4 years ago, I wrote about why we should not use NRIC numbers for authentication. Unfortunately, this mistake was repeated and it can be exploited today to claim free masks from the government.
This video shows the exact process to claim one free mask per NRIC. Unfortunately, there is no 2FA. The claimant does not have to enter date of birth or any other particulars to verify his identify, he just needs to scan his NRIC. The NRIC uses the Code 39 barcode specification and the checksum algorithm is public so anyone can generate loads of them. As proof, I have generated the first 16 NRICs starting with S900000XX.
Disclaimer
This post is for educational purposes only. As proven, the same mistakes are made time and again, education is necessary. Please do not use this method to fradulently claim masks, I am not responsible for any actions taken against you.
Update:
Apparently, it has now become a trend.
