Stricter ways of verifying customers’ identity required under MAS plan

Banks, insurers and other financial institutions may have to implement more stringent ways of verifying customers' identity in non-face-to-face situations such as phone or online banking.

The Monetary Authority of Singapore (MAS) yesterday issued a consultation paper on the types of information required for such verification.

The proposed requirements come against the backdrop of rising impersonation scam cases, and seek to address risks arising from theft and misuse of a person's personal particulars, MAS said.

Under the proposed notice, it would be mandatory for a financial institution, such as a bank, to use at least one of the following types of information for non-face-to-face verification through channels such as phone or online banking:

• A password or PIN,
• A one-time password generated through a hardware or software token,
• Biometric information which uniquely identifies the individual,
• Information that is known only between the individual and the financial institution, such as account transaction details.

These would be required before any transactions or requests from the client are undertaken, MAS said.

Financial institutions would also be prohibited from relying on common personal information, such as their NRIC number, residential address and date of birth, as the sole means of identity verification.

Singapore

Passenger says $10 taxi booking fee is unfair

Aug 28, 2022

Related Stories

TNP goes fully digital

DBS restores digital banking services, rules out cyber attack

Vegetable prices here rise due to wet weather in M'sia

The measures would strengthen the authentication controls implemented by financial institutions, MAS said.

MAS chief cyber security officer Tan Yeow Seng said personal information like NRIC numbers are often provided by the public for various purposes, such as filling in application forms. Such information could be used for impersonation fraud.

"The proposed notice will further bolster consumer confidence in financial institutions by making these identity verification practices compulsory during non-face-to-face financial transactions," Mr Tan said, adding that consumers should also play their part by not disclosing their online banking login credentials to others.

Separately, MAS' Cyber Security Advisory Panel has recommended financial institutions to review their risk profiles and adequacy of risk-mitigating measures to maintain oversight of third-party vendors.

These recommendations were presented at an MAS management meeting last Thursday.

While Singapore's financial sector has done well so far in its cyber and operational resilience, it cannot rest on its laurels, MAS managing director Ravi Menon said. "Financial institutions must remain alert and nimble and strengthen their defences against emerging cyber threats," he said.

• ADDITIONAL REPORTING: NG WEI KAI