Hardware Tokens as Option for Bank Customers to Enhance Security of Online Banking

Ms Sylvia Lim asked the Prime Minister (a) which retail banks in Singapore have phased out hardware tokens for customers; and (b) whether the Monetary Authority of Singapore will mandate that this option be available to customers to enhance the security of online banking.

Most major retail banks in Singapore already offer hardware tokens for customers. These include the three local banks, DBS, OCBC and UOB, as well as foreign banks like Maybank and HSBC. Although these banks do not provide hardware tokens by default, bank customers can request for a hardware token if it better meets their needs. There is therefore no need for MAS to mandate that hardware tokens be made available to bank customers as an option.

Hardware tokens are not a panacea. While hardware tokens that generate one-time passwords (OTPs) are resistant to malware-enabled scams, they are still susceptible to phishing tactics deployed by scammers. There have been many instances where victims were tricked into sharing the OTPs generated by their hardware tokens with scammers who in turn, used them to perform fraudulent transactions.

MAS has been working closely with the industry to continuously strengthen the security of online banking. MAS has also asked the banks to assess and implement customer authentication mechanisms that are more resistant to both phishing and malware attacks.