Search for:

In brief

Singapore authorities are looking to address the recent spate of SMS-phishing scams targeting digital bank users through a variety of measures. The multi-stake holder approach involves government entities with responsibilities for the financial, telecommunications and home affairs sectors, as well as industry groups such as the Association of Banks in Singapore (ABS).

Some of the recent key developments are set out below.


Key takeaways

  • The Monetary Authority of Singapore (MAS) and the ABS are looking to introduce more robust measures for banks in Singapore to put in place to bolster the security of digital banking
  • The Info-communications Media Development Authority (IMDA) may require telecommunication companies, banks, and SMS aggregators in Singapore to register with the Singapore SMS SenderID protection registry
  • The ScamShield app, developed by the National Crime Prevention Council (NCPC) and the Government Technology Agency, is another avenue for consumers to seek protection from scams
  • MAS has not yet issued a notice or circular on the issue and there may be further updates in the future

In depth

Recent SMS-phishing scams

There has recently been a spate of SMS-phishing scams, targeting, in particular, customers of banks.

In late 2020, malicious actors diverted and used SMS one-time passwords (OTPs) to perform fraudulent credit card transactions worth SGD 500,000 and affecting 75 bank customers.1

More recently, in December 2021, nearly 470 customers of a major Singapore financial institution lost at least SGD 8.5 million to SMS-phishing scams.

In these most recent cases, fake SMSes appeared in the same thread as legitimate text messages previously sent by the bank for OTPs and transaction alerts. The scammers impersonated the bank, setting their sender IDs to be identical to that of the bank and thus causing it to appear in the same thread on the customers’ mobile device. These fake messages claimed that there were issues with the customer’s bank accounts or credit cards and instructed them to click a link, which led them to fake websites or requests for banking details.

These SMS scams are successful, firstly, because the grouping of fake messages with previous legitimate ones immediately makes them seem genuine. Secondly, phishing links in these fake SMSes are often shortened to disguise the actual URLs, making it difficult for victims to check their validity. Thirdly, the links lead to fake banking websites that also seem authentic.

The issue is not confined to Singapore. In the Philippines, the National Privacy Commission has received reports of mobile users receiving unsolicited SMS messages, allegedly due to contact information they provided in COVID-19 contact tracing and health declaration forms. The Canadian government has also drawn attention to the issue, as scammers there have similarly capitalised on the pandemic by pretending to be from assistance programs like the Canada Emergency Response Benefit and the Canada Recovery Benefit to target vulnerable Canadians. The messages involved included links that redirected recipients to seemingly legitimate sites which could then steal users’ personal data, introduce mobile malware, or commit fraud.

Measures to bolster digital banking security

In response, on 19 January 2022, the MAS and the ABS announced that a set of additional measures to bolster the security of digital banking are to be introduced within the next couple of weeks. The measures being explored by the Banks in Singapore, in consultation with the MAS, include:

  1. Removal of clickable links in emails or SMSes sent to retail customers;
  2. Threshold for funds transfer transaction notifications to customers to be set by default at S$100 or lower;
  3. Delay of at least 12 hours before activation of a new soft token on a mobile device;
  4. Notification to existing mobile number or email registered with the bank whenever there is a request to change a customer’s mobile number or email address;
  5. Additional safeguards, such as a cooling-off period before implementation of requests for key account changes such as in a customer’s key contact details;
  6. Dedicated and well-resourced customer assistance teams to deal with feedback on potential fraud cases on a priority basis; and
  7. More frequent scam education alerts.

These measures address the trap of fake links in scam SMS messages, and increase the likelihood that customers will be immediately notified of any fraudulent transaction or attempt to take control of their bank account. MAS is also intensifying its scrutiny of major institutions’ fraud surveillance mechanisms to ensure they are adequately equipped to deal with the growing threat of online scams.

The Singapore SMS SenderID protection registry

The IMDA announced on 20 January 2022 that a national registry, called the Singapore SMS SenderID protection registry, will be rolled out. The IMDA urged all telecommunication companies, banks, and SMS aggregators in Singapore to register, and it reportedly may soon be made a requirement for these companies and organisations to do so.

