Seven hundred and ninety people handed their online banking details to fake websites, and S$13.7 million left their accounts. OCBC, Singapore’s second-largest bank, said on Sunday, January 30, that it has arranged “full goodwill payouts” for every one of them.
The scam came by text message, with the sender posing as the bank. Victims typed their log-in credentials and one-time PINs into phishing sites, which let the scammers take over their accounts and move money out. OCBC said its investigation confirmed as much. It paid anyway, calling the decision “a one-off gesture of goodwill given the circumstances of this scam.”
The bank also owned up to a second reason. Its “customer service and response fell short of our own expectations,” OCBC said, and that could have affected how much of the loss was stopped in some cases.
How the losses stacked up
About 80 per cent of the S$13.7 million disappeared between December 23 and 30, over the year-end festive period. Calls to the bank’s contact centre jumped by more than 40 per cent in those days.
Police had said the month before that at least 469 people had been hit, with reported losses of at least S$8.5 million. OCBC said those numbers came from police reports made at the time, and more reports reached the bank in January. It also contacted victims who did not yet know they had been scammed. More than 200 customers, it said, were kept from falling for scams by the tighter measures it brought in after the first wave. No further fraudulent transactions linked to the scam have shown up in the past few weeks, the bank added.
The changes OCBC listed this month include instant alerts for fund transfers, even when only one cent moves. It took clickable links out of marketing e-mails and SMS messages and cut the default daily PayNow limit from S$5,000 to S$1,000. A 24-hour cooling-off period for digital token provisioning started on December 31, and the same wait for key account changes is due by January 31.
Regulator’s view
These steps match requirements the Monetary Authority of Singapore and The Association of Banks in Singapore announced on January 19. Banks must also run dedicated customer assistance teams for suspected fraud and notify customers on their existing mobile number or e-mail address when someone asks to change those details.
On Friday, February 4, MAS said the OCBC payouts were a “one-off gesture” that do not set a “general precedent” for future cases. The regulator said banks have largely put the January 19 measures in place, and that it is working with the industry on longer-term ones.
One of those is a framework for sharing scam losses, drawn up by the Payments Council, which MAS chairs and which has worked on it since July 2021. “The proportion of losses each party bears will depend on whether and how the party has fallen short of its responsibilities,” MAS said. Banks are expected to guard accounts and spot suspicious transactions. Customers are expected never to give out personal or banking details and never to click links in texts or e-mails claiming to come from a bank. MAS aims to publish the framework for public comment within three months.
Sources
- OCBC arranges for 'full goodwill payouts' to 790 customers who lost $13.7m to phishing scams
- OCBC's goodwill payouts to scam victims were 'one-off gesture': MAS
Sources
- OCBC arranges for 'full goodwill payouts' to 790… | The Straits Time…
- OCBC's goodwill payouts to scam victims were 'one-off': MAS
