[sgbuffett]

I don't know about your guys.

But because of this, I tried changing my ATM withdraw limit for OCBC.. It did a 2FA authentication with my phone (I am using my phone as 'token', so I am assuming adding a payee will need the same authentication). Maybe some of you can try and let the rest know.

As for whether to allow change of limit online, it depend on individual. Some wants the convenience. 

I don't know if OCBC solution is obsolete, but it allows me to use my phone to authenticate instead of SMS. DBS and UOB also have similar features.. So if OCBC solution is obsolete, then it is a industry wide problem.

Maybe we should all go back to our parent's days, all transactions must go to the bank to carry out.. Safer..

in the ocbc scam, the customer keyed in hs login id, password and otp from his phone digital token at fake site
once the scammer get this 3 things his uses it to shift digital token to his own device.

now scammer can generate otp from his device.

basically he can do anything he wants.

the dbs system has an extra step:
1. it sends sms to your phone with code.
2. you key in code to token to generate new code.
ths new code is needed.

for the dbs system the hacker need to capture both sms and token.
this is harder because you need sms plus token to move the token.