4 banking habits that can prevent scams
You can lessen the risks of being scammed substantially with good financial practices
Sign up now: Get ST's newsletters delivered to your inbox
Picture this - a man wearing a jacket bearing the name of your bank turns up at your door, declares there is a problem with your account and asks you to hand over your details so he can fix the issue.
And all without showing a bank identification card or even seeming to know your name.
Pretty much everyone would spot this as a scam and laugh at the notion of handing over important bank details to a guy with "crook" written all over his face.
Even the idea that a bank would send an employee door to door to ask for customers' details is preposterous in itself. The reality is no bank would ever approach customers and ask for banking details outside of a branch.
This applies even to online banking.
Remember those times you call the bank for assistance? They ask for personal details only to verify your identity; the staff do not ask for your account details because a real bank knows everything about you. Only scammers want such information because they don't know who you are and what accounts you hold.
Most people would not hand over bank details to strangers who show up at their doors even if they wear a shirt with the bank's name.
But how come such vigilance disappears when you receive an SMS or e-mail asking you to hand over your banking details by logging into a site? And instead of wearing a bank's name on their shirts, online scammers spoof the bank's name via electronic messages to say your account has a problem and that you must key in your account details by clicking on the attached link.
The message still does not identify you by your name or IC number, and if you pause to think for a moment, why would a bank ask you to log into your account to verify a banking problem when it could resolve such issues at its end?
Yet scores of bank customers have fallen victim to such phishing scams, which lure them to part with critical data by setting up fake bank sites. In the latest phishing scam involving OCBC bank customers, 790 of them lost a total of $13.7 million to the crooks.
Such scam tactics have been around for years, so it is worrying that many of the recent victims were young and tech-savvy; some even worked in tech-related jobs.
Cyber-security and corporate governance expert Anthony Lim, who is a fellow at the Singapore University of Social Sciences, believes that the pervasive use of social media and online services has made many people impatient - they yearn for instant results because they are used to getting answers with a tap of their phones.
"It is common knowledge that no bank will ask its customers to log into their accounts via SMS or e-mails whatever the circumstances and yet many people continue to do so. Scammers are counting on their behaviour of always clicking on links without checking and they have succeeded yet again.
"It is time for all of us to take a step back and pause... if there appears to be a problem."
Mr Lim notes that scammers always use "fear tactics" to push their victims into doing their bidding. Some of these ruses include claims that their accounts have been hacked, their relatives were hurt or kidnapped, and more recently, being in contact with Covid-19 patients.
He says people can avoid being ripped off if they take the time to make their own checks instead of following the instructions that come with such calls and messages.
Here are four good practices that can prevent you from being the next scam victim.
Always be on the alert when you are online
The authorities and the banks have stepped up various measures that can make it harder for scammers to siphon money from a victim's account. These include lowering the default fund transfer amounts as well as delaying the process of putting the changes to accounts, such as adding a new payee, into effect.
But all these efforts will come to nought if you still respond to unsolicited messages and calls and then disclose your account details. This is akin to allowing thieves to enter your home and hoping that someone will stop them before they escape.
Note that if a bank's database is truly compromised, it will usually make a public announcement and then take remedial steps to solve the problem. In short, if you didn't do anything that put your own account at risk, you have nothing to worry about.
Some people wonder why it is hard to recover the stolen money. After all Hollywood movies suggest that all bank transfers leave a digital trail that allows the cops to track down the criminals.
The reality is that once money is transferred overseas, it is hard to even locate the owners of the recipient accounts as they could just be money mules who allow their accounts to be used and they know nothing about the real masterminds.
Have only one online banking practice
Everyone who uses digital banking should do this - always do your banking transactions the same way and never deviate from this practice.
This means bank online only through the official bank apps on your phone or from your personal computer that is well-protected from spyware, and log into the genuine website by keying in the URL yourself, instead of googling for the bank websites.
This is because scammers are known to use online ads to push their fake sites to unsuspecting users.
Even if you feel compelled to log in to check after receiving a message that says your account is compromised, do so in your usual way and not by clicking any links in the message. And never use a stranger's device or do important transactions in public places because your keystrokes and inputs can be recorded easily, either by embedded software or hidden cameras.
Save important hotlines on your phone
When you plan for retirement, you start now and not wait when you are retired. Similarly, when you are planning for financial security, you do it now and not wait for troubles to hit you.
Start by saving all the relevant hotlines on your phone so that you can call instantly without having to search for the numbers online. Again, it is not wise to search for important information only when you need it because you can also end up with outdated, or worse, decoy links.
