Strengthening Enforcement and Public Education

Mr Speaker, I thank the Ministers for their Ministerial Statements. I have two questions and one suggestion. Sir, many of my Clementi residents were very worried to hear about what happened and it is important that MAS has recognised that there needs to be equitable sharing of losses when an incident happens.

My first question is, will this proposed equitable sharing look at the difference between an unforced error compared to a forced error, where a customer was led or pressured into making an error, as appears to have been the case with the OCBC phishing scam?

The second question, Mr Speaker, will this proposed framework for equitable sharing of losses also consider the speed of the bank response when a consumer is trying to get help? One of my Clementi residents described it thus. He said, "Imagine you got tricked, someone copied your house keys, they are looting your house now, you call for help and you are put on hold. You wait to press a number or get to the right department." That is what my resident said and they are worried what happens if this is their experience in a scam.

Sir, for the suggestion, may I suggest to the Ministries, if they have not already done so, there can be Red Teams looking at not just fighting the last scam war, but the next one because, today, we know there are deepfakes for voices, deepfakes for video calls as the technology improves. We have to be ready for the next character of scams. Likewise, is there a role for white hat scammers, just like there are white hat hackers – white hat scammers actively testing the bank's procedures to look for vulnerabilities before fellow Singaporeans suffer avoidable losses?

Mr Speaker, I thank Dr Tan Wu Meng for his suggestion on the last point. Indeed, we cannot be fighting the last war, we have to look ahead, anticipate vulnerabilities and continually look at different ways to improve our system, and MAS is certainly committed to this process.

On the framework for the sharing of losses incurred by customers, this is a complex issue. I mentioned just now that it is being deliberated upon by the Payments Council, which is chaired by MAS, and it aims to put up something for public consultation within the next three months. I do not want to get ahead of the process, but I would just want to set out some key principles which the Council is using to guide its deliberations.

First, the framework for the sharing of losses should be consistent and common. So, it should not matter which bank you go to; it has to be applied consistently across the entire industry.

Second, the framework should be equitable in determining how losses are to be shared, because both banks and customers have their respective responsibilities. So, Dr Tan Wu Meng talked of some scenarios about speed and whether or not it is a forced or unforced error. But what we intend to do is to be quite clear and specific about what these responsibilities are for financial institutions and customers and what each party is expected to do to prevent scams. Then, the share of losses each party bears will depend on whether and how the party has fallen short of these very clearly stated responsibilities.

I think that is a fair and equitable principle, But, obviously, there are many details to be worked out. So, the Payments Council chaired by MAS will go about these deliberations with the different stakeholders. And I should add, the stakeholders, as I have mentioned earlier, also include players operating the communications infrastructure because we want to ensure that there is proper accountability across the entire ecosystem.

Thank you, Mr Speaker. I thank the Ministers for their comprehensive replies. I agree with the Minister that we need to adopt an ecosystem approach to tackle banking scams. I have two supplementary questions for the Minister for Finance.

First, given the unprecedented wave of online banking frauds hitting consumers – actually, not just in Singapore, we have read about such accounts in the UK and around the world – may I ask how does MAS fare in terms of anti-scam controls, compared to some of the best practices in other jurisdictions to protect the interests of our consumers?

Sir, the second question relates back to the new framework being debated to establish how losses behind scams are to be shared between consumers and financial institutions. I want to ask, specifically, whether MAS will be imposing a set of minimum standards for the banks' fraud surveillance system to better protect consumers.

Mr Speaker, I thank Ms Foo Mee Har for the very important question. MAS' approach and what MAS has done so far has, in fact, gone beyond the usual practices among financial regulators. In major jurisdictions, regulators do not themselves prescribe the specific anti-scam controls for the banks. Instead, they take a supervisory approach, which means they set up the broad supervisory expectations of the banks, then they place the responsibility on the banks to develop the specific anti-scam measures. Then, the regulators will assess the adequacy of these measures and they will impose penalties if the banks fall short of expectations. So, that is the approach that other regulators take, most regulators will take, and that is also the basic approach that MAS has undertaken.

But, as I mentioned, MAS has, in fact, gone beyond most regulators in being quite clear about its expectations, as well as the specific anti-scam measures that are required. Amongst the three local banks, this started last year, following MAS' focus supervisory review. Then, earlier this year, in January, as I mentioned just now, MAS and ABS put in place a comprehensive suite of measures and controls that will apply across all retail banks. That is, in fact, more than what major jurisdictions have in place.

And we are going beyond that, because, as I have highlighted in my speech, MAS is also considering and studying further enhancements to the measures that we can put in place across banks to reduce the risk across our digital banking channels. So, let me assure Members that MAS takes this work very seriously. It has been, and will continue to do everything it can, working together with other partners and stakeholders to strengthen the security across our digital banking channels and also across the entire digital ecosystem.

