Briefing / Flash / Policy
Singapore banks to phase out OTPs for customers with digital tokens
MAS and the Association of Banks in Singapore say customers who have activated a digital token on their phone will no longer be able to log in with a one-time passcode.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.
High confidence
Based on the Monetary Authority of Singapore's own media release.
Key points
- Announced July 9, 2024.
- Applies to customers who already have a digital token on their phone.
- Aimed at phishing scams that capture OTPs on fake bank sites.
What was announced
The Monetary Authority of Singapore and the Association of Banks in Singapore said major retail banks would phase out the use of one-time passcodes for logging into bank accounts, for customers who have activated a digital token on their mobile device.[1][2]
Why
Phishing sites imitating banks can capture a customer’s password and OTP and use them immediately. A digital token bound to the customer’s registered device can’t be relayed that way.
What customers see
Instead of typing a code, customers approve logins with the digital token in their bank’s app.
Sources
- Banks in Singapore to strengthen resilience against phishing scams Monetary Authority of Singapore, 2024-07-09
- Banks in Singapore to phase out one-time passwords Finextra
Changelog
- Published.