by

September 19, 2026

10 minutes

Read Time

Scammers are using AI to commit crimes at speed. How is Singapore police’s new Cyber Command keeping up?

Hackers are using AI to help write malicious code and find exploitable weaknesses, says a cybersecurity specialist with the Singapore Police Force’s new Cyber Command.

New: You can now listen to articles.

This audio is generated by an AI tool.

Natasha Ganesan

Read a summary of this article on FAST.

Get bite-sized news via a new
cards interface. Give it a try.

Click here to return to FAST
Tap here to return to FAST

FAST

SINGAPORE: It looked like an ordinary text message about a pending delivery: parcels could not be delivered due to an “invalid address”.

The message appeared to be from familiar Singapore courier companies, and recipients were sent a link and instructed to update their details within 24 hours.

Here’s the catch: they would have to pay a small fee between S$0.06 (US$0.05) and S$1.64 to get their items redelivered.

Once they entered their credit card details, that information did not go to the delivery companies – it was now in the hands of scammers.

Guess Word
Crack the word, one row at a time

Buzzword
Create words using the given letters

Mini Sudoku
Tiny puzzle, mighty brain teaser

Mini Crossword
Small grid, big challenge

Word Search
Spot as many words as you can

Show Less

The link took them to a website that looked like the delivery company’s, but it was actually controlled by con artists.

Tracking down such fraudulent websites is part of the job for officers at the Digital Disruption Centre, a core component of the Singapore Police Force’s (SPF) new Cyber Command.

But when one website goes down, another can spring up almost immediately – with the help of artificial intelligence. In the courier company phishing case, cybercriminals exploited AI and found new ways to operate at speed and scale.

A phishing website resembling J&T Express prompting victims for redelivery payment. (Images: Singapore Police Force)

Launched two months ago, Cyber Command consolidated cybercrime-fighting units from across the SPF. It aims to be the “tip of the spear” in the fight against scams and cybercrimes.

Its focus is not only on investigating individual cases, but also on understanding and disrupting the broader criminal ecosystem, said Inspector of Police (INSP) Harbhajan Kaur.

This includes working with local and international partners to identify syndicates, their facilitators and other enablers involved in cybercrime and scam operations, she said.

AI CYBERCRIME

AI has made social engineering more convincing and scalable in three main ways, said INSP Kaur.

Deepfakes and voice cloning enable realistic impersonation of trusted figures, while hyper-personalised messaging uses scraped personal data to make phishing far harder to detect.

Conversational AI allows scammers to sustain believable relationships at scale without human operators.

“Together, these developments have contributed to more victims self-transferring money, which also complicates prosecution since the transfers can appear voluntary on the surface,” said the senior investigation officer from the Anti-Scam Investigation Branch at Cyber Command.

The police have warned of a growing trend of phishing scams impersonating courier companies to obtain victims’ personal and banking details.

In another phishing scam involving Community Development Council (CDC) vouchers, scammers used fake websites masquerading as government ones and circulated the links through hijacked Telegram accounts. As such, victims might have received them from someone they knew and trusted.

The challenge here was scammers using legitimate online services and automation to generate new links quickly, said Special Constable Sergeant (SCSGT) Javier Lau, a cybercrime operator stationed at the Digital Disruption Centre.

“There’s definitely going to be a rise in automation on the scammer side. That’s why our Cyber Command also has to keep up with advances in technology, so that we can counteract this load that will come in from automation,” he said.

“If they are using more advanced technologies, we also have to keep up and use more advanced technologies to uncover these scams and understand the (scam) campaign as a whole.”

Special Constable Sergeant Javier Lau from the Singapore Police Force’s newly formed Cyber Command, on Sep 16, 2026. (Photo: CNA/Lim Li Ting)

In the courier phishing scams, the websites were churned out quickly and officers used AI to tackle them, SCSGT Lau said.

“To combat this volume, we use AI and machine learning to disrupt these sites as quickly as (they are) being created … We want to reduce manual labour, so we can focus our energy on looking at, for example, tackling the whole campaign in (and) of itself, or focusing on other scams.”

Rather than treating each malicious link as an isolated case, cybercrime operators look for patterns across reports and use open-source tools to identify related suspicious sites more efficiently, he added.

Cybersecurity professional Syazwan Suhaimi, who is with the unit’s cybercrime investigation branch, said the use of AI cuts both ways.

Just as attackers use it to find vulnerabilities, the police are using it to analyse the volume of data faster than any person could alone.

