Private firms using NRIC numbers as authentication, default passwords should stop as soon as possible: Josephine Teo

There are some “incorrect uses” of the NRIC number today and the government planned to stop these while the problem is “relatively contained”, said Mrs Teo. 

“Doing so will better protect everyone and allow us to use NRIC numbers with confidence,” she added. 

Individuals who have used their NRIC number as a password should change it immediately, said Mrs Teo. 

This will give them better protection against those who use NRIC numbers to get access to information or services, she added. 

An NRIC number is like an individual’s name – even if not widely disclosed, it is not a secret, said Mrs Teo. 

“If someone we don’t recognise calls out our names and starts to behave as though they know us well, we would be at least slightly suspicious,” she added. 

Individuals should not fully trust others just because they know their names, and this is how they should treat those who know their NRIC numbers. 

“We should not automatically assume that they know us well or are figures of authority, or can be trusted. We should be cautious about revealing more about ourselves or saying yes to their requests, or following their instructions without checking further.” 

If individuals stop using NRIC numbers as passwords and organisations stop using NRIC numbers as authenticators, this will go “a long way” in preventing harms from scams and identity theft, said the minister. 

This will then give individuals “better peace of mind” to use their NRIC numbers when necessary, such as when receiving medical treatment or applying for jobs, she added. 

The Ministry of Digital Development and Information aims to start consultations with the private sector soon, and initial meetings suggest that there can be “different approaches”. 

The government knew that it would take time for public agencies to make the change to masked NRIC numbers, and expected that it would take even longer for the private sector, said the minister. 

The plan was to change internal government practices before moving on to the private sector and non-profit organisations, she said, adding that this would allow agencies to better understand the implementation challenges. 

“We had also planned to mount a major effort to help Singaporeans be aware of the risks and to support efforts to stop incorrect practices,” said Mrs Teo. 

“The Bizfile incident was an unfortunate misstep, which now means these plans need to be brought forward.”