NRIC numbers can be used to reveal home address, clinic records

In the wrong hands, such data can pose risks; experts urge vigilance against scams

- Osmond Chia

Individuals whose full NRIC numbers were exposed on the Accounting and Corporate Regulatory Authority's (Acra) database earlier in December face potential cyber-security risks, as organisations frequently rely on NRIC numbers to retrieve personal information.

Checks by The Straits Times also found that NRIC numbers can serve as a key to collecting information about individuals, which can be used for targeted scams or mischief.

Cyber-security experts cautioned that NRIC numbers can be used by bad actors to trick victims into believing they are authority figures or to commit crime. The exposed NRIC numbers can also be used to collect further information for scams.

The experts said the risks highlight how an NRIC number in the wrong hands can pose risks to individuals, who need to be vigilant against scams, even as changes in how NRIC numbers are used in the private sector are afoot.

The concerns come after NRIC numbers belonging to key representatives of companies registered under Acra's database were revealed by mistake on its new Bizfile web portal on Dec 9. As a result, anyone could freely search and view the full NRIC numbers of registered individuals, including business' public representatives - some of whom are also politicians.

Acra apologised for the incident and disabled the feature on Dec 13, but experts said fraudsters could still use simple algorithms to collect the NRIC numbers exposed during this window at scale, increasing the threat of scams.