Police warn of rise in unauthorised cryptocurrency account access through compromised emails

Police warn of rise in unauthorised cryptocurrency account access through compromised emails Several of the email accounts involved had previously appeared in data breaches on other platforms, the police said. SINGAPORE: The police have warned of a recent trend involving the unauthorised access of cryptocurrency accounts through compromised email accounts. The Singapore Police Force (SPF) said on Saturday (Sep 12) that it has observed an increase in such cases since mid-August. Investigations found that several of the affected email accounts previously appeared in data breaches on other platforms, suggesting that the victims' credentials may have been exposed. “Perpetrators may have exploited this by using the compromised email credentials to access victims’ cryptocurrency accounts, taking advantage of victims who reused the same passwords across multiple online services,” SPF said in a news release. In such cases, scammers might have searched the victims' email accounts to identify the cryptocurrency platforms or exchanges they used. They may also create inbox rules to automatically archive, forward or delete emails from cryptocurrency exchanges to avoid detection. The scammers can then initiate password reset requests for the cryptocurrency accounts and intercept password reset links, one-time passwords or verification emails sent to the victims. Police also warned that credentials obtained through previous data breaches could be used to gain access to cryptocurrency accounts if victims had reused the same passwords across multiple online services. SPF urged members of the public to use strong and unique passwords for each online account and enable multi-factor authentication or two-factor authentication. Where possible, users should use an authenticator application rather than SMS-based verification, which is more susceptible to interception, said the police. Users should also regularly check their email security settings, looking out for unauthorised inbox rules, email forwarding settings and suspicious login activity. They should pay attention to notifications from service providers about data breaches and change their passwords immediately if their credentials have been exposed, while ensuring that multi-factor authentication or two-factor authentication is enabled. Those with cryptocurrency accounts should regularly review their transaction history and enable account activity notifications where available. Anyone who suspects that their email or cryptocurrency account has been compromised should contact their email service provider and cryptocurrency exchange immediately to secure or freeze the accounts, where possible. They should also change the passwords for the affected emails, cryptocurrency accounts and any other online accounts where the same password was used. Anyone with information relating to such crimes can call the police hotline at 1800 255 0000 or submit information online through the police's i-witness platform. Those unsure if something is a scam can call the 24/7 ScamShield Helpline at 1799 or download the ScamShield app to check, detect and block scams.