• Alex Quek Wei Kai began researching how to hack stored value cards in 2015
• The computer science major modified and sold 121 Kopitiam cards from May 23 to July 9, 2017
• He has made full restitution for the S$12,100 in losses that Kopitiam suffered
• He will return to court next month to be sentenced

SINGAPORE — A former Nanyang Technological University (NTU) undergraduate has become the second person hauled to court in recent months for hacking stored-value cards to make purchases without top-ups, and then selling the cards online.

Alex Quek Wei Kai, 29, modified and sold 121 cards from food court operator Kopitiam on e-marketplace Carousell. He earned S$7,573 over about seven weeks before he was caught.

The cards are issued by Kopitiam for customers to make cashless payments at its outlets, and are the same brand as ones that NTU students use to pay for air-conditioning services in their rooms.

Quek, who studied computer science in NTU, pleaded guilty in a district court on Monday (June 22) to a single charge under the Computer Misuse and Cybersecurity Act.

Quek’s lawyer, Mr Desmond Tan from Lee & Lee, told TODAY that his client withdrew from his course due to the “lengthy period of police investigations”. He had earlier taken a voluntary leave of absence from his studies in August 2017.

Quek will return to court on July 22 to be sentenced.

Previously, a 25-year-old NTU computer engineering graduate was jailed for 10 months in April for similar offences. 

Tee Chin Yue began hacking his stored value card for free air-conditioning services in his residential hall room, before using the same method to hack four Kopitiam cards 137 times.

He then used the credits in them to top up 186 prepaid SIM cards from telco Singtel for users on e-marketplace Carousell.

He managed to make almost S$34,000 in total and caused Kopitiam to suffer losses of S$80,812.

TOLD CUSTOMERS HE GOT THE CARDS IN A GIVEAWAY

The court heard that Quek, a Singaporean, began researching how to modify stored value cards when he was a first-year student in 2015.

Students staying in NTU residential halls have to top up a stored-value card with cash before using it to pay for air-conditioning services in their rooms.

One of his neighbours had asked if he could modify one, such that it registered as having stored value even without a top-up.

He downloaded a specialised computer programme and used it to obtain the file information of two cards. He then used the details of a card with the maximum value of S$50 to overwrite another one with low value.

However, he did not personally use the modified cards as the air-conditioning unit in his room was faulty.

Soon, he discovered that he could modify Kopitiam cards as well. He began using two that he got from his relatives for his own use, and some of his friends borrowed them occasionally.

In the beginning of 2016, he realised that the cards could not be used at Kopitiam outlets any longer. 

He then modified the internal card numbers, but this method eventually failed in mid-2016. Kopitiam had started using cards with a strong encryption system.

Quek then started getting Kopitiam cards from other friends and modifying them. Through the online marketplace Taobao, he also obtained a specialised card to modify the unique identification numbers of the cards.

He used the cards to pay for parking fees, food, drinks and cigarettes. He gave the cigarettes to his friends as he did not smoke.

In May 2017, he began selling the modified Kopitiam cards on Carousell. He gave each card a stored value of S$100 and advertised them for about S$55 to S$70 each.

He met his customers at Kopitiam outlets so they could check the value in the cards. When they asked if the cards were legal, he replied that he got them through a friend’s company giveaway.

From May 23 to July 9, 2017, he modified 121 cards and sold them to 24 people. 

His offences came to light when a Kopitiam staff member at the Lau Pa Sat outlet noticed suspicious transactions made by another person. Quek was also captured on security footage at the outlet.

He stopped when a schoolmate told him his photograph was displayed at Kopitiam outlets. He was arrested on July 25 that year after the police tracked down several of his customers.

He has since made restitution of S$12,100 for the losses that Kopitiam suffered.

WILL REAPPLY TO UNIVERSITY: LAWYER

Deputy Public Prosecutor David Koh, who sought six months’ jail, argued that Quek was motivated by greed and had shown significant premeditation and planning.

While Tee’s case involved higher personal profits and losses for Kopitiam, DPP Koh said that Tee had stopped when Kopitiam lodged a police report. In comparison, Quek “persisted in offending” after encountering issues and “devised new methods of hacking”.

Meanwhile, Mr Tan argued that Quek’s conduct was actually amateurish. Among the points Mr Tan made was that Quek did not try to evade detection, which he contended was why Quek was caught within two months.

Quek had not thought his actions hurt Kopitiam or anyone else as he was not taking money from them directly, and he did not breach their back-end system or server, Mr Tan said.

“Alex was led on by his curiosity and the technical aspect of being able to overcome the puzzle of bypassing the closed system, rather than any real criminal intent to defraud or cheat Kopitiam,” the lawyer added.

While Mr Tan initially asked for probation or a community-based sentence, he eventually sought two months’ jail after District Judge John Ng said a custodial sentence was warranted.

Mr Tan also told the court that Quek will be re-applying to university once his case is concluded. He currently works as a media communications and information technology executive.