Banks, customers to share scam losses; framework to seek views: Wong

Singapore

EVEN as banks adopt new and better technologies to bolster the security of digital banking, it is important to establish a framework for sharing the liability for scam losses, said deputy chairman of the Monetary Authority of Singapore (MAS) Lawrence Wong in Parliament on Tuesday (Feb 15).

This comes as OCBC's recent goodwill payouts to fully cover scam victims' losses were made as a one-off gesture and do not set a general precedent for future cases, said Wong, who is also finance minister.

The Payments Council chaired by MAS has been working on a framework - expected to be published for public consultation within the next 3 months - on how losses arising from scams are to be shared among consumers and financial institutions.

"Under this framework, both banks and their customers have their respective responsibilities and the share of losses each party bears will depend on whether and how the party has fallen short of its responsibilities," said Wong, addressing some of the 39 parliamentary questions arising from the recent OCBC phishing scams.

These responsibilities will be clearly and specifically set out, said Wong in response to queries from the Members of Parliament regarding the legislation of the framework.

The framework for the sharing of losses should also be applied consistently across the entire industry, said Wong.

The shared responsibilities of all the key parties, including players operating the communications infrastructure, will be considered to ensure that there is proper accountability, he added.

Some 790 OCBC customers had fallen prey to SMS phishing scams, with total losses amounting to S$13.7 million. More than 90 per cent of the affected customers have been reimbursed and the remaining reimbursements should be disbursed soon, said Wong.

Providing an update on the ongoing investigations in Parliament, Minister of State for Home Affairs Desmond Tan said that as at Feb 13, the police have frozen 121 local bank accounts and recovered about S$2 million lost by victims in phishing scams targeting OCBC customers.

Some S$2.2 million of victims' funds have also been traced to 89 overseas bank accounts, said Tan, who chairs the Inter-Ministry Committee on Scams (IMCS).

At least 107 local and 171 overseas IP addresses were linked to the unauthorised access of the victims' Internet banking accounts.

The police have commenced investigations into the local IP addresses linked to the scam, and the owners of the local money mule accounts.

Meanwhile, MAS and the banks are taking steps to strengthen the safeguards against such scams.

Among measures include banks accelerating the shift towards the use of mobile banking apps for customer authentication, transaction authorisation and delivery of bank notifications.

MAS and the banks are also reviewing the use of SMS to deliver one-time passwords (OTPs) and potential risk mitigation measures that should be taken if such a practice continues.

In a bid to boost fraud surveillance capabilities, MAS will expect banks to develop more versatile algorithms through artificial intelligence (AI) and machine learning to detect suspicious transactions, said Wong.

Banks should also step up their ability to immediately block suspicious transactions and reach out to their customers to verify their authenticity, said Wong.

The authorities are therefore looking into enabling customers to trigger a freeze on their own accounts without having to contact the banks if they suspect their accounts have been compromised.

As an additional layer of security, banks are exploring expanding the use of biometric technology, in addition to passwords and OTPs, as a means of authentication.

More customer confirmations, beyond just notifications, for significant changes to accounts or high-risk transactions, may also be introduced.

The communication infrastructure, on the other hand, will be enhanced through upstream measures, said Minister for Communications and Information Josephine Teo.

Government agencies will explore the use of AI to identify and block spoofed websites, said Teo, who is also Minister-in-Charge of Smart Nation and Cybersecurity.

The National Crime Prevention Council will by the third quarter this year, launch a WhatsApp channel to crowdsource information on scam websites and messages from the public, said Teo.

The police and Infocomm Media Development Authority (IMDA) are already working with Internet service providers to block scam websites.

In 2021, 12,000 suspected scam websites were blocked as authorities cast their net wider, a sharp rise from about 500 such websites blocked a year before.

In the OCBC case, over 350 scam websites were blocked, with as many as 52 sites being blocked in a single day.

As for phone calls, Teo said that telcos already block around 15 million calls each month, or about 1 in 7 of all incoming overseas calls to Singapore.

Still, the government expects the number of scam calls to rise, given the changing tactics of scammers to increase their reach, said Teo.

Telcos here therefore plan to build in additional analytics capabilities to block more of these suspected scam calls, estimating some 55 million calls to be blocked each month.

To improve coordination of anti-scam enforcement and investigations, the police will be forming an Anti-Scam Command this year to consolidate expertise in scams across all its units, said Tan.

Tan also urged the public to download ScamShield, to filter out scam messages and block scam calls. The app is available on iOS devices, and the Android version will aim to be released in the next few months, he said.