Banks, customers to share scam losses; framework to seek views: Wong

EVEN as banks adopt new and better technologies to bolster the security of digital banking, it is important to establish a framework on sharing the liability for scam losses, said deputy chairman of the Monetary Authority of Singapore (MAS) Lawrence Wong in Parliament on Tuesday (Feb 15).

This comes as OCBC's recent goodwill payouts to fully cover scam victims' losses were made as a one-off gesture and do not set a general precedent for future cases, said Wong, who is also Finance Minister.

Some 790 OCBC customers had fallen prey to SMS phishing scams, with total losses amounting to S$13.7 million. More than 90 per cent of the affected customers have been reimbursed and the remaining reimbursements should be disbursed soon, said Wong.

The Payments Council chaired by MAS has been working on a framework on how losses arising from scams are to be shared among consumers and financial institutions. The framework is expected to be published for public consultation within the next 3 months.

"Under this framework, both banks and their customers have their respective responsibilities and the share of losses each party bears will depend on whether and how the party has fallen short of its responsibilities," said Wong.

While institutions should bear an appropriate share of losses arising from scams, care must be taken to "ensure that any compensation paid to customers does not weaken their incentive to be vigilant".

Beyond immediate measures that have been rolled out, banks are working with authorities to enhance their ability to deter, detect and combat phishing scams.

Among additional measures that are being considered include banks strengthening their fraud surveillance capabilities to identify suspicious and anomalous transactions.

Banks will soon be expected to develop more versatile algorithms through artificial intelligence and machine learning to detect suspicious transactions.

Such algorithms should be based on multiple sources of information, including customer profile and vulnerabilities, past transaction patterns, account activity, and mobile device identification.

Banks should also step up their ability to immediately block suspicious transactions and reach out to their customers to verify their authenticity, said Wong.

The authorities are therefore looking into enabling customers to trigger a freeze on their own accounts without having to contact the banks if they suspect their accounts have been compromised.

To add, MAS and the banks are exploring additional customer confirmations, beyond just notifications, for significant changes to their accounts or high-risk transactions. These include changes in account holder details, activating a token on another device, fund transfers that are large relative to their overall balances, and overseas transfers.

"This will introduce some friction to customers carrying out genuine transactions. But we will all need to adapt and get used to these inconveniences, in order to strengthen the security of digital banking," said Wong.

As an additional layer of security, bank are exploring expanding the use of biometric technology, in addition to passwords and one-time passwords (OTP), as a means of authentication.

Banks will also accelerate the shift towards the use of mobile banking apps for customer authentication, transaction authorisation and delivery of bank notifications. Meanwhile, MAS and the banks are reviewing the use of SMS to deliver OTPs, and the potential measures that should be taken to reduce risk if such a practice should continue.

But there is no single measure that can guarantee the security of digital banking given that techniques employed by scammers are constantly evolving and gaining in sophistication, said Wong.

MAS will work with the banks to strengthen these measures and set minimum parameters but it would be counter-productive to publish the specific calibration of these controls, he said.

"This is no different from why the red flags that banks look out for to detect money laundering transactions are not published in full," he added.

READ MORE:

• Singapore banks set for expansion in net interest margins, higher dividends in 2022
• MAS and ABS introduce new measures to bolster digital-banking security
• Economists not ruling out further tightening by MAS in April despite surprise off-cycle move
• Banks imposing extra security measures after recent SMS scams; OCBC will make 'full goodwill payouts'