[kc172021]

in the ocbc scam, the customer keyed in hs login id, password and otp from his phone digital token at fake site
once the scammer get this 3 things his uses it to shift digital token to his own device.

now scammer can generate otp from his device.

basically he can do anything he wants.

the dbs system has an extra step:
1. it sends sms to your phone with code.
2. you key in code to token to generate new code.
ths new code is needed.

for the dbs system the hacker need to capture both sms and token.
this is harder because you need sms plus token to move the token.

Not true. DBS also send SMS to the HP and with OTP via sms, you can transact online and change limit. My concerns is that if the internet bank account can be so easily hacked, then they Banks should add in another layer of protection on the changing of transacted limit by either a email confirmation or phone call verification in order to change the limit.

Main reason to set the transacted limit is to protect your bank account but if the Banks are so handoff to allow one to change the limit transacted limit online, once the account is being hacked, all gone your saving.

The banks need to put in extra secure step before transacted limit can be changed : either to personally do it at  the bank or any other extra steps, its a bit inconvenient, but its safer way to protect ones money in the bank