Banks should bear all phishing scam losses

SOME years ago, I went to one of Singapore’s local banks to remit money overseas. A rather harried-looking employee at the branch told me it would be far easier and cheaper if I did the transaction online.

Not wanting to spend time figuring out how to do it myself, I insisted that she do it for me. She tried a few more times to dissuade me, but eventually gave in and grudgingly did what I asked.

As I walked out of the bank, I was feeling rather irritated. Why did the bank make such a fuss over a simple transaction? Why push me to some do-it-yourself online channel? What happened to customer service?

In fact, I was so turned off by the whole experience that I subsequently learned how to remit money overseas via the bank’s online platform – just so I would not have to deal with reluctant staff at the branch again.

And, yes, now that I have figured it out, it is very easy to do.

These days, I rarely go to the bank at all. That’s thanks to the pandemic-era lockdowns, when we were confined to our homes and the bank branches I frequented were closed.

During those dark days, I was forced to learn how to manage my finances via my laptop and phone. Even though our movements are no longer restricted, I doubt I will ever write another cheque or settle my share of dinner and drinks with cash.

It was certainly fortunate for the banks that the pandemic came along and pushed everyone to embrace their labour-saving online platforms.

But have bank customers been made to trade off security for convenience? Have the banks invested sufficiently in their online platforms?

Last month, there was a fresh spate of phishing scams, this time involving customers of DBS. This came only a few months after an earlier wave of scams that targeted customers of OCBC.

While some of my younger colleagues felt these bank customers ought to have recognised that they were being scammed and have only themselves to blame, I cannot help feeling sympathy for the victims.

After all, nobody loses money on purpose. And, much like me, they probably had little choice in turning to online banking.

MAS, ABS taking action

The Monetary Authority of Singapore (MAS) and Association of Banks in Singapore (ABS) seem to have redoubled their efforts to ensure that digital banking remains secure and trusted.

In January, MAS and ABS said banks in Singapore would take a number of immediate steps to detect and prevent scams.

This included, among other things, setting the threshold for funds transfer transaction notifications at S$100 or lower; and sending notifications to customers’ existing mobile numbers and email addresses whenever there is a request to change them.

Banks were also required to put in place dedicated and well-resourced customer assistance teams to deal quickly with feedback on potential fraud cases.

Further measures were announced in June. In particular, banks will provide their customers with a self-service “kill switch” to suspend their accounts quickly if they suspect these accounts have been compromised.

Banks will also facilitate rapid account freezing and fund recovery operations by co-locating staff at the Singapore Police Force Anti-Scam Centre.

Meanwhile, MAS said on Feb 4 that a framework for equitable sharing of losses arising from scams would be published for public consultation within 3 months. The proportion of losses that the banks and their customers bear will depend on whether and how each party falls short of its responsibilities, MAS said.

Financial institutions have a responsibility to protect their customers, including through robust controls to safeguard customer accounts as well as measures to detect and respond to suspicious transactions.

On the other hand, MAS said customers have a responsibility to take “necessary precautions”. This includes not giving away their banking credentials to anyone, never clicking on links embedded in SMSes or emails purportedly sent by banks, and transacting only through the official websites and mobile apps of their banks.

The consultation will also cover the responsibilities of other key parties in the ecosystem, MAS said.

Underinvestment by banks?

Is making banks and their customers share the losses from phishing scams a good idea?

Clearly, much depends on the precise details of the loss-sharing framework – the publication of which is now 2 months past the timeline indicated by MAS.

While it makes sense to ensure all parties are incentivised to be alert and vigilant, the risk is that banks engage in a box-ticking exercise to push the onus of avoiding losses to their customers.

Let’s say fraudsters manage to change a customer’s contact details, and the bank sends notifications to the customer’s existing mobile number and email address, as it is now required to do.

If the customer fails to immediately get in touch with the bank or hit the self-service kill switch, would the bank be less culpable for any ensuing theft of the customer’s funds?

At the end of the day, it is the banks rather than their customers that can be effectively incentivised to develop and maintain trust in the digital banking ecosystem.

The fact that the banks have recently been directed by MAS to take several measures – including removing clickable links from emails and SMSes, setting up proper customer assistance teams to deal with fraud cases, and sending out more frequent scam education alerts – also suggests they have underinvested in some important aspects of their online platforms.

Making the banks wholly responsible for losses arising from scams might be an effective way to address this underinvestment, and ensure that their online banking platforms are safe for users who really have no other choice.