Standards of reimbursement for bank scam victims could help financial sector digitalisation

SOME form of reimbursement standards for victims of bank scams could help the financial sector to mature digitally, industry watchers said, although a blanket reimbursement scheme would probably do more harm than good.

Rather than returning every penny to every scam victim, they advocated a standard that would complement other anti-scam measures put in place.

In Parliament last month, Workers’ Party chairperson Sylvia Lim said banks in Singapore should be required by law to fully reimburse scam victims, and in a timely manner without much hassle.

Lim said the Monetary Authority of Singapore’s (MAS) current approach – of holding customers responsible for their proportion of the loss – is inadequate and unjust. She argued that banks are better positioned and have more resources than customers to prevent scams.

Minister of State (MOS) for Trade and Industry Alvin Tan, however, said such a position could erode vigilance and personal responsibility, and also lull users into complacency.

Instead, Tan said, a balance must be struck between fairness, accountability and compassion.

Experts polled by The Business Times agreed with Tan’s position to some extent.

On their own, monetary reimbursements pose the risk of a moral hazard, said Thangaraja Nadaraja, a partner specialising in risk, regulatory and compliance for financial services at PwC Singapore.

This can be counter-intuitive to the wider objective of reducing system-wide losses caused by perpetrators, Nadaraja added.

Thilan Wickramasinghe, head of regional financials at Maybank Investment Banking Group, also noted that a blanket reimbursement scheme may cause customers to take less care as they know their losses will be covered.

This could also embolden criminals to target Singapore’s banking sector, Wickramasinghe added.

Meanwhile, banks’ operating costs will likely rise as they build scam compensation reserves – and earnings could be hit in the immediate aftermath, Wickramasinghe said.

A blanket reimbursement scheme may result in higher banking fees and insurance costs for customers, he added, noting that development of electronic payment systems may also be hindered by additional layers of security checks.

Nadaraja noted that monetary reimbursements are usually considered on a case-by-case basis, and can be in the form of reimbursement or ex-gratia payment.

In 2021, some customers at OCBC lost a total of S$13.7 million in phishing scams in a high-profile case that flagged the increased sophistication of scammers.

OCBC later reimbursed affected customers in full in a one-off gesture of goodwill, given the circumstances of the scam.

In 2022, about 60 DBS customers each lost between S$60 and S$3,000 to phishing scams.

Amid the rising number of scams, the government has sought to create an equitable loss-sharing framework for financial scams.

The framework, which aims to determine how losses from scams will be shared between customers and financial institutions, was slated to be published in 2022.

MAS subsequently delayed it due to the complexity of the issues involved.

Said Wong Nai Seng, regulatory strategy leader at Deloitte South-east Asia: “Banks and their customers both play important roles in the fight against financial crime – this should be recognised in any framework for addressing losses arising from scams.”

In a bid to strengthen protection against malware scams, the Association of Banks Singapore (ABS) said major retail banks in Singapore have enhanced their security measures on their banking apps.

OCBC was among the first to roll out new security features, restricting the use of its app if the device has apps downloaded from other portals instead of an official store.

Recently, Citi, too, said it will restrict users’ access to its app if risky permissions are detected on other apps.

UOB and DBS on Sep 26 said they will restrict customer access to their apps in the event of any ongoing screen-sharing or screen-mirroring activities.

UOB will also restrict access if it detects apps with “risky permissions settings”; DBS/POSB customers will not be able to access their accounts if malware is detected, or if malicious applications or unverified applications have accessibility permissions enabled.

Yet, OCBC’s latest security measure received mixed reviews. The bank said the update managed to prevent losses of S$2 million in a month, but some customers said it was an invasion of privacy.

Commenting on the overall industry, PwC’s Nadaraja said it is crucial for both banks and customers to recognise that every layer of security comes with trade-offs on customer experience.

“While some measures may seem intrusive, they are often designed with the primary intent of safeguarding users’ financial assets and personal information,” he said.

Nevertheless, some form of reimbursement may be beneficial for industry development.

Transparent, industry-wide scam reimbursement standards can build confidence in Singapore’s payment network as it transitions into a cashless society, said Maybank’s Wickramasinghe.

He expects users will accelerate migration to cashless payments when they know protections are in place.

“By shifting some of the onus of scam protection to the banking sector, rather than fully resting on the consumer, it could incentivise better innovation, collaboration and enforcement within the industry,” he said.

Nadaraja also said it is important to recognise that scams are complex, and the roles played by various entities and individuals vary.

“Investment into efforts to educate, as well as in identifying scams along with unusual transactions, are just as important in the broader endeavour to reduce the total losses arising from scams,” he added.

In the latest update, MOS Tan said in Parliament that the government will aim to publish the consultation paper on the loss-sharing framework in October.

The three local banks declined to comment on the matter. ABS also declined to comment, ahead of the release of the consultation paper.