More than 700 Singapore residents have registered for GovTech's Scam Vaccine since sign-ups opened on 20 September, agreeing to receive realistic simulated scams by phone or WhatsApp without prior warning.
Open Government Products, the GovTech unit behind ScamShield, built the drills to shrink the lag between new scam variants appearing and public awareness catching up. Lead product manager Tay Paul Hong told reporters the exercises mimic channels, conversational pacing and escalation tactics seen in live cases reported through ScamShield.
How the simulations work
Participants submit a name, Singapore mobile number and age band. The system then schedules benign phishing calls or messages that follow scripts drawn from recent government impersonation, e-commerce and investment lures. Built-in guardrails block malware installs and money movement; monitors end a session if stress signals spike.
Unlike classroom slides, the drills arrive cold — similar to a fire alarm test — so users practice scepticism in context. Tay said the team refreshes scenarios when ScamShield logs new variants, aligning with police and Ministry of Home Affairs reporting lines.
Why timing matters
Real voucher and OTP scams continue to circulate on messaging apps, and parents still lose money to compromised student WhatsApp accounts. Scam Vaccine does not replace those advisories; it adds muscle memory for hanging up, verifying through official numbers and refusing OTP sharing.
Privacy teams audit logs so simulated data does not leak to third parties. Participants can opt out after each drill, though Tay hopes repeat exposure builds reflexes similar to annual cybersecurity drills run inside banks.
Scaling beyond early adopters
OGP plans cohorts with community centres and polytechnics after the pilot stabilises metrics on report rates and drill completion. Enterprise versions could follow for small and medium enterprises that lack security operations staff.
For now, the headline number — more than 700 volunteers in under two weeks — shows appetite for active training rather than passive posters. Whether that converts to fewer real losses will depend on police statistics months from now; the engineering bet is that practice beats reading yet another infographic.
Technical safeguards
Engineers strip real government logos from drill scripts and replace them with altered marks so participants learn to check URLs rather than graphics alone. Call simulations use rotating caller ID labels that mimic spoofing patterns documented in ScamShield logs, without connecting to actual criminal infrastructure.
Minister for Digital Development and Information Josephine Teo's Friday remarks on AI misuse explain why drills focus on social engineering rather than deepfake video alone. OGP shares anonymised completion metrics with the National Crime Prevention Council for public education campaigns.
Volunteers aged below 18 require parental consent forms at sign-up, and seniors above 70 receive shorter call scripts to reduce fatigue while still testing scepticism.