The rise of sophisticated online scams and the resulting financial devastation on victims is a critical concern impacting Singaporeans from all walks of life. Across our nation, residents, both young and old, tech-savvy and not, have fallen victim to these fraudulent schemes.
I have met constituents who have lost their life savings to scammers, with even fixed deposit accounts being cleared out by these criminals. Some have joint accounts with their children or parents, doubling the impact on families. These incidents demonstrate a concerning vulnerability that affects us all. While I consider myself relatively tech-savvy, I have to admit that even I feel the looming threat of becoming a victim one day.
Many victims I have spoken with describe a disheartening response from their banks. Upon reporting the fraud, they frequently receive responses that are frustratingly vague and non-committal. They offer little information, citing banking secrecy, and at times, a goodwill payment that doesn’t fully cover the loss. Victims are sometimes told by the police that the funds have been transferred overseas and nothing further can be done to retrieve the funds.
The technical nature of these scams is deeply concerning. “Drive-by download” attacks and the more advanced “zero-day” exploits make it possible for malware to be installed on phones with little or no user action. These methods exploit vulnerabilities in operating systems and applications.
In view of these sophisticated attacks, how far do the authorities investigate each reported scam, especially those involving screen reading and keylogging malware? Without thorough investigations, it will not be possible to ascertain fault and ensure that innocent victims are not held responsible for losses they did not cause. Is the default blame then placed on the victims who have to bear most of the financial loss?
Scams have emerged as a formidable obstacle in advancing digital access for our citizens, particularly in our senior community. Numerous elderly residents I have encountered express a fear of using internet banking or online payments because they are apprehensive about falling prey to scams. Consequently, I find myself hesitant to advocate the use of digital banking to them, despite its convenience, due to the real risk of them losing their entire life savings if they are targeted by scammers.
This situation has precipitated what the Member for Aljunied, Ms Sylvia Lim, aptly describes as a “crisis of confidence” with the digital banking system. Unless the authorities address the issue of scams more effectively and establish stronger consumer protections, our extensive efforts to transition all our citizens into a digitally empowered society will come to nought.
One tool the government has on hand to deal decisively with scams is the Online Criminal Harms Act. This will allow the government to, inter alia, direct online platforms to disable access to accounts suspected to be involved in scams. Parliament passed this Act last July, however it is only set to be progressively rolled out from this year. When will the Online Criminal Harms Act be fully operationalised? Given that an average of 87 scams are taking place every day in Singapore, each day of delay will be one day too late for many scam victims.
Banks must shoulder a greater responsibility in protecting their customers. I echo Ms Sylvia Lim’s earlier call for banks to reintroduce physical tokens as the default measure for multi-factor authentication for all their customers. Multi-factor authentication relies on a combination of “something you know” and “something you have”. However, when phones are compromised by malware, allowing scammers to view screens and keystrokes, this system collapses into a single factor. This allows scammers, who have access to the password entered by the user, to bypass the additional security layer. Therefore, bringing back physical tokens will reinstate the crucial second layer of security.
The Monetary Authority of Singapore (MAS) must more assertively and decisively tackle the problem of scams in the banking system to protect consumers. In my dealings with MAS when advocating for constituents victimised by scams, I have observed that MAS tends to forward these critical cases to the banks for follow up, instead of directly addressing and resolving the issues on behalf of victims. This delegation process then places the onus on the banks to determine who is at fault — the institution or the victim — for the occurrence of the scam. Such a practice raises serious concerns about the impartiality and effectiveness of the investigation.
I have also observed a discrepancy in MAS’ approach to enforcing actions on financial institutions for different violations. On one hand, MAS imposes very punitive measures like restrictions on acquisitions and additional capital requirements on banks when there are brief downtimes in online banking and ATM services. On the other hand, this level of decisiveness and rigour is markedly absent when addressing scam cases. MAS should require banks to tackle scams with the same level of intensity and rigour as they do in safeguarding consumers’ interests for system outages.
Scam victims need a comprehensive explanation from a knowledgeable and impartial entity like MAS about how the scam occurred. This explanation should detail the roles of banks, telcos, customers and other entities in both the occurrence and prevention of such scams. This will determine who is responsible and who should bear the cost of these fraudulent acts.
Furthermore, responsibility should not be limited to financial institutions, telcos and consumers. Social media companies and mobile phone handset manufacturers should be held accountable for securing their platforms against scams. All handsets sold in Singapore should be required to disable side-loading of apps by default and make it difficult for end users to override critical security features. Social media platforms should be required to have processes in place to remove fraudulent posts soon after being notified.
The Ministry of Communications and Information has revealed that a notable proportion of residents, approximately 37%, do not regularly update their devices. Many of these may be less tech-savvy users. It is not reasonable to expect that everyone will have the technical proficiency to keep their devices updated. Therefore, consumer protection strategies must be designed on the premise that a significant number of users will not know how to keep their devices updated, and should incorporate additional layers of security to safeguard these users.
A central agency should oversee all scam investigations and responses. I am aware of the Anti-Scam Command (ASCom) and the important work their officers are doing. However, given that ASCom is a department under the Commercial Affairs Department of the Singapore Police Force, I don’t think they can be held accountable for whole-of-government efforts to combat scams. Who, therefore, is ultimately accountable for the government’s anti-scam efforts?
To summarise, my recommendations are as follows:
First, banks must significantly increase their responsibility towards customer protection, including by providing physical tokens to customers.
Second, MAS should take a more active role in ascertaining responsibility for scams carried out on banks’ digital platforms and supporting victims.
Third, the Online Criminal Harms Act needs to be fully operationalised without further delay.
Fourth, the government needs to hold technology companies more accountable for the security of their platforms and devices.
And finally, a central anti-scam agency should oversee and be ultimately accountable for the government’s anti-scam efforts.
Mdm Deputy Speaker, we stand at a critical juncture in the battle against scams. Our actions in the face of this scourge will define our commitment to protecting our citizens in the digital age. Let’s act swiftly and decisively to protect our people and, indeed, ourselves. I support the Motion.
