $933 million in 2023, according to police data released on Monday.

In total, victims in Singapore have lost more than $3.4 billion to scams since 2019.

The figures come amid a rising tide of scams in the Southeast Asian nation, with police warning that scammers are becoming increasingly sophisticated in their methods.

Among the most common types of scams are investment scams, love scams and e-commerce scams.

Investment scams saw the biggest increase in 2024, with losses more than doubling from $276.8 million in 2023 to $606.1 million in 2024.

Love scams also saw a significant rise, with losses increasing from $163.4 million in 2023 to $246.9 million in 2024.

E-commerce scams saw a smaller increase, with losses rising from $425.3 million in 2023 to $429.6 million in 2024.

Despite the overall increase in scam losses, the number of cases fell from 20,600 in 2023 to 15,046 in 2024.

This suggests that scammers are becoming more successful at targeting victims and defrauding them of larger sums of money.

The police are urging members of the public to be vigilant and to report any suspected scams.