On the second question on the framework for the sharing of losses, I do not want to get into details because, as I have highlighted, this is still work in progress. But, as I mentioned just now, our intention is to clearly set out basic responsibilities expected of financial institutions. Indeed, if financial institutions were to fall short of these responsibilities, then they should bear their share of the losses. So, this is work in progress and we will put out the details in due course when we are ready.

Sir, I have clarifications for the Minister for Communications and Information as well as the Minister for Finance.

For the Minister for Communications and Information, once the sender ID registry becomes a whitelist like what she described just now, will scammers still be able to send SMSes from overseas with the sender ID that is not registered in Singapore's registry? And if so, how would such scam messages be prevented? Secondly, is there a fast-track channel in which scam websites can be reported even by members of the public and blocked expeditiously?

For the Minister for Finance, recent scams have demonstrated that SMS is an insecure channel for sending either one-time passwords or hyperlinks. According to MAS' Technology Risk Assessment Guidelines to financial institutions, end-to-end encryption should be implemented for the transmission of customers' passwords. SMS is not an end-to-end encrypted channel. So, why is MAS not immediately prohibiting the use of SMS one-time passwords, especially to protect the less tech-savvy customers who are at risk of getting scammed?

Mr Speaker, I do not mean to be too technical, but to answer the Member's question, I will have to explain how the SMS service providers will interact with the SMS sender ID registry.

Basically, the SMS service providers will be approached by a party to say that here is a message that I would like to send to these numbers in Singapore. The imposition that we are making on the SMS Service provider is to look at the header that is being requested by the customer to send it under and check against the registry.

So, if a name already appears on the registry, then, regardless of who the customer is or where they are requesting this service from, as long as the name appears in the registry and this party's details do not match the other record in the registry in terms of their UEN, in terms of the path that they described, how they want to send the SMS across, then this business has to be turned away by the SMS service providers. So, the purpose of having the registry is to allow the SMS service providers to know whether this is a legitimate request and if these signs of legitimate requests are not matched, the requirement for the SMS service provider is to turn away the business.

So, I hope that that provides an answer to the Member's question.

Mr Speaker, on the use of SMS to deliver OTPs, I mentioned just now that we are reviewing this practice and, if we were to continue, whether potential measures should be taken to reduce the risk. I should highlight that, really, as I mentioned in my speech, there is no single measure that can guarantee the security of digital banking.

Issuance of SMS, even if it were to be done through a very safe and encrypted channel, for example, that would not stop deception from happening and, if the scam succeeds in identity theft, as has happened here, impersonating a bank, getting the person to think that this is, in fact, a genuine bank, then the person with the OTP will still provide the OTP to this scam website or scam account or whatever it is.

So, it is a broader issue that we have to look at holistically and, as I mentioned, we are determined and committed to this process to review the entire ecosystem and strengthen it.

Mr Speaker, Sir, in Mandarin.

(In Mandarin): [Please refer to Vernacular Speech.] With the sharp increase in online fraud cases amidst the COVID-19 pandemic which has led to most institutions to minimise in-person transactions, will the Singapore Police Force step up collaboration and education efforts with SG Digital Office and the Silver Generation Office to reach out to and assist seniors, such as increasing its presence in the heartlands by setting up more SG Digital Community Hubs and sending out more Silver Generation Ambassadors to visit seniors at home? Many grandmas and grandpas are unable to understand how ScamShield works.

I will reply in English and I will say a few remarks in Mandarin. I thank the Member for the question. Actually, Minister Josephine Teo has highlighted many of the measures that we have implemented in relation to helping our seniors go digital as well as to continue on our digital transformation journey. I think the question is a valid one in relation to how this incident may have affected some confidence, especially among our users and seniors. I want to emphasise that, as I had mentioned in my speech earlier on, the groups of people who are affected by scams are not just the seniors. In fact, our data showed that the younger people who have been transacting more online are more susceptible, or just as susceptible, to scams.

So, there are two areas that we need to focus on in relation to the Member's question.

One is how can we bolster confidence among our users? That is something that Minister Lawrence Wong, Minister Josephine Teo and I have been trying to explain and let Members know the measures that we are taking to make the digital space a safer environment for all of us to operate in.

The second area is to build a more resilient community in the use of the digital space. That is something that we have been working with the different stakeholders and partners – Government as well as the private sector – to strengthen.

More specific to Member Don Wee's question on the seniors' programme, we have introduced a number of programmes and, given this incident, we will continue to step up our outreach to our seniors to not just help them to acquire the skillsets but also to explain to them what are the telltale signs of scams and how to protect themselves from scams.

Today, the SDOs have done a good job in reaching out to 130,000 seniors in our community at the community centres, different libraries and so on. So, we will continue to step up these efforts.

