SINGAPORE — The recent case of a Chinese exchange student in the United States who went missing and was later found alive in the woods has sparked worldwide interest in the particular kind of scam to which he had fallen prey.

A victim of "cyber kidnapping", 17-year-old Kai Zhuang was told by a group of scammers to isolate himself in a tent in a secluded area and take pictures of himself that would make it look like he was kidnapped.

They then used the photos he took to extort money from his family, threatening to harm him if they did not pay up, even though all the while, the scammers were nowhere near Kai Zhuang. 

Though this particular case has caught worldwide attention, this is not a new type of scam and cases have occurred, including in Singapore, over recent years. 

TODAY takes a closer look at how this scam works and how people can protect themselves from being tricked by these methods.

WHAT IS 'CYBER KIDNAPPING'?

Associate Professor Razwana Begum from the Singapore University of Social Sciences (SUSS) said that cyber kidnapping is an extortion tactic in which cyber or virtual kidnappers employ deceit and intimidation to compel victims into seclusion and coerce them to capture images that falsely depict their confinement.

The victims are often told that if they do not comply, their families will be in danger. 

The scammers will then use the photos and videos taken by the victim to trick the victim's family into believing that the victim is in physical danger.

They might also employ fake voice clips of screaming and distress, or deep fake video clips that seem to show the victim in distressing situations. 

Mr Kenny Yeo, director and head of Asia Pacific cybersecurity practice with consultancy firm Frost & Sullivan, said: “The motive is the same, to convince the victim's family that the victim is in trouble and that they need to pay up fast.” 

Cyber kidnappers do not physically kidnap their victims, but they employ many manipulative tactics similar to other scammers who use phones or online modes of communication to conduct fraud.

For example, they exploit human psychology and trick individuals into divulging confidential information or performing certain actions, such as instilling fear in their victims with false claims of compromised information or imminent harm.

Assoc Prof Begum, who is from SUSS' School of Humanities and Behavioural Sciences, said that these kidnappers would also create a false sense of urgency, pressuring victims to act quickly to avoid “perceived negative outcomes”.

Another expert said that these manipulation techniques become more convincing when they are coupled with the kidnapper’s collection of data that they have gathered on their victims.

Mr Terence Siau, general manager of the Singapore Centre For Strategic Cyberspace International Studies, said that before pulling off their cyber kidnappings, the scammers would first mine information that is publicly available, such as from the victims' social media accounts.

They can then use the information — for example, where the victim lives, his hobbies and places he frequents — to create a detailed enough story to tell the victim's family, to make it more convincing that they had really kidnapped the victim. 

HAVE SUCH CASES HAPPENED IN SINGAPORE?

A few similar cases have been reported here. Similar to the US case, the scammers targeted foreign students living here without their parents.

In May 2022, a 16-year-old student from China feigned his own kidnapping when two scammers posing as police officers from China told him that his identity had been used to register for a mobile number in his home country and the phone number was being used to scam victims in Singapore.

Using that as a reason, they asked him to send them 260,000 yuan (about S$49,000) to prove his innocence. They even threatened to deport him back to China if he did not send them the money. 

He asked his parents for the sum, saying that it was for a new laptop and tuition fees but his parents rejected his request, so the scammers told the student to stage some videos of himself looking like he had been kidnapped, which were then sent to his guardian in Singapore and his parents in China. 

That same year, two university students from China who were living in Singapore were coerced by scammers to travel to Cambodia and record videos of themselves pretending to be kidnap victims. 

In both cases, the scammers had also claimed to be police officers from China.

One victim was a 21-year-old student who had been living in Singapore for at least four years, while the other was a 22-year-old student who had been living here for at least three years. 

The scammers then sent the videos to their parents in China and demanded ransom money. 

WHY IS CYBER KIDNAPPING ON THE RISE?

Cyber-kidnapping scams have become more prevalent in recent years, experts said, largely enabled by the proliferation of social media and the advancement of artificial intelligence (AI).

Mr Yeo from Frost & Sullivan said that fraudsters can use “specific contextual information” from social media for criminal exploitation.

For example, a scammer might be able to surmise through social media that a single female traveller is on her graduation trip across Europe alone. 

“Cyber criminals could leverage that contextual information to contact family members that their daughter is stuck in a European country and in trouble unless a ransom is paid,” Mr Yeo said. “This contextual information lends credibility to the criminal threat.”

As AI becomes more sophisticated and advanced, cyber kidnapping could become even more convincing and harder to detect, he added.

Dr Chew Han Ei, a senior research fellow at the Institute of Policy Studies (IPS), said that although people who live abroad and apart from their families tend to be more vulnerable, anyone can be targeted with the ease and availability of such information.

The continued development of AI is a worrying trend for public safety and security professionals even though it may help them do their jobs better, Assoc Prof Begum from SUSS said.

“While AI provides unparalleled abilities in detecting threats, responding effectively and recognising patterns, it concurrently introduces fresh challenges such as the evolution of threats, privacy issues and the demand for a proficient workforce or detection mechanism.”

Agreeing, Dr Chew noted that criminals are already using AI to produce deepfakes of celebrities and politicians, including Prime Minister Lee Hsien Loong, to deceive Singaporeans into falling for investment scams.

In the case of cyber kidnappings, AI could be used to create audio deepfakes of the victim's voice to make it even more convincing to their families that their child has been kidnapped, he added.

HOW TO GUARD AGAINST CYBER KIDNAPPING SCAMS

Experts agreed that the best way to guard oneself against cyber kidnapping is to be alert and practise responsible online behaviour. 

“As social media users, we have to be vigilant and aware about the kind of personal information we are putting online, both of ourselves and our loved ones,” Dr Chew said. 

Even seemingly harmless information such as daily routines and favourite locations can be used by criminals to make the scams more believable, he noted.

Assoc Prof Begum said that it helps to have a secure Wi-Fi network, keep software updated and use secure passwords and multi-factor authentication to prevent scammers from accessing personal data and information.

This includes adjusting privacy settings on social media accounts to limit who can see your personal details and avoiding the public sharing of sensitive information.

"Be sceptical of unexpected communications and verify the sender's legitimacy before taking any action," she added.

And if you do someday receive a call from someone who says that he or she has kidnapped your family member, get law enforcement involved as soon as possible, regardless of whatever threats the kidnapper is laying on you, Mr Yeo said.

One tip from Dr Chew: Come up with a code word for the family — if one of the family members says this word, the rest will know that the individual is legitimately in danger. 

“Think of these special code words as a form of authentication unique to the family,” he said.