“It is as much about constantly retraining our people as it is about the tools. AI is not just writing better phishing messages anymore; some hacking groups are using it to help write malicious code and find exploitable weaknesses, automating steps that used to need a skilled human,” he said.

Cyber Command also taps expertise through partnerships with local stakeholders and foreign counterparts who have dealt with similar tech-enabled scam cases and may be more advanced in certain areas, said Assistant Superintendent of Police (ASP) Nicole Monica Morgan, an International Cooperation and Liaison staff officer under the command’s Partnership and Engagement Division.

The unit also learns from task forces from organisations such as Interpol and Europol, officially known as the European Union Agency for Law Enforcement Cooperation, she added.

MINUTES INSTEAD OF HOURS

Before Cyber Command was formed, officers from the different units used to “work in silos”, they told reporters on Wednesday (Sep 16). Operating under a unified command has made it easier to share information across teams, said SCSGT Lau.

In some cases, processes that once took hours can now be completed within minutes.

He pointed to job scams, which can involve multiple scammers across different platforms. A victim might first come across a fraudulent job advertisement on social media and be directed to a website. That website might contain a phone number.

All three – the social media advertisement, fraudulent website and phone number – were dealt with separately previously.

“For me, I deal with website disruption. So previously, before Cyber Command, if I wanted to disrupt the phone number or the advertisement on social media platforms, it would take longer.

“It will be a bit more tedious because I will have to draft an email and give the information to the relevant teams,” said SCSGT Lau.

“But with Cyber Command now, because we’re all under one roof, I can just turn around and give the info to them more efficiently, give context verbally, which is easier to understand. If they have any questions, they can ask me on the spot,” he added.

“Effectively, with Cyber Command, we are able to disrupt more than one scam enabler, which affects the scammers’ operations. It just hurts them more whenever we disrupt the scam itself.”

On how long the process would have taken before Cyber Command was set up, he said: “I would say previously maybe it would take a couple of hours.

“We’ll for sure get it done as quickly as we can, but then now maybe in a couple of minutes, because we’ll be … able to look to our left, look to our right, and give the information more efficiently.”

Cybersecurity professional Syazwan Suhaimi from the Singapore Police Force’s newly formed Cyber Command, on Sep 16, 2026. (Photo: CNA/Lim Li Ting)

Mr Syazwan said he is now able to share his expertise with investigation officers and assist them in any technical areas.

“IOs do investigations. They do have a little bit of cyber background, but they are not really the specialists or the experts in that area. When I come into the command, I can become the adviser on what to do,” said Mr Syazwan, who specialises in cryptocurrency investigations and blockchain tracing.

He added that he can also build tools to improve officers’ workflows, help them trace scams faster, as well as to identify potential victims who may lose a lot of money in different scams.

One tool he built was used to pinpoint threat actors when they attempted to move cryptocurrency through a mixer, which is designed to increase the privacy and anonymity of blockchain transactions.

Before Cyber Command was formed, officers used tools from vendors, but now, with more hands and brains on deck, those with a cybersecurity background like Mr Syazwan can support officers with in-house tools.

HEAD IN THE SAND

But delays in victims reporting scams remain a challenge for officers, said INSP Harbhajan Kaur.

When there is a delay in reporting, the money transferred to scammers may have already been moved overseas, making it difficult for police to trace, she said.

One reason victims hesitate to report scams is denial, she said. For instance, in internet love scams, scammers may spend months or years cultivating a relationship with their victims.

Over time, victims come to trust the person at the other end. They “blindly transfer” money and keep doing so – sometimes until they are pushed to take out bank loans – before the warning bells ring.

“Some will come forward, some will not come forward. So those that don’t come forward, they will say, ‘I think I report also I’m not going to get back my money’,” said INSP Kaur.

Mr Syazwan has similarly come across victims who did not believe they had been scammed.

“We try and try to convince them that it’s a scam. Maybe it doesn’t work the first time, and then maybe the second time, they realise that after doing their own research and stuff like that, they know that they (were) really scammed.”

For him, one of the most rewarding parts of his job is when potential victims believe him and stop investing or sending their money to scammers.

He also feels a sense of satisfaction when he manages to recover the money lost or identify the scammer.

The number of scam cases fell in the first half of 2026, continuing the downward trend that started in 2025 after years of increases.

But the numbers remain high, and tackling scams is still a national priority, the police said last month.

The road to success for Cyber Command ultimately comes down to three outcomes, said ASP Morgan: fewer scam cases, more funds recovered and more cybercriminals arrested.

Source: CNA/ng(mi)

Inbox