DBS, UOB to continue offering physical tokens on request

DBS and UOB have separately said they will continue to offer physical security tokens to customers, in response to queries from The Business Times on Friday (Jan 7).

This comes after OCBC's latest decision to halt its move to phase out hardware tokens - previously slated for end-March 2022 - amid the sharp rise in online fraud involving the bank last month.

DBS had stopped issuing physical tokens since February 2021 and fully phased out the use of these tokens in April 2021.

But a spokesperson on Friday said customers can still request for a physical token on a case-by-case basis, though majority of its customers are using digital tokens.

UOB had stopped issuing physical tokens automatically in 2018, though customers can still opt for one.

Its head of group personal financial services Jacquelyn Tan told BT there has not been an increase in requests for physical security tokens, with average monthly requests down about 60 per cent year-on-year in 2021.

As more people bank through their phones and cyber threats grow increasingly sophisticated, Singapore has seen a surge in scam victims, from phishing attacks to identify theft.

Most recently, nearly 470 people had lost at least S$8.5 million in SMS phishing scams impersonating OCBC since the start of December.

But to be clear, digital tokens - integrated within a bank's mobile banking app - are said to be just as secure as physical tokens in providing an added layer of security via two-factor authentication.

Security tokens, whether in digital or physical form, generate security codes used to access online banking accounts and authorise services.

This is an additional step after the user has entered their username and password details.

"To be most effective, it is critical customers never reveal any banking details or one-time passwords (OTPs) to anyone. This will help them to avoid falling prey to scams," said Tan.

DBS said its digital token has in-built security features such as end-to-end encryption that provides multi-layered protection.

Customers fall prey to fraud, whether via phishing or identity theft, when their banking credentials are compromised.

"We would like to remind our customers to remain vigilant and proactively take precautionary measures to protect their credentials and devices. This includes not revealing their banking credentials, such as their PIN or OTP, to anyone," said the bank's spokesperson.