DBS says all duplicated card transactions refunded on June 19, day after incident

DBS on Saturday said that all duplicate card transactions - which were reported by customers on Friday - have been successfully refunded.

In a Facebook post - with the latest update as at 10.45am - Singapore's largest bank said any fees or charges as a result of this incident will be waived. 

"Our systems are safe, secure and uncompromised. We apologise for any undue anxiety and regret the inconvenience caused."

The post did not say how many customers had been affected by the payment processing glitch that occurred on Friday. 

Some DBS customers reported from Friday morning double charges on transactions made using their credit and debit cards due to a payment processing glitch. The lender's online banking services were also down for the day amid heavy traffic.

BT understands that while many customers flagged double charges on their cards, conversely, there may be some who were paid twice.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

These customers had most likely deposited cash at an ATM, received a peer-to-peer transfer, or are simply merchants who got paid for their goods. And based on anecdotes, some customers indeed had the same amount of money credited into their accounts twice.

In a statement on Friday night, a DBS spokesperson said that the issue has been resolved and that automatic refunds are expected to be completed by this weekend. The lender did not disclose how many customers were affected or the total value of transactions.

The Business Times understands that some accounts have gone into negative balances as a result of the glitch.

"DBS discovered a payment processing glitch that resulted in duplicate transactions on some debit and credit cards. The issue has been resolved and we would like to assure all customers that our systems remain safe, secure, and uncompromised. The automatic refund process is now underway and will be completed by this weekend. We apologise for any undue anxiety and inconvenience caused," said its spokesperson on Friday.

In response to queries, the Monetary Authority of Singapore (MAS) said that it has instructed DBS to conduct a thorough investigation of the incident and submit the report to MAS. Supervisory actions will be taken if the bank has fallen short of MAS' expectations. "MAS takes a serious view of this incident. We expect all financial institutions to put in place processes to ensure the reliability of their IT systems and the effective delivery of financial services to their customers," a spokesperson told BT.

Cyrus Daruwala, managing director for IDC Financial Insights, surmised in response to a BT query that there had been a systemic error, which could take between 24 to 36 hours to resolve given back-end complications and the potential number of transactions impacted.

He explained that the duplicate transactions could have occurred due to a failed data reconciliation at the back end that caused charges to be recorded twice.

"They must have been fixing something or doing a systems upgrade... a technical upgrade to their mobile banking as well as the Internet banking system. Because these two run on parallel systems, they created two separate records and those records were not reconciliated at the back end. It's showing two different entries as if there were two separate entries, but they are, of course, the same," he said.

Mr Daruwala reckoned that recovery will stretch into the weekend as the bank has to verify every affected transaction, which could have been in the "hundreds and thousands" by now.

"The reversal of transactions is easier said than done because it is a systems glitch. It takes a very long time because every transaction has to go through many stages in the system," he told BT.

To be clear, each transaction has to go through an authorisation and approval process before the actual turnaround can be executed.

"Then there's the clawback where every customer who received double amounts will have to agree to pay back. DBS can't just go into your account and say: 'I'm taking S$10'. So that, I think, is going to prolong the charge backs," noted Mr Daruwala.

He added that the bank's work-from-home arrangements amid Covid-19 restrictions - coupled with less IT support staff working over the weekend - could prolong recovery.

DBS' digibank app and website were down since Friday noon, with the lender citing heavy traffic.

Candid Wuest, vice-president of cyber protection research at Acronis, told BT that online banking services will most likely normalise within the next 24 hours. "The investigation launched by the bank and the concerned customers trying to login to check their balances resulted in a traffic spike and some customers no longer being able to log in."

He further said it is unlikely that transaction logs are completely lost; it is "just a matter of time" till the balances are corrected, and DBS has committed to refunds.

Last November, a number of DBS customers had faced difficulties accessing the business banking portal, DBS Ideal, for more than a day. Separately in December, some customers who attempted to log into the digibank app were met with an error message notifying them of technical difficulties. The issue was resolved within an hour for some users.