A loophole in the Singapore Pools betting app has allowed users overseas to place bets despite geofencing meant to restrict access to users physically in Singapore, according to reports. When users connect via mobile data roaming on a Singapore telco, their traffic routes back through Singapore and is assigned a local IP address, bypassing the app’s location check entirely.
Singapore Pools has said its online betting services are intended solely for local use, with geofencing measures to restrict overseas access, and that account holders must be Singapore residents or valid Foreign Identification Number holders. Accounts found breaching the rules can be frozen, suspended, terminated or closed, while the Gambling Regulatory Authority of Singapore has said non-compliant operators face penalties ranging from a written warning to licence suspension of up to six months, a fine of up to $1 million, or revocation.
Location is a network signal, not proof of identity
Takanori Nishiyama, Senior Vice President APAC and Country Manager, Japan at Keeper Security, said the case illustrates a hard truth that applies well beyond one betting app: location is a network-layer signal, and network-layer signals lie. Mobile roaming routes traffic back through local telcos, masking a user’s true location, and VPNs and proxies can produce the same effect — meaning any organisation that treats a trusted location as proof of a trusted user leaves itself exposed.
“What is being tested here is not whether the loophole was technically difficult to exploit, but whether the safeguards behind it were genuine and reasonably effective — the same standard used in compliance audits and certification reviews everywhere. A control does not need to be unbeatable to hold up under scrutiny, but it does need to be real, tested and revisited as circumvention techniques evolve,” said Nishiyama.
A single signal is never enough
Nishiyama said any organisation relying on a single signal — whether a device’s location, an IP address or a login credential — to prove trust will eventually meet a workaround it did not initially anticipate. The observation echoes a broader shift in enterprise security thinking, where identity and access controls are increasingly expected to combine multiple layers of verification rather than depend on any one check.
For organisations operating location-restricted digital services in Singapore and the region, the case is a reminder that geofencing alone is not a substitute for stronger identity verification and access management as circumvention techniques continue to evolve.
