We’ve been alerted to these messages being forwarded on WhatsApp:
The first message depicts what appears to be a screenshot of an SMS from the Ministry of Health (MOH). The SMS’ content informs the recipient that they are eligible for ‘Phase 1 vaccination’ from 1 Jan 2021 and provides a link to which the recipient can register for an appointment.
The next message forwarded warns that the link provided in the screenshot is a phishing attempt, and that a ‘dental colleague’ who received it called MOH to check its legitimacy. It is not specified who this dental colleague is.
Fake ‘fake news’?
We found it rather strange that the domain of the URL in the screenshot is that of ‘gov.sg’, an indication that it could very well be a legitimate webpage created by the Singapore Government. To verify our guess, we typed in the URL in the SMS sans the code and we are directed to this webpage:
As seen in the screenshot, it is indeed a legitimate webpage under the gov.sg domain for individuals to register for the COVID-19 vaccine. The page also contains two input fields – one that asks for NRIC/FIN and another that asks for a 10-character registration code that was sent via SMS.
When we entered the URL with the code, we were led to the same page, but with the code automatically filled out in the top input field:
Given that so far, evidence doesn’t seem to point towards the link being the work of scammers, is this a case of a legitimate webpage being ‘wrongly accused’ of being a phishing scam?
MOH’s update
On 7 January, MOH put up a notice on its website to inform the public that SMSes the COVID-19 vaccination programme is being rolled out progressively, and that SMSes to invite those who are eligible to register for registration, starting with healthcare workers.
MOH adds that those who receive the notification should not forward it to others as the invitation is unique to them, and should check that the link in the SMS ends with ‘gov.sg’ before clicking on it.
The screenshot in the SMS does fulfil the criteria as stated in the MOH notice in that it:
- Ends with ‘gov.sg’
- Contains a unique invitation code
- Appears to be part of the progressive roll-out of the vaccination exercise
Therefore, the claim that the link in the SMS is a phishing scam is likely false.
We have reached out to MOH for clarification, and will update the article when we get a reply.