I want to end off by saying that this education effort is an important one. We want to build a Smart Nation. We also want to build a Scam Smart Nation, where our people understand the telltale signs and to protect themselves and help one another.

(In Mandarin): [Please refer to Vernacular Speech.] Mr Speaker, Singapore has seen a rising number of scam cases in recent years. Therefore, MHA and other Ministries will do our best to work with community partners to strengthen prevention measures and raise awareness against scams.

In 2021, online phishing scams were on the rise. Scammers used various ways to mislead victims into revealing their personal information. Here, I urge everyone to stay alert and not to believe strangers easily, nor to share your personal information or even transfer money.

The public can also download ScamShield from Apple Store. Mr Don Wee said our grandmas and grandpas might not understand ScamShield. However, I believe that once they realise the benefits of ScamShield which offers them greater protection, they will be able to use digital platforms more confidently.

Thank you, Mr Speaker. I thank the Ministers and the Ministries for the efforts that they have put in and continue to put in to prevent future scams. I have two supplementary questions.

Firstly, is MAS considering the contingency reimbursement model in the UK where banks reimburse scam victims which started on a voluntary basis but there are now plans to legislate it?

The second supplementary question: in working out the shared responsibility between banks and their customers, would MAS consider putting the onus more on the banks on the basis that: one, the banks are more tech-savvy and scam-savvy than the average bank customer and they have better resources to keep up-to-date with the latest tactics; two, it provides additional incentives on the banks to adopt a pre-emptive approach, for example, to consider the scam potential before pushing out new procedures or facilities; and thirdly, it is probably more cost-effective to focus on scam prevention efforts from the ends of a few banks rather than public education on a whole wide range of bank customers?

Mr Speaker, this must be my third question on the loss-sharing framework. I can appreciate that there is a lot of interest in this and, as I have said, it is a work-in-progress. But to quickly answer Ms Poa's two questions.

Number one: MAS will certainly look at models around the world in developing the details of this framework for the sharing of losses in an equitable fair share.

Number two: as the Member has highlighted, the responsibility will be different for individuals and financial institutions. We are very mindful that individuals have a different set of resources and capabilities, compared to financial institutions. So, in developing the specific responsibilities for individuals and financial institutions, we will certainly take that into consideration.

Thank you, Mr Speaker. I have one clarification for the Senior Minister of State for Home Affairs. One of the issues with scams is that the perpetrators are normally based abroad. I just wanted to check whether there is any framework in place for us to actually cooperate with foreign agencies in order to identify the perpetrators and have them prosecuted for these actions?

I thank the Member for the question. I mentioned in my speech that this is an area that MHA and SPF will continue to sharpen, to build our networks across the different foreign law enforcement agencies as well as working with Interpol to enhance our ability to respond and to investigate across jurisdictions.

At the same time, I also mentioned some of the difficulties, including how we can get our foreign law enforcement agency partners to work within their jurisdiction. And once the money has been transferred, there are also some difficulties as well. But it is an effort we will continue to do, as we have done in recent times, and we will step up this collaboration with the partners – foreign law enforcement agencies – to try and strengthen our enforcement as well as recovery of lost monies with the foreign banks as well.

Thank you, Mr Speaker. I have two questions.

The first is for Minister Lawrence Wong. I wonder if the Ministry has plans to introduce complementary legislation to bolster the additional regulatory actions that he has already proposed and the reasons are, because while regulation is often useful for guiding actions, to use the example Minister Lawrence Wong raised earlier about allowing certain transactions to be disputed, without the force of law, it might still fail to adequately ensure an equal distribution of liability even in the presence of, as he described, the fair, equitable framework.

Using the same example, if I may, requiring charges above $50 to be subject to dispute under the Fair Credit Billing Act in the US has meant that financial institutions have, actually, been a lot more proactive in deploying fraud detection systems and securing fraud insurance. This is something that Member Hazel Poa has mentioned as well.

My second question is for Minister Josephine Teo and it is to ask if there are plans to comprehensively audit the compliance of technology systems with their official safeguards. I say this because, in a recent little experiment with my Sengkang colleague, Louis Chua, we tried to test the limits of the PayNow system, as applied by banks. The stated PayNow transfer limit, in the absence of additional authentication via token, is meant to be $1,000. However, we were able to transfer sums in excess of this amount just by instantaneously changing the daily transfer limits, and, again, without any two-factor authentication beyond the PIN prior to executing the transfer. Others have reported similar lapses in banks' checks and balances in guaranteeing customer security. One banking customer, writing to The Straits Times, shared that they were able to breach the credit limit by 1.8 times in transactions occurring over multiple countries in foreign currencies without the incident being flagged.

Mr Speaker, in developing any new measures, MAS will want to ensure that these measures are effective – effective in reducing the risk in our banking system, effective in implementation. And if new legislation is necessary or amendments to the laws are necessary, we will certainly not rule out those options.

