SINGAPORE - Some 43 people lost at least $1.2 million in September alone, after falling for scams promoting bogus travel packages on social media platforms.

Victims would come across advertisements on Facebook or Instagram promoting “cruises, tour packages, concert tours and durian tours”, police said in a release on Thursday.

The scammers would contact them on Whatsapp and ask them to download an Android Package Kit file, an installation file for a third-party app, through the messaging platform or via malicious links in order to pay for booking fees.

After installing the file, which contains malware, the victims were prompted to grant app access to certain services, which effectively allows the scammers to access the victim’s device remotely and steal banking credentials and passwords.

The victims may be asked to key in their Internet banking login details through a fake banking website within the app, or instructed to make PayNow or bank transfers to pay for booking fees.

They would discover unauthorised transactions made from their bank accounts after that.

The Straits Times had reported on Sept 29 that a part-time bakery worker lost more than $111,000 after downloading a third-party app, which infected her Android phone with malware, to buy a durian day-tour ticket to Malaysia.

Warning the public against downloading apps from third-party or dubious sites, the police urged those who suspect their phones have been infected with malware to take the following steps:

Firstly, switch on “flight mode” on the device and ensure the Wi-Fi is turned off.

Then, run an anti-virus scan to check if it is infected with malware. As a further precaution, perform a factory reset, which erases data on the phone, and change important passwords.

Using another device, check for any unauthorised transactions made using bank accounts and digital services such as Singpass and Central Provident Fund accounts.

If there are unauthorised transactions, report it to the bank or the relevant authorities, and file a police report.

The police urged the public to adopt the following measures:

• Add the ScamShield and anti-virus applications to your device, and ensure its operating system and applications are updated regularly.
• Disable “Install Unknown App” or “Unknown Sources” in phone settings and do not grant permission to pop-ups that request for access to your device’s hardware or data.
• Check for scam signs with official sources such as the ScamShield Whatsapp bot, the Anti-Scam Helpline on 1800-722-6688 or visit www.scamalert.sg
• Only download and install applications from official app stores such as the Google Play Store for Android users. Be wary if asked to download unknown apps to buy items or services on social media platforms.
• Report suspicious content or advertisements on social media sites. Block and report numbers linked to scams on Whatsapp. Lastly, report fraudulent transactions to banks immediately.

Those with information relating to such crimes may call the police hotline on 1800-255-0000, or visit www.police.gov.sg/iwitness

For more information on scams, the public can visit www.scamalert.sg or call the Anti-Scam Helpline.