Are senior citizen scams a technology problem?

Ask a senior in Singapore why she still carries cash and will not touch PayNow, and you will get an answer about scammers. She is not wrong to be afraid. But she — and an industry that keeps answering her with more warnings — may be asking the wrong question. Are senior citizen scams a technology problem? The honest answer is two answers, and the split is the useful part.

The case that only looks technical

For the money that leaves a consumer’s account, the technology is not what failed. In 2025, 81.8% of reported scams in Singapore were self-effected transfers: the victim authorised the payment. The scammer never logged in, never broke an encryption layer, never took the account. The system did exactly what it was told. Somebody was persuaded.

“In these cases, scammers did not gain direct control of the victims’ accounts but manipulated them into performing monetary transactions through deception and social engineering.”

Singapore Police Force, Annual Scam and Cybercrime Brief 2025

One of our own team got caught, and it is worth writing down because of how ordinary every step was. She was at her desk. An email arrived that appeared to be from her manager, asking for help with something urgent and confidential: buy gift cards — from more than one shop, over a thousand dollars of her own money — and send him the codes. He would reimburse her. She did it.

What stopped it was not a system. Something finally felt wrong — why has he been emailing me all morning about this? — and she messaged him. He had sent nothing. The messages came from someone else entirely. And looking back, the tell was sitting in plain sight the whole time: the address was never his. On a busy morning, nobody was reading it.

Our working assumption — and it stays an assumption, because we will never get a clean answer — is that the entry point was her own recent job update on LinkedIn, which handed someone a fresh, accurate picture of who she was, who she reported to, and what would sound like him. Nothing was breached in any way we could find. But the technology is not absent from this story either: a display name is trivially easy to forge, and that is the whole trick.

It is not a rare event. On 28 January 2026 the Singapore Police Force issued an advisory about exactly this variant — scammers altering their email display name to pose as a company’s chief executive or a supervisor, then instructing staff to buy Razer Gold, Apple or Xbox gift cards with their own money against a promise of reimbursement. Since 1 January 2026 it had seen at least 25 cases and at least S$30,000 lost. It added a detail worth repeating: new employees and interns are at higher risk.

Hold that next to the usual explanation — “common sense failed.” It did. But that is the problem, not the diagnosis. Common sense is not a control. It cannot be written down, tested or audited, and it fails first under exactly the conditions an attacker manufactures: urgency, a familiar name, and a morning with fifty other things in it. The flag here was real and free — a wrong address in plain sight. A rule that forced somebody to check it would have cost nothing. Vigilance, on its own, cost more than a thousand dollars.

Four attacks where the technology is the weapon

Everything so far is persuasion wearing the costume of a security story. That is true of the consumer scams and true of the business email scams. It is not true of everything. Four documented cases show where the technology is genuinely the weapon:

1. A phone the attacker controls. In 2023 at least 1,899 people in Singapore were deceived into installing a malicious app, and lost at least S$34.1 million between them — about S$17,960 each. The app used Android’s accessibility permissions to watch the screen and read the SMS one-time codes the banks sent. That is not persuasion: the device itself was compromised, and the bank’s own security was fighting on enemy ground. The syndicate ran servers across Malaysia and Hong Kong; a joint operation with Malaysian and Hong Kong police produced 16 arrests and two extraditions in June 2024.
2. A session the attacker stole. A newer family of phishing kits — Tycoon 2FA is the best known — sits between you and the real login page as a relay. You type your password and your one-time code into a page that forwards both to the genuine site in real time, and the attacker leaves with an authenticated session rather than a password. It has been linked to more than 96,000 victims worldwide, and Singapore’s Cyber Command helped dismantle its operators in 2026. The uncomfortable part is what it does to multi-factor authentication: MFA did not fail. It was bypassed. At least three Singapore business email accounts were compromised this way between November 2025 and January 2026.
3. A fake phone mast. In September 2026 a man was jailed for driving around Singapore for up to twelve hours a day with an “SMS blaster”, a portable transmitter that pretends to be a mobile tower. It pushed more than 10,500 phishing messages into more than 31,820 phones that came within range. The detail worth sitting with: those messages never passed through a telco network at all, so the SMS Sender ID Registry and the “Likely-SCAM” label — protections Singapore built precisely to warn people about spoofed senders — never got a look at them. A technical trick walked around a technical safeguard.
4. A face the attacker rendered. In January 2024 a finance employee in the Hong Kong office of the engineering firm Arup received an email from the group CFO that he correctly suspected was phishing. Then he joined the video call. Every other participant — the CFO, several colleagues he knew — was an AI-generated likeness built from footage the company had published itself. He made 15 transfers totalling about US$25.6 million before anyone checked with head office. Arup’s own CIO called it “technology-enhanced social engineering”; no internal system was breached. The defence that was supposed to work — you cannot fake a face you know — was the exact assumption the attack existed to destroy.

Set those four against a consumer scam and the shape becomes clear. In the business attacks the technology is the weapon, the access, or the escape route. In the consumer scam the technology works perfectly and the person does not.

So is it a technology problem?

For a consumer or a senior, no. The failure is not in the system; it is in trust. And the fear deserves to be understood before it is dismissed. A Visa study of 200 Singapore residents aged 50 to 80 found that while nearly 80% were heavy users of messaging apps, only about 30% used mobile banking — and the reasons were not technical. Card and wallet payments were “too scary.” They feared keying in the wrong amount, and hidden charges. Above all, they wanted to know the money had arrived; the survey named “the lack of communication behind digital payments” as a barrier in itself. You hear the same on the street: a 65-year-old told CNA the app “has too many buttons… it gives me a headache”, and that she was afraid of sending the wrong amount and losing her savings.