Sender IDs permit the identification of the sender of an SMS message such that a word or phrase appears instead of a number. When scammers try to send messages using a registered sender ID, organisations may choose to block them from being sent. This prevents scammers from impersonating banks and other organisations, and specifically targets situations like the most recent incidents.

The Singapore SMS SenderID protection registry had been in its pilot phase since last August. OCBC Bank, Lazada, and Singapore Post are reportedly among the organisations that have registered.

However, experts maintain that a better approach would be for banks not to use SMS at all, and instead rely on notifications from the bank’s applications, portals or websites to send messages to customers. This is especially so given that there is still room for manipulation: Scammers can simply alter the sender ID slightly, for example, “” instead of “Bank”.

Additionally, the success of the registry relies on the participation of the abovementioned companies and organisations. Registration is not yet a requirement, though more than 2,100 people have signed an online petition to make it mandatory.

Other initiatives by the IMDA include blocking numbers that are commonly spoofed and prefixing incoming international calls with “+” to alert the public to a potential scam call.

ScamShield

Another avenue for protection is the ScamShield app, which was jointly developed by the NCPC and the Open Government Products team, a unit in the Government Technology Agency. The app filters scam messages using artificial intelligence and can also block calls from numbers reported by users, or those on a list maintained by the Singapore Police Force. Between the app’s launch in November 2020 and August 2021, the app had blocked about 8,600 phone numbers, and users had reported 1.4 million suspicious SMS messages via the app.

The model is trained to recognise words often used in fraudulent texts, including “loans”, “gambling”, and “repayments”. It then looks at how these words are used in combination with each other.

The app may not always be effective at filtering all scam messages, as there are reportedly ways to work around it. We would advise caution in relying solely on the app as the only means of filtering scammers. 

While the threat of scams cannot be eradicated, especially given the speed at which scammers adapt, these measures may provide barriers to counter at least some vulnerabilities that come with online banking. In tandem with these measures, as MAS maintains, customer vigilance remains of paramount importance.

View Japanese Version (æ—„æœŹèȘžç‰ˆ)


https://www.mas.gov.sg/news/media-releases/2021/sms-one-time-passwords-diverted-to-perform-fraudulent-card-payments


LOGO_Wong&Leow_Singapore

© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Author

Ken Chia is a member of the Firm’s IP Tech, International Commercial & Trade and Competition Practice Groups. He is regularly ranked as a leading TMT and competition lawyer by top legal directories, including Chambers Asia Pacific and Legal 500 Asia Pacific. Ken is an IAPP Certified International Privacy Professional (FIP, CIPP(A), CIPT, CIPM) and a fellow of the Chartered Institute of Arbitrators and the Singapore Institute of Arbitrators.

Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Author

Stephanie Magnus co-heads the Asia Pacific Financial Institutions Group and heads up the Financial Services Regulatory Practice Group in Singapore. Stephanie is ranked Band 1 for FinTech in Singapore by Chambers FinTech 2020. She is also ranked as a Leading Individual for Financial Services Regulatory: Local Firms in Singapore by Legal 500 Asia Pacific 2020. She is recognised as a leading lawyer for Banking & Finance: Regulatory in Singapore by Chambers Asia Pacific and Chambers Global 2020. Stephanie was quoted in Chambers Asia Pacific for her "timely, practical and business-oriented" advice, with a "deep understanding of the regulatory regime." She is also recognised as "very business-savvy and brilliant every time," and is admired for her "very strong grasp of the legal issues from both a technical and practical perspective."

Author

Daryl Seetoh is a local principal in the Intellectual Property & Technology (IPTech) practice group at Baker McKenzie Wong & Leow. He is a qualified lawyer in Singapore, and is a member of the International Association of Privacy Professionals (IAPP) as a Certified Information Privacy Professional for Asia (CIPP/Asia), an IAPP Certified Information Privacy Manager (CIPM) and a Certified Information Privacy Professional for Europe (CIPP/E). Daryl has previously worked at Baker McKenzie’s San Francisco office and has also been seconded to financial institution and technology multinational clients.