Replacing NRIC number as authentication tool may take months: Experts

They also flag risk of scams, identity theft as organisations overhaul security systems

- Lee Li Ying

Singapore's digital ecosystem will become more secure when NRIC numbers are no longer used to authenticate users, but to put in the infrastructure for stronger authentication tools could take several months to a year or more, said cyber-security experts.

In the interim, Singaporeans could face an incremental risk of scams and identity theft while organisations overhaul their systems, and would be well advised to stay vigilant and adopt additional security measures, they added.

Following a public outcry after the Accounting and Corporate Regulatory Authority (Acra) unmasked NRIC numbers on a new search portal last week, the Government apologised for the unease caused and announced a policy shift whereby NRIC numbers should not be treated as sensitive information.

Furthermore, NRIC numbers are intended to identify individuals, and not to be misused as a form of authentication to access privileged information or perform privileged transactions, said the Government.

Organisations should instead authenticate users through passwords, security tokens or biometric data.

Experts point out that NRIC numbers are widely used in Singapore across industries such as banking, telecommunications, insurance and healthcare for both identification and verification purposes.

Identification states who a person is, while verification proves a person's identity.

Singapore University of Social Sciences law lecturer Ben Chester Cheong said: "For example, using your NRIC (number) to register at a clinic's front desk or to look up your insurance policy is identification - (you are) simply declaring who you are.

"However, making changes to your insurance policy, accessing medical records, or conducting financial transactions requires proper authentication - proving you are who you claim to be."

Authentication methods will vary by sector and what they are used for.