Singapore banks have stepped up efforts to prevent SMS phishing scams with initiatives to be implemented from Monday.

The more stringent measures may cause slight delays for certain online banking transactions but will provide an additional layer of security to protect customers’ funds, says the Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS).

Robust measures to deter scams

• Retail customers will no longer receive clickable links in e-mails or SMSes. With no clickable links in official bank messages, customers will be able to easily distinguish a message from scammers. If the message asks you to click on a link and then enter your customer details and password, call your bank immediately.

  Banks will never send SMSes that direct customers to a website to perform a transaction or ask for your username/password, one-time password (OTP), or any other banking information such as card PIN
   
• A default threshold of $100 or lower for funds transfer transaction notifications to customers. The notifications will keep customers informed of their transactions and help them to flag unauthorised transactions to their bank sooner.

  It is important that customers continue to pay close attention to these notifications so you can monitor your account and react immediately if anything seems amiss
   

• Cooling-off period of at least 12 hours after a new soft token is set up on a mobile device. The cooling-off period will prevent an immediate account takeover by the scammers and provide time for customers to notice if their soft token had been shifted to an unauthorised device
   
• A notice will be sent to the customer’s mobile number or e-mail registered with the bank whenever there is a request to change their mobile number or e-mail address. This ensures that customers are aware of any changes to their contact details prior before they are made
   
• Dedicated and well-resourced customer assistance teams to give priority to customers concerned about potential fraud
   
• More frequent scam education alerts

Q: Should I ignore all bank notifications – via SMS or e-mail – that have clickable links in them?

A: No. In fact you should pay attention so you can monitor your account and react immediately if anything seems amiss.

Banks are removing clickable links from their SMS and e-mail communications with retail customers, and will complete this system change by Monday.

Q: How can I be sure that the SMS or e-mail that I have received is truly from my bank?

A: If you suspect that something is amiss, stay calm and call the bank on its official hotline immediately to verify its authenticity. 

Q: Is it safer to transact via my bank's mobile app compared to its website?

A: Both the bank’s mobile app and website offer secure access via two-factor authentication (2FA).

Ensure that you have entered the correct website address and do not click on links to get to the bank’s website.

Customers can look for signs such as misspelling in the URL or domain name for spoofed websites.

Q: What else can I do to better protect myself from scams?

A: Stay updated: Keep yourself up to date of the latest scams types and how they work, and take heed of scam advisories.
Stay calm: Always verify the authenticity of the message through the bank’s official channels – scammers use time pressure and tap on fear to prey on their victims.
Stay cyber safe: Practise good cyber hygiene by doing the following:

• Never reveal your banking details or OTP to anyone
• Do not click on URL links provided in unsolicited e-mails or text messages and always verify the authenticity of the information with the bank’s website or sources
• Always perform your banking transactions through the bank’s channels such as its mobile banking app or personal banking website

Q: What can I do if I suspect that I am a victim of a phishing scam?

A: Call your bank immediately if you suspect any irregularities with your accounts, and call the Singapore Police Force’s Anti-scam helpline: 1800-722-6688

You should also change your passwords immediately. Alternatively, you can deactivate your account by repeatedly using an incorrect password.

Q: Why has the default threshold for funds transfer transaction notifications been changed to $100 or lower?

A: A lower notification threshold will help customers better monitor their account activity and flag unauthorised transactions earlier to their bank, to halt further unauthorised access.

Q: Why do I have to wait at least 12 hours before the new soft token on my phone is activated? 

A: The cooling-off period will prevent an immediate account takeover by the scammers and provide time for customers to notice if their soft token had been shifted to an unauthorised device.

Q: What is the SMS SenderID registry? Does this mean that I do not need to worry about fraudulent SMSes anymore?

A: A secured SMS and mobile communication network is important to Singapore to have a trusted national digital infrastructure. For the SMS SenderID Protection Registry to be effective, all relevant stakeholders in the digital ecosystem need to be involved. It is imperative all relevant stakeholders work together to find more permanent solutions to combat SMS spoofing.

Nonetheless, the registry is not foolproof in preventing SMS spoofing so you must stay vigilant.

Scammers are constantly evolving their tactics. You can stay up to date of the latest scam types by reading scam advisories from the banks and the Singapore Police force.

This was produced in partnership with The Association of Banks in Singapore