Fake SMS scams: Do banks and telcos have a duty of care to customers?

Singapore

WHEN some OCBC customers started receiving SMSes last month that they were being locked out of their accounts, quite a few were duped into clicking on a link that mirrored the OCBC website but was actually set up by scammers.

The links in the messages should have sounded alarm bells in the customers' heads, as they did not look the same as official OCBC website links. But these customers were lulled into a false sense of security because the SMSes showed up in the same message threads of older, but official OCBC messages.

Customers who lost money to these scammers have complained to the banks, but attention is also turning to the role of the telcos in masking the identities of senders in the first place.

Industry experts The Business Times spoke to said such scams are possible because malicious actors can send SMSes with the same sender ID as another organisation.

Most organisations, including banks, already use a service called SMS number masking. This means that an SMS from OCBC will display on a customer's phone as coming from OCBC, rather than from a string of unfamiliar phone numbers.

But number-masking technology can also be used by scammers to replace any phone number with an alphanumeric "spoofed header" or sender IDs - most commonly the name of the bank.

In theory, this means nearly anyone can impersonate a bank. But BT's checks also found that regulations and procedures exist to minimise such spoofing, and to make SMSes more secure.

According to Twilio, a cloud communications platform that allows its clients to send SMS messages to consumers, pre-registration is required in countries such as Armenia and Qatar to send messages with alphanumeric sender IDs.

In Hong Kong, where such pre-registration is required to send messages on the China Mobile Hong Kong network, messages sent with a non-registered sender ID will fail to deliver. A Twilio form to register a sender ID in Hong Kong requires companies to submit their address, company website and their purpose for using their sender ID, among other details.

But most countries - Singapore included - do not mandate pre-registration to send SMS messages with such sender IDs.

Infocomm Media Development Authority (IMDA) did not respond to BT's queries, including one asking why pre-registration to send messages with sender IDs is not required.

In the United Kingdom, where such pre-registration is also not required, the National Cyber Security Centre (NCSC) encourages organisations to better understand how their SMS messages are sent. This is because some third-party organisations that send messages for companies may not do so directly, but instead forward these messages to fourth parties to pass SMS traffic to mobile network operators (MNOs).

The NCSC therefore encourages companies to use so-called Tier 1 SMS aggregators, which have a direct connection to MNOs. Such aggregators are able to engage with MNOs to block messages claiming to be a company but which did not originate from the aggregator itself.

Examples of companies that claim to be Tier 1 SMS aggregators include Hello Technology and Commzgate. On its website, Commzgate lists the Singapore government, SMRT Taxis, the Esplanade and Ascendas among its clients.

Checks by BT showed that Commzgate also works with telcos in Singapore to register the companies that Commzgate represents, thus preventing local malicious actors from sending messages as their clients.

OCBC and DBS both told BT that they use Tier 1 SMS aggregators, which have registered both banks with the local telcos. UOB could not be reached at press time.

Nevertheless, aggregators told BT that the registration process with local telcos applies only to Singapore-based aggregators. Foreign players, therefore, could slip through the net.

The telcos also say they employ several other means of preventing SMS scams.

A Singtel spokesperson said that it actively investigates customers' feedback on scam SMS messages. The sources of these messages and their embedded hyperlinks are blocked if they are found to be bogus.

Similarly, StarHub said it has put in place safeguards to block SMS sent from commonly spoofed numbers to better protect its customers and emphasised that education is key to mitigating the impact of scams.

M1 said it has installed safeguards to alert customers and decrease the chances of phishing attempts; it also urges its customers to exercise caution in protecting themselves from phishing attempts.

TPG said it is coordinating with the IMDA on the measures that it has implemented regarding SMS scams, and is not at liberty to discuss the details.

Several government programmes to prevent such scams are also underway.

The National Crime Prevention Council (NCPC) has worked with GovTech and the police to develop ScamShield, a mobile application that can identify and filter scam messages. Calls from phone numbers used in scam cases or that were reported by other ScamShield users are blocked.

The application was launched in November 2020 for iOS users and will be released for Android users later this year.

In response to a Parliamentary query this week on Internet-related scams, Home Affairs and Law Minister K. Shanmugam said the police, under Project Frontier, have established processes with financial institutions to freeze bank accounts suspected to have links to scams and mitigate victims' losses.

From January to November 2021, the police froze more than 5,400 accounts and recovered S$65 million in scam proceeds.

Still, Shanmugam said the public should remain vigilant: "Combatting scams is a whole-of-society effort, and members of the community play an important role in the fight. We urge the public to be alert, and to raise our collective awareness of scams by sharing scam prevention tips with your friends and family."