DispatchNews
Singapore banks to phase out OTPs for customers with digital tokens
MAS and the Association of Banks in Singapore say customers who have activated a digital token on their phone will no longer be able to log in with a one-time passcode.
The short answer
In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.
If you read nothing else
- Announced July 9, 2024.
- Applies to customers who already have a digital token on their phone.
- Aimed at phishing scams that capture OTPs on fake bank sites.
What was announced
The Monetary Authority of Singapore and the Association of Banks in Singapore said major retail banks would phase out the use of one-time passcodes for logging into bank accounts, for customers who have activated a digital token on their mobile device.[1][2]
Why
Phishing sites imitating banks can capture a customer’s password and OTP and use them immediately. A digital token bound to the customer’s registered device can’t be relayed that way.
What customers see
Instead of typing a code, customers approve logins with the digital token in their bank’s app.
Sources
- Monetary Authority of Singapore Banks in Singapore to strengthen resilience against phishing scams (2024-07-09)
- Finextra Banks in Singapore to phase out one-time passwords
Changelog
- : Published.
Cite this
Tradecraft. “Singapore banks to phase out OTPs for customers with digital tokens.” Tradecraft, July 9, 2024. https://glide-tradecraft.pages.dev/dispatches/singapore-banks-phase-out-otp/