Singapore IC debate: is unmasking identification numbers safe?
Criminals can pair NRIC numbers with other details, such as full names and birth dates, to scam victims, cybersecurity experts say
The issue surfaced after some users of the revamped digital service business portal, operated by the Accounting and Corporate Regulatory Authority (ACRA), found that they could access the identification card numbers of other individuals through a search function.
Singapore’s Ministry of Digital Development and Information (MDDI) apologised for the concern caused, explaining its intent was to change the existing practice of masking identification numbers – or National Registration Identity Card (NRIC), colloquially called “IC” – only after educating the public that it was safe.
“As a unique identifier, the NRIC number is assumed to be known, just as our real names are known. There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others,” the ministry said in a statement on Saturday.
The Personal Data Protection Commission (PDPC), an agency which regulates and promotes data protection and sharing, also stressed that an NRIC should be used as an identifier rather than a means of authenticating identity.
Authentication is about proving you are who you claim to be
“A person’s name and NRIC number identifies who the person is. Authentication is about proving you are who you claim to be. This requires proof of identity, for example, through a password, a security token or biometric data. As the NRIC number is not a secret, it should not be used by an organisation for authentication purposes.”
