Singapore’s ICA suspends electronic change of address service for security review

In the meantime, those who require proxy assistance may approach the IC Unit at Level 3, ICA Building for assistance from Mondays to Fridays, 8:00am to 4:30pm.

The Immigration & Checkpoints Authority (ICA) of Singapore has suspended its electronic Change of Address (eCOA) service, following several attempts of misuse.

Since its launch in October 2020, the eCOA service has provided residents with a convenient way to update their residential addresses online using their Singpass credentials.

Investigations by ICA revealed approximately 80 cases of misuse where individuals fraudulently changed addresses by using stolen Singpass accounts. The perpetrators succeeded in changing the addresses in about 75% of these attempts. This prompted the temporary shutdown of the service to safeguard data integrity and implement stronger security measures.

To mitigate further risks, ICA said it is conducting a comprehensive security review of the eCOA system. The additional security measures include integrating face verification technology into the Singpass log-in for the eCOA service, which minimises the risk that a perpetrator can use the stolen Singpass account of a third party to access the service to change a victim’s address.

In the meantime, the authority added, those who require proxy assistance may approach the IC Unit at Level 3, ICA Building for assistance from Mondays to Fridays, 8:00am to 4:30pm.

The eCOA service is expected to resume operations on 14 January 2025 with improved security measures. However, the "Others" module, which was part of the online system, will remain under unavailable for further evaluation and testing before it is reinstated.

The authority has advised individuals to check its official website and communications for updates on the service resumption and further details about enhanced security measures. It will continue to engage affected individuals to assist with any fraudulent changes made to their addresses, including supporting them with account recovery processes.

Lead image: ICA