[starbugs]

Someone from HWZ pasted the article from behind the paywall.

See especially what HFK said about his friend warning OCBC about the scam SMS on Dec 17. No action by OCBC to warn its customers until 4 Jan.

If you receive an SMS from your bank telling you there is a problem with your account and that to fix it, you need to go to its website through the link provided, what would you do?

Okay, you have a suspicious mind and you do not ordinarily fall for the usual online scams like helping a Nigerian get his money out of the country.

You look at the SMS again and find that it comes from the same thread as previous bank messages.

In fact, it is in the same thread which the bank has been sending you one-time passwords (OTPs) for all the online transactions you have been making.

How can it not be legitimate?

So you click on the link and it takes you to what looks like the bank's log-in website, with its logo and all the usual features in place, as professionally done as what you would expect from a rock-solid bank.

You log in with the OTP which has been sent to your mobile phone in that same SMS thread.


And that is when your entire savings get transferred out, leaving you with exactly zero dollars in your account.

It is as if you have gone to the physical bank to withdraw all your money and somewhere in the bank - or maybe it was just outside the bank, you are so confused you don't know exactly where - someone points a gun at you and relieves you of all your cash.

I think this must have been how those 469 OCBC Bank customers felt when they fell for this scam last month, losing $8.5 million altogether.


Among them: a 38-year-old software engineer who lost $250,000 that he had been saving since 2010; a young couple whose $120,000 was money to start a family; and a mother of seven whose savings of $100,000 disappeared, out of which $60,000 was in her children's Young Savers Account.

The tragedy is that this fraud, using what is known as spoofed telephone numbers that impersonate caller IDs to trick victims into thinking the text messages originate from OCBC, isn't new or terribly sophisticated.

It has been used for some time, especially over the last two years, and both the police and banks were well aware of the increased prevalence.

As a result, in July last year, the police issued a statement that these scams affecting banks' customers had re-emerged, resulting in 374 of them losing $1.07 million from January to May.

This was what it said: "As the scammers had spoofed the bank's SMS accounts, the scammers' message might appear in the same SMS conversation thread as a bona fide SMS message from the bank."

This was five months before the December OCBC incident. Same old trick, yet so many still fell for it.

It raises the question whether banks have done enough to take preventive and pre-emptive steps to safeguard their customers' money when they knew the danger was clear and present.

I do not have an account with OCBC, but when I checked my DBS SMS thread from July when that police statement was issued, there was not a single message from it warning me of this threat.

A friend had a closer shave.

He received the same scam message as those 469 on Dec 17, which meant that he might have been one of the earliest targeted.

He immediately informed OCBC about it, adding that it should alert all its customers.

Alas, according to him, he did not hear from it until Jan 4, when he received an SMS text from the bank alerting him of these scams.

This was almost three weeks after his first call to the bank and well after those 469 had been robbed.

In fact, of those three persons cited above who lost their entire life savings, two were scammed on Dec 28 and one on Dec 21, quite some time after my friend alerted OCBC.

If the bank had been more alert to the problem and warned its customers more proactively, they might not have fallen victim.

Are banks too complacent and slow in taking the necessary steps to safeguard their clients' money?

It baffles me why so many of them did not send SMS messages to their clients warning them of the impending danger.

What will prod them to be more proactive in dealing with the problem?

I can think of one way - make them pay, if not all, at least a substantial amount of the losses suffered by their clients.

Under existing laws, they are not obliged to, as they will argue that the customers were negligent in falling for the scam.

In fact, they are always quick to say that their security systems were not compromised. No one hacked into and broke through their defences.

In other words, they were not at fault as all the trickery took place outside of the bank and inside their customers' own mobile phones.

But this is not satisfactory, and it is unfair for unsuspecting people to have to bear all the burden of having to look out for devious crooks who know everything about what makes a person vulnerable to these tricks.

To be fair, the Government recognises that more should be done to address these issues, particularly over the question of how to define more clearly where banks' and customers' liabilities and responsibilities fall.

In July, Finance Minister Lawrence Wong announced that the Monetary Authority of Singapore (MAS) was reviewing the matter and that it will take till the end of that year.

He also added that banks were already flexible in reimbursing their clients' losses, taking into account the merits of each case.

All eyes will now be on how OCBC deals with its affected clients and demonstrates exactly how flexible it is.

MAS should use this latest scam as a case study and seek a fairer balance that takes into account the vulnerability of customers to the increasing sophistication of online scammers.

If banks are held to a higher standard of accountability, even when there is no security breach in their own systems, they will have a greater incentive to do more to prevent such fraud.

If they are liable for some or all of these losses, you can bet they will do more to outsmart the crooks.

But there is also the danger that if customers believe they are completely insured against all losses, they will let their guard down and not do their bit to ensure safe banking.

There is a moral hazard which needs to be addressed and the balance set appropriately.

The most important issue is public confidence in the banking system which is even more critical now that Singapore has moved aggressively into the digital world, involving more and more activities and transactions.

We are constantly told by the authorities that digitalisation is the way forward for the country and will give it a competitive advantage.

Those pushing this transformation have a duty to make this new world safe for all, and to provide for adequate redress when banks and other financial institutions fail to do so.

For those 469 cheated bank customers, their confidence in the banking system has been completely shattered.

It needs to be restored quickly.

• Han Fook Kwang is also senior fellow at the S. Rajaratnam School of International Studies, Nanyang Technological University.