What is being described is not complexity. It is irreversibility. Cash is visible, final and in your hand. A transfer is a number on a screen that leaves in a second and does not come back. That is a rational fear, and it is a communication problem, not a technology one.

For a business, increasingly yes. The four cases above are not persuasion with extra steps. They are real compromises: a controlled handset, a stolen session, a false tower, a rendered face. But notice what made each one succeed. The malware needed somebody to grant an app permission. The stolen session needed somebody to type a code into a page they did not own. The Arup employee was asked to trust his eyes because nothing forced him to check a channel the attackers did not control. The technology is the weapon far more often than it is the failure. Where something genuinely failed, it is almost always the same thing: a control that was never made structural, left to a person to notice.

The senior half, in numbers

If this question is going to be answered with data rather than fear, the Singapore scam statistics are worth stating plainly.

Singapore lost more than S$4 billion to scams between 2019 and 2025 — S$913.1 million in 2025 alone, down 17.9% from S$1,112.4 million in 2024. But read the loss column, not just the count: the median loss per case rose from S$1,389 in 2024 to S$1,644 in 2025. Fewer scams, each taking more.

The senior-specific part is the part most people get wrong. Victims under 65 made up 85.2% of all cases in 2025, and the largest single group was adults aged 30 to 49, at 36.1%. A 2022 study by the NUS Institute for the Public Understanding of Risk found those under 25 were 10% more susceptible to scams than those aged 65 and above. Seniors are not the most likely to be caught. They are the most costly to catch: victims aged 65 and above were about 15% of cases but lost an average of S$37,053 each — the highest of any age group — and were the only group whose numbers rose while everyone else’s fell. That is a target-selection gap, not a comprehension gap. Seniors hold the savings worth engineering for.

The safeguard is on the wrong side of the door

Nearly every protection Singapore has built for consumers lives inside the app: Money Lock, transaction alerts, the PayNow check that shows the recipient’s registered name before you send, and the “cognitive breaks” the banks added in October 2025 that pause suspicious transfers. All of it requires that you are a user. So a senior who refuses the app does not become safer. She steps outside the protections, keeps the underlying risk, and adds a new one — cash is stealable, and untraceable when it is.

The state sees the same asymmetry. Where persuasion fails completely, the Protection from Scams Act lets the police impose a restriction order, freezing transaction capability on a person’s own account; eighteen were issued in the first half of 2026. And the Shared Responsibility Framework, in force since December 2024, obliges banks and telcos to compensate victims of phishing — the unauthorised kind — while explicitly excluding the self-effected transfers that are 81.8% of cases. When a system’s last resort is to override the customer rather than convince her, that is not a technology failure. It is a communication one, written into law.

What actually holds

Singapore has spent years teaching people what a scam looks like, and it is working — cases fell sharply in 2025. But you cannot spot an anomaly without a sense of the norm, and almost nobody teaches the norm: that a real bank SMS looks like this; that PayNow shows the recipient’s registered name before you confirm; that a request to buy gift cards is never how a boss asks for anything. The fear is loud. The baseline is silent.

“If the alternative is to lose my life savings, perhaps needing a few more clicks and an identity verification check to complete a bank transfer might not be such a bad thing.”

Dr Ng Li Sa, Ministry of Home Affairs, Global Anti-Scam Summit

For businesses the fix is narrower and duller than a training programme. Any instruction that moves money gets verified on a channel the requester did not choose and cannot control — a number you already held, dialled by you. In the Arup case that one rule would have cost a phone call. In ours it would have cost one glance at an address. Neither is technology. Both are structure. A safety control only protects the people who trust it enough to use it, and a control that depends on a busy person noticing something is not a control at all.

Frequently asked questions

Is being scammed a technology problem?

It depends which scam. In 81.8% of 2025 cases the victim made the transfer themselves and no account was compromised, which is persuasion rather than a systems failure. Against businesses, malware that takes control of a phone, phishing kits that steal a live session, fake phone masts and deepfaked video calls are genuinely technical attacks.

How much has Singapore lost to scams?

More than S$4 billion between 2019 and 2025. The annual figure peaked at S$1,112.4 million in 2024 and fell to S$913.1 million in 2025.

What is a self-effected transfer?

A payment the victim authorises and sends themselves, after being persuaded by a scammer. The scammer never gains control of the account. In 2025, 81.8% of reported scams were of this kind.

Are seniors more likely to fall for scams?

No. Victims under 65 made up 85.2% of cases in 2025, and a 2022 NUS study found under-25s were 10% more susceptible than those aged 65 and above. Seniors are the costliest victims, though, losing S$37,053 each on average.

What is the gift-card email scam?

Scammers change their email display name to look like a company chief executive or a supervisor, then ask staff to urgently buy gift cards such as Razer Gold, Apple or Xbox with their own money and send the redemption codes, promising reimbursement. Singapore police recorded at least 25 cases and S$30,000 lost between 1 and 28 January 2026. New employees and interns are most at risk.

Does PayNow protect me from scams?

PayNow is a payment rail, not a scam filter. Its protection is transparency: it shows the recipient's registered name before you send, and confirms the transfer. That safeguard is real, but it only helps if you know it exists and trust it.

What is the Shared Responsibility Framework?

A Singapore framework, in force since 16 December 2024, requiring banks and telcos to compensate victims of a defined set of phishing scams where their duties were breached. It does not cover self-effected transfers.