Ex-NTU computer science undergrad jailed 5 months for hacking, selling 121 Kopitiam cards

• Alex Quek learnt how to hack stored-value cards in 2015
• He modified and sold 121 Kopitiam cards from May 23 to July 9 in 2017
• He has made full restitution for the S$12,100 in losses that Kopitiam suffered

SINGAPORE — A former computer science undergraduate from Nanyang Technological University (NTU) has been jailed five months for hacking 121 stored-value cards to make purchases without cash top-ups and then selling the cards online for a total of S$7,573.

Alex Quek Wei Kai, 29, was sentenced on Wednesday (July 22). He had pleaded guilty to a single charge under the Computer Misuse and Cybersecurity Act on June 22.

Quek’s lawyer, Mr Desmond Tan from Lee & Lee, previously told TODAY that his client withdrew from his university course due to the “lengthy period of police investigations”. He had earlier taken a voluntary leave of absence from his studies in August 2017.

The court heard that Quek, a Singaporean, began researching on ways to modify stored-value cards when he was a first-year student in 2015.

Students staying in NTU residential halls have to top up a stored-value card with cash before using it to pay for air-conditioning services in their rooms.

One of his neighbours had asked if Quek could modify one, such that it registered as having stored value even without a cash top-up.

Quek then downloaded a specialised computer programme and used it to obtain the file information of two cards. After that, he used the details of a card with a maximum value of S$50 to overwrite another one with low value.

However, he did not personally use the modified cards.

Quek soon realised that the cards used by NTU students are the same brands as the one issued by food-court operator Kopitiam for customers to make cashless payments at its outlets.

He eventually found a way to modify the Kopitiam cards, and began using two that he got from his relatives for his own use. Some of his friends borrowed the cards to use occasionally.

In the beginning of 2016, he realised that the cards could not be used at Kopitiam outlets any longer. 

He then modified the internal card numbers, but this method eventually failed in mid-2016 because Kopitiam had started using cards with a strong encryption system.

Quek then started getting Kopitiam cards from other friends and modifying them. Through online marketplace Taobao, he obtained a specialised card to modify the unique identification numbers of the cards.

He used the modified cards to pay for parking fees, food, drinks and cigarettes. He gave the cigarettes to his friends as he did not smoke.

In May 2017, he began selling the modified Kopitiam cards on Carousell. He gave each card a stored value of S$100 and advertised them for about S$55 to S$70 each.

He met his customers at Kopitiam outlets so that they could check the value in the cards. When they asked if the cards were legal, he replied that he got them through a giveaway from a friend’s company.

From May 23 to July 9 in 2017, he modified 121 cards and sold them to 24 people. 

His offences came to light when a Kopitiam staff member at the Lau Pa Sat outlet noticed suspicious transactions made by another customer. 

Quek himself was also captured on security footage at the outlet, and an anonymous individual informed the food-court operator of Quek’s name.

He stopped his activities when a schoolmate told him that his photograph was displayed at Kopitiam outlets. He was arrested on July 25, 2017 after the police tracked down several of his customers.

He has since made restitution of S$12,100 for the losses that Kopitiam suffered.

For his offences under the Computer Misuse and Cybersecurity Act, Quek could have been fined up to S$10,000 or jailed up to three years, or both.