Don't keep big sums in your savings account
Some of the recent OCBC Bank victims had up to a few hundred thousand dollars in savings accounts that were wiped clean by the scammers.
This begs the question: Why keep so much money in a savings account because even from a financial planning perspective, this is not prudent given that you earn a pittance in interest every month.
Even if you prefer to hold cash and not invest it, put the portion that you are unlikely to use in the near future in a fixed deposit with a different bank.
Doing so will allow you to enjoy a higher rate because it is "fresh funds" to the new bank and if you do not have online banking with this bank, no one else can touch your money.
You can open a fixed deposit with the same bank but if a scammer gains access to your online account, you should know that fixed deposits can also be withdrawn online.
Yes, it is more troublesome to open a fixed deposit with another bank but the incentive for doing so is peace of mind and up to a couple of thousand dollars extra from the higher interest as a reward for your vigilance.
Scammers want you to give away personal data
Scammers all over the world are working hard to come up with new, ever more ingenious and devious ways to get you to part with your money.
It is impossible to predict what they will be up to next but you stand a fair chance of avoiding scams if you do not divulge your personal details easily in all kinds of scenarios.
Take the experience of one of our readers. He told Invest recently that he was surprised when a stranger deposited about $120 into his bank account via his mobile phone, which is registered with the PayNow system. He did not know the sender and wondered how the person obtained his phone number. But he made the right call - he went to his bank, which asked him to lodge a police report.
"The idea is to make it clear that I did not ask for and would not keep the money," he says. He then gave a copy of the report to the bank so that it could deal with the money.
Bank officials say that while strangers may be able to deposit money into your account using your mobile number, they would not be able to extract other banking information from such transactions or compromise the account's security.
It is unclear why the sender would deposit money into a stranger's account - after all, you are likely to be very careful when keying in the recipient's data before you press "submit".
So what should you do if this happens?
Never call or disclose your particulars
First, don't call the sender because he may be expecting to hear from you because he could be recruiting potential money mules. He could say he made a mistake and give you a number to return the money but if you follow this instruction, you could unwittingly get yourself implicated in a money laundering process.
Another possibility could be that the sender is trying to find an opportunity to meet and befriend you so that he can lure you to part with more money. In such cases, you would be better off to just contact your bank and follow its advice on what to do next.
Even if the unexpected deposit is made by someone you know, such as a casual business contact or a vendor, and the person said he made a mistake, you should not be in a hurry to reverse the transaction via PayNow because you can end up giving the full name you use for your bank account to the recipient.
Instead, ask for his full name and banking details so that you drop off a cheque into his bank's deposit box. In this way, the recipient won't be able to see your personal details on the cheque.
Yes, it is a hassle but you must guard your personal details jealously because information like this is being traded by crime syndicates in the darknet, which is the notorious digital underworld.
Don't give details freely in lucky draws
Frankly, all of us should stop taking part in any lucky draws that require us to fill in our full name, home address and mobile numbers on a slip of paper that is then deposited in a box.
This information can be abused because there is no telling where these slips will end up after the draw. Don't count on every business to shred and burn every slip - note that customer details can be dug out of garbage bags when these slips are improperly disposed of.
Ever wonder how scammers can call or send messages to your phone when your number is unlisted? It is not illogical to assume that one potential source could be from the details you freely gave away in such casual lucky draws.
Even if there is another explanation, retailers should stop making their customers fill out their particulars on paper slips when many already have membership programmes that keep such data.
Businesses that truly want to reward customer loyalty should use such programmes to give away prizes and not resort to quaint paper slips that can be a source of information leaks.
Never feel threatened by calls or messages from an unknown source
Scammers are counting on you to be afraid or lose your cool because people tend to be hasty and do things without thinking when they are faced with dangers or threats to their security.
For instance, according to the accounts of some victims in other countries, some scammers can allegedly copy and mimic the voice of your relatives - presumably after they make some nuisance calls to them earlier - to lure you into thinking that they need you to send money because they have been kidnapped or involved in some accident.
If this happens, just remember that you are in Singapore and that you can seek help from one of the best police forces in the world.
Moreover, unless you are a famous tycoon, the probability of someone wanting to kidnap your relatives, an offence that can attract the death penalty, is practically zero.
So the first thing you should do is to end the call and then try calling your relative, or your other kin.
Stay calm until you reach someone, and you can always call the police for help as a last resort.
Finally, what happens if you see this message on your phone - "We have detected a $1,000 charge on your credit card. If you did not use your card, click on this link and verify your details".
It is a scam, so don't click on the link. Instead, call your bank to check, so you have peace of mind.
Tan Ooi Boon
