BT Explains: What you need to know about SMS phishing

THE sharp rise in phishing scams has cemented SMS as a weak link in online banking as more customers transact through their phones and attackers grow increasingly sophisticated.

Nearly 470 OCBC customers have lost at least S$8.5 million to such scams since last December. The bank has made goodwill payouts to more than 30 victims as at Monday (Jan 17), though it had earlier warned that the possibility of funds recovery is "very low" once money has left the customer's account - leaving many on high alert.

The Business Times breaks down the science behind SMS phishing and how customers can better protect themselves from falling prey.

1) Why does an SMS appear to be from OCBC when it isn't?

Most banks, including OCBC, currently use a service known as number masking. This means an SMS sent by OCBC shows up on a customer's phone as "OCBC", rather than an unfamiliar phone number.

But scammers are able to use this technology to replace any phone number with an alphanumeric "spoofed header" or sender IDs - most commonly the name of the bank.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

When a legitimate sender's ID is cloned, this enables the scammer's SMS to appear as if it is originated from a legitimate sender, thus enabling their message to appear in the same thread as legitimate SMSes from the bank.

2) How does phishing work?

In OCBC's case, customers received SMSes that appear to be from the bank, claiming there are issues with their bank accounts or credit cards.

These SMSes contain a link to a fraudulent website disguised as a legitimate bank website, requesting for bank account log-in credentials.

The scammer can then use those details to gain access to the customer's account and transfer monies out of the accounts.

OCBC said scammers often reroute the monies through various accounts, making it difficult to track their movement and even harder to recover the cash.

3) Why do banks use SMS if they are unsecure?

Banks commonly use SMS to notify customers of card transactions, fund transfers, ATM withdrawals, overdue charges and credit card activation, among other things. These messages sometimes include clickable links to product promotions. SMS is also used as a channel for 2-factor authentication where customers receive one-time passwords (OTPs).

In today's mobile-first era, SMS increases the speed of communication to customers and provides convenience for banks, since many processes can be automated.

SMS also ensures that customers still receive important alerts in the event that cellular data is unavailable, and is a format accessible to nearly all customers.

While it remains unclear if banks will scrap SMS use, the Monetary Authority of Singapore is working with the industry to explore additional measures such as lowering notification thresholds and enhancing fraud surveillance systems.

4) What should I do if I receive an SMS from a bank?

Never click on links provided in suspicious e-mails and SMSes. Always type the bank's URL directly into the address bar of a web browser or use its official mobile banking app.

When in doubt over the authenticity of any SMSes received, call your bank directly for verification. Even if the bank cannot be reached immediately, you do not need to respond to the SMS.

OCBC said it would never send customers an SMS to inform them of an account closure or that they have been locked out of their accounts temporarily.

The bank has also said it will no longer send SMSes with clickable links, so as to help customers identify fraudulent ones more easily.

5) What else can I do to ensure the security of my bank account?

iOS phone users can download the ScamShield app that blocks unsolicited messages and calls.

Cease the use of SMS OTP for log-in authentication and transactions where possible. BT understands this service varies from bank to bank. Switch to digital tokens as they are more secure.

More importantly, do not divulge your banking log-in credentials or OTPs to anyone, or key such confidential information into unverified webpages. Do not transfer money to strangers. When in doubt, get advice from a family member or friend.