Mr Speaker, there are two parts to the Member's question. One is in terms of the banks' information systems, IT systems, we classify them as part of our critical information infrastructure. As a result of this classification, they are subject to higher requirements and also regular audits. So, earlier on, when I had explained, and Minister Lawrence Wong had also explained why this was not a cyber attack or cybersecurity breach, that has to do with the kind of defences that are part of the banking system being a critical information infrastructure. Is it subject to regular audits? It has to be. Otherwise, we would not know whether the cyber defences that are intended to be put up are, in fact, effectively done. So, that part is done.

But I would always caution that this is not something you brag about. Just because the system is sound at any point in time does not mean it is not continuously being subject to testing. And whether it is banks, whether it is our telcos, as part of the operators of our critical information infrastructure, they always also have to conduct their own penetration testing, in order to assure themselves that there are no vulnerabilities or gaps that are glaring and that have not been patched. So, that is one part of it.

The second part of it, and his experiment with Mr Louis Chua using PayNow, I think it is very similar to what Dr Tan Wu Meng had already suggested earlier, whether you would consider subjecting your own banking processes to white hat scammers. And I think Minister Lawrence Wong had already responded to that question to say that the answer is yes; it is a good suggestion. And we should be seriously thinking about how to do so.

Thank you, Speaker. I thank the Ministers and the Minister of State for their comprehensive replies. I would like to ask a couple of supplementary questions. We understand from Minister of State Desmond Tan that once the money is transferred out of Singapore during an Internet scam, it is almost as good as gone.

So, I would like to ask the Minister for Finance what the proportion of Internet transfers is involving accounts overseas. Is it possible for the local user to opt, by default, to not allow the transfer of money out to overseas, unless authorised otherwise with the two-step verification? This is similar to what local mobile phone users do, where they can disable the auto-roaming so as to minimise the cost.

Secondly, when banks are alerted to the significant increase in banking scams, can the bank deactivate all overseas bank transfers for a short period, so as to minimise the scam's impact?

Mr Speaker, the short answers to both questions are yes. As I have mentioned in my speech, MAS is, indeed, looking to introduce additional customer confirmations for higher-risk transactions, and that would include fund transfers that are large, relative to the overall balances, as well as overseas transfers, recognising that once the funds leave our local banking system, they are very hard to recover, indeed.

So, as I have mentioned, these are additional strengthening and enhancements we are looking at, which will require customer confirmation. It will add friction to the transaction for genuine customers but we hope that everyone understands that these inconveniences are necessary to have a safer digital banking system in Singapore.

The second point about having a cooling-off period, if the banks are aware of the scam and whether or not they can put in place some cooling-off periods, indeed, that is something that has been done. And we will continue to look at how these sorts of measures and safeguards can be strengthened.

I thank the Ministers for their comprehensive replies. I would like to follow up on the hon Member Ms Foo Mee Har's question on anti-scam standards set by MOF.

My residents who came to me to seek help on the recent OCBC bank scam incident shared that information from the bank during the investigation process and the support during the processes itself, were found wanting. Many of them had interactions only with the call centre staff and this has left them very afraid and stressed and, indeed, worried that their life savings were kept in limbo.

So, I would like to ask if the Ministry, or the agencies in charge of this, will be putting in standards and requirements for the banks in the management of scam victims during the investigation process.

Mr Speaker, again, the short answer is yes. But I should clarify the standards are not set by MOF; they are set by the Monetary Authority of Singapore (MAS) and I am speaking also in my capacity as the Deputy Chairman of MAS. This is under MAS' purview.

As I explained in my speech just now, we have assessed that OCBC itself, in this incident, could have done better. There were areas, in terms of its responses to customers, which, certainly, could be improved. That is why we are reviewing the conduct of OCBC, and we will take the appropriate actions. That is for the OCBC incident.

But with regard to standards, expectations and responsibilities, these are in place today for all the retail banks and we will continue to review and ensure that these standards are set in such a way that provide assurances to customers and hold the banks accountable to meeting these high standards.

Thank you, Mr Speaker. It is sobering to learn that our current anti-scam systems are blocking millions of scam calls each month. I would like to ask Minister Josephine Teo whether this useful protective filter extends to blocking scam calls made using Voice over Internet Protocol (VoIP), which allows calls to be made over the Internet as well as telecommunications applications, such as WhatsApp call, which is also becoming very popular even among our seniors. If not, are there any plans by the Ministry to safeguard these channels?

Mr Speaker, as a general point, we are constantly looking at what channels are being exploited for scams to be perpetrated. But the Member is right. The current call blocking, as well as the website blocking, is now mainly done through Domain Name System (DNS) blocking. So, unless my technical understanding is flawed, and I would have to check this up, my understanding is that it does not block VoIP calls. But I will have to get back to him properly.