Singapore regulator ramps up scam loss liability plan after $13.7m spoof case

The Monetary Authority of Singapore (MAS) said on 4 February it was working with the industry "in the coming months" to "develop a framework for equitable sharing of losses arising from scams".

This comes after 790 OCBC Bank customers lost $13.7m in recent scams where fraudsters spoofed its name to send fake SMSes with phishing links to victims.

OCBC's recent goodwill payouts to fully cover the scam losses of customers "were a one-off gesture by the bank in the circumstances, which included the bank's consideration of how it had not met its own expectations of customer service and response", the regulator said adding "They do not set a general precedent for future cases." 

Some OCBC customers said that 20 minutes or more to get through to a person via its hotline that, by the time it was able to take action, the scammers had siphoned off much of their funds.

MAS further said banks in Singapore had substantially implemented the additional measures1 to bolster the security of digital banking announced on 19 January 2022.

The Payments Council, chaired by MAS, had been working since July 2021 on a framework that aims to provide clarity on how losses arising from scams are to be shared among consumers and financial institutions.

Under the framework, all parties had responsibilities to be vigilant and to take precautions against scams.

Financial institutions have the responsibility to protect their customers, the MAS continued, such as through robust controls to safeguard customer accounts, and effective measures to detect and respond to suspicious transactions.

"Customers have the responsibility to take necessary precautions, especially by never giving away personal or banking credentials to anyone, never clicking on links in SMSes or emails which are claimed to be sent by a bank, and transacting only through the bank's official website or mobile application.

"The proportion of losses each party bears will depend on whether and how the party has fallen short of its responsibilities. MAS expects financial institutions to treat their customers fairly and bear an appropriate proportion of losses arising from scams.

"At the same time, care must be taken to ensure that compensation paid to customers does not weaken their incentive for all to be vigilant. OCBC's recent goodwill payouts to fully cover customer losses were a one-off gesture by the bank in the circumstances, which included the bank's consideration of how it had not met its own expectations of customer service and response. They do not set a general precedent for future cases."

MAS said it aimed to publish the framework for public consultation within the next three months. Other than the sharing of losses, the consultation will also cover the responsibilities of other key parties in the ecosystem.

Customers were urged to exercise greater vigilance and adhere to the following digital safety practices:

• Never click on links provided in SMSes or emails claimed to be sent by banks.
• Never disclose internet banking credentials or passwords to anyone, including persons claiming to be from banks or government agencies.
• Verify SMSes or emails received by calling the bank directly on the hotline listed on its official website.
• Transact only on the bank's official website, or through the bank's official mobile application.
• Closely monitor transaction notifications received from the bank so that any unauthorised payments are reported as soon as possible to increase the chances of recovery.
• Keep your devices updated with the latest security patches and anti-virus software.