It has been three years since SingPass users could change their unique online ID from their National Registration Identity Card (NRIC) number, but most have failed to do so, The Straits Times has learnt.

A spokesman from the Smart Nation and Digital Government Office (SNDGO) revealed the statistic to the ST, but declined to reveal the proportion of users who use non-NRIC details to access their SingPass.

Mr Benjamin Ang from the S. Rajaratnam School of International Studies (RSIS) said that because an NRIC can be used to access a host of government services, cyber attackers could do a lot of damage with just that one detail.

“If many systems are linked by one number, such as NRIC, it’s convenient for users because we can access them all with that number,” said Mr Ang, who is a senior fellow in the Centre of Excellence for National Security at RSIS.

“But this convenience is also a risk, because an attacker can also access them all with that one number, so additional measures like 2FA are needed.”