Singapore banks see higher requests for physical tokens in January

MORE consumers are requesting physical security tokens amid the recent SMS phishing attacks, perhaps reflecting elevated levels of overall distrust and anxiety over digital banking services.

This comes even as lenders and some cybersecurity experts have claimed digital soft tokens are just as secure for 2-factor authentication (2FA).

In response to queries from The Business Times (BT), UOB said it has seen a daily average of 15 enquiries for physical tokens over the last few days, up from a daily average of 10 at the start of January.

DBS saw "marginal" increase in similar enquiries over the past few weeks, though the vast majority of customers are using digital tokens, said its Singapore consumer banking head Jeremy Soo.

OCBC has likewise seen an increase in requests for physical tokens this month. But the average daily "remains at less than 2 per cent" of the overall requests for tokens for digital banking, said its head of global consumer financial services Sunny Quek.

"The majority of customers request for and use digital tokens," he told BT.

That said, OCBC had recently reversed earlier plans to phase out physical tokens by March 2022.

DBS customers can also opt for physical tokens on a case-by-case basis. This comes after the lender previously announced it had completely phased out issuance since April 2021.

"We recognise that there may be a small minority of customers who are unable to use digital tokens, for instance, customers who may not own a smart phone," said Soo.

UOB head of group personal financial services Jacquelyn Tan told BT tokens are issued on "exceptional request basis", such as for seniors who may face difficulties in using a mobile device or if the customer's mobile device does not support the minimum requirements for UOB's digital banking app.

The lender will continue to issue digital tokens by default.

"While we can understand the anxiety recent media coverage has caused, it is important that customers are assured that both physical and digital tokens are equally effective and secure," said Tan.

BT understands that Citi will also issue physical tokens on a special-request basis, such as to Singaporeans based overseas.

Meanwhile, Standard Chartered has completely phased out hard token issuance since 2019.

A bank spokesperson said 2FA can only be done via a virtual security token integrated within StanChart's mobile banking app, which comes with "enhanced encryption capabilities" that improves overall security.

With the soft token, it also alleviates the risk of physical tokens being stolen or misplaced, the spokesperson added.

In the latest phishing scams, at least 469 OCBC customers were tricked into divulging their account information on a fake website, which scammers then used to activate the bank's digital token to authenticate transactions.

But DigiCert senior director of business development Dean Coclin said hardware security tokens are "not anymore secure than digital tokens", and comes with a slew of challenges.

"These physical tokens are often vulnerable to theft, breach of codes, as well as man-in-the-middle attacks. Additionally, they are more expensive, easy to misplace and are difficult for IT departments to manage," he told BT.

Checks by BT found that banks charge an average fee of S$20 for a token.

Using a digital token eliminates the need to pay for and keep track of a physical object, but lenders would now have to put in more work to reassure customers that their accounts are secured.

To combat fraud and scams for digital token set up, banks in Singapore will be required to, within the next week, implement a delay of at least 12 hours before customers can activate a new soft token on a mobile device.

This is among additional measures introduced by the Monetary Authority of Singapore and the Association of Banks in Singapore on Jan 19 to tighten security on digital banking services.

Customers will not be able to make certain online and mobile banking transactions during the cooling period.

"The fight against scams is a shared responsibility. All stakeholders, including banks, telcos, SMS aggregators and customers, need to collaborate on initiatives and solutions that are comprehensive and effective in protecting our customers," said Soo.