Help for Individuals Affected by Bank-related Cyber Scams or Unauthorised Bank Transactions

Mr Deputy Speaker, I am taking this question on behalf of the Senior Minister and Minister-in-charge of the Monetary Authority of Singapore (MAS). Generally, consumers who have suffered financial losses from fraudulent transactions are protected as long as they have acted responsibly.

For online card transactions, if a merchant has not adopted a system which requires consumers to authorise transactions using one-time passwords (OTPs), a consumer will not be liable for an unauthorised transaction. For lost or stolen cards, a consumer’s liability is capped at $100 for lost or stolen cards, provided he or she has not been careless and has reported the loss promptly.

Likewise, for non-card e-payments, consumers who have practised proper cyber hygiene and have not been negligent will not be liable for any losses arising from unauthorised transactions that do not exceed $1,000. For unauthorised transactions exceeding this limit, financial institutions will investigate further on the root cause of the issue before liability is established. Where the unauthorised transaction arose because of lapses or non-compliance with MAS’ rules by the financial institution, the consumer will not be liable.

The question raised by Ms Yeo pertains to a situation where neither the consumer nor the financial institution is at fault. Specifically, the consumer has not given out his credentials to a scammer and there were no lapses or non-compliance on the part of the financial institution. Between September 2020 and February 2021, the Singapore Police Force (SPF) received a total of 89 reports of fraudulent card transactions performed with SMS OTPs, where victims claimed that they neither performed the transactions nor received any SMS OTPs to authorise the transactions. While these cases represent less than 0.1% of fraudulent online card transactions reported and the number of cases has come down since March 2021, it is nonetheless concerning.

SPF and the Infocomm Media Development Authority (IMDA) are investigating these cases. MAS has however asked financial institutions to step up vigilance towards such fraud. Financial institutions have put in place additional measures, such as rejecting card payments made to common merchants previously linked to the unauthorised transactions or placing limits on the transaction amounts that consumers can transact with such merchants.

MAS also expects financial institutions to ensure that consumers are treated fairly whilst investigations are ongoing. For instance, banks have waived finance charges and late fees on the outstanding amounts or offered temporary goodwill credits on the consumers’ credit cards in the interim. For those who wish to settle on the issue, banks may also offer partial waiver of the disputed amounts, taking into consideration individual circumstances, such as financial hardship and whether there were indicators of negligence by the consumers.

MAS is working with the industry to review the existing framework to provide greater clarity on the responsibilities and liabilities of consumers and financial institutions in the case of fraudulent payment transactions. The review will include the scenario where neither the consumer nor the financial institution was remiss in allowing the fraud to occur, the scenario that Ms Yeo had asked about. The framework should provide a balance of incentives for all parties to do their part in preventing fraudulent transactions, while ensuring that consumers who are not at fault are protected.

Thank you, Sir and also, thank you to the Minister for his comprehensive answer. I have one supplementary question. I have seen over the past few months a rise in the number of appeal cases from my residents who have fallen victim to such cyber crimes. They tell me that they have not received any OTPs nor have they divulged their bank account information or credit card information unwittingly. When they go to their banks for investigation, their banks' usual response is that they have divulged their OTPs and hence, the victim, not the bank, is responsible for the loss.

One of my residents, who is a retiree, lost over $10,000 in a string of transactions and she is very sure that she has never given her OTP once, if any. Another resident has told me he has merely done one banking transaction online with a payment platform and before he knew it, he had $1,000 missing from his bank account.

Given the push towards online financial transactions and digital banking, what are the measures that the Ministry has put in place, especially with the banks and financial institutions, to ensure that our citizens are made aware of these fast-evolving banking and credit card scams?

Mr Deputy Speaker, I thank Ms Yeo for the supplementary question. I am sorry to hear about her residents who have been victims of these fraud cases.

As I cited just now in my reply, if you look at the overall statistics, the numbers have not been rising and the overall numbers are small as a percentage of transactions. Nevertheless, as I highlighted, this is concerning and we are doing a few things.

One, Police and IMDA are investigating these specific cases that have arisen and they will find out, try to determine what exactly has happened so that we can get to the root of it.

Two, MAS has also asked the financial institutions to step up vigilance, as I highlighted just now. So, they are putting in place additional measures, including making consumers more aware of such possible frauds that may happen.

Thirdly, as I also highlighted, we are working with the industry through the Payments Council to review the framework to provide greater clarity should instances arise where both the financial institution and consumer say, "Look, we did not do anything" and the consumer says, "I never revealed any OTP", as what Ms Yeo said her residents claimed. So, the banks too have put in place sufficient safeguards, complied with all the rules. What exactly went wrong there? We will have to find out but should such an incident arise and we hope in the future, less and less of it will happen, but should such an incident arise, then, we are looking at the review to see how we can provide greater clarity on the responsibilities of both parties – the banks as well as the consumers – in order to resolve such incidents.

But certainly, we want to see fewer of such incidents and the reviews and investigations by the Police and IMDA and the safeguards that MAS is putting in place with the financial institutions will hopefully result in fewer incidents in the future.

Thank you, Deputy Speaker. I just have a few questions.

First of all, my resident is also one of the victims. I would like to ask might MAS know what is the total value involved in that 89 cases spoken about? Two, these are hard-earned monies, so, I am wondering whether for some of the fraud cases where the amount that is being cheated, if it is below a certain amount, can the bank just write it off first, so that it reduces the stress on the poor victims. And thirdly, I am glad to know of the review; I am just wondering if there is an indication of the timeline for when this will be done? Technology is fast evolving and so is the nature of crime. So, the faster we can react to this, the lesser the number of victims that we will have.

Mr Deputy Speaker, on the first question, I do not have the figures of the amounts that were involved in these 89 cases. The Member can file a separate question and we can always provide that data.

On the second question, indeed, the banks do offer a waiver of the disputed amounts and if there are specific cases that the Member knows about, please let us know. We will be able to look at them on a case-by-case basis, raising this with the banks because, on such instances, they are prepared to offer waiver of the disputed amounts, as I have said, taking into account the individual circumstances of the victims involved.

On the third question, on the timeline, we are working towards a review and an outcome by the end of the year. So, we are doing as fast as we can.

Deputy Speaker, I am wondering if the Minister can clarify the extent to which a much more robust legislation, along the lines of what we see in terms of the Consumer Credit Protection Act of 1968 in the US, has been seriously considered and examined by MAS and the Ministry. For those of us that have spent some time in the US, we would be aware of the enormous comfort that is provided by the kind of consumer protection legislation where, at the very least, it means that the amount of liabilities that are faced are often capped at a certain amount, once evidence of fraud has been established. So, I wonder if the Minister can elaborate on legislative efforts along this front.

Mr Deputy Speaker, as I mentioned earlier, we are doing a review together with the industry to look at the existing framework holistically and we will not rule out whether or not legislative changes are required. But we will look at it holistically and see how best we can move forward on this issue, providing assurance to consumers but also ensuring a balance of incentives for all parties to do their part in preventing fraudulent transactions.