| Making Sense of Internet Banking Security |
Increasingly, many people are making use of Internet banking to conduct financial transactions such as fund transfer, bills payment, online shopping, etc. Therefore, it is not surprising that progressively, more cyber crooks, thieves and scammers are devising ways to access customers’ Internet banking accounts and make a profit at the expense of Internet banking consumers.
Read on to find out how you can take simple steps to safeguard yourself from becoming a victim. PIN, PLEASE?Case 1: Mr Wong received a call from a person named Siebel allegedly from ABC bank. Siebel explained that there was a security breach and Mr Wong’s banking account had been compromised. Siebel told him that as a preventive measure, the bank had suspended his account. Siebel advised Mr Wong to go to the nearest bank branch to reactivate his account. When Mr Wong expressed his displeasure, Siebel offered to assist Mr Wong in activating his account. He then requested Mr Wong to provide his user ID, Internet banking PIN and One-Time Password (OTP) from a hardware token or SMS for verification. Mr Wong quickly rattled off his details and hung up.
Two days later, Mr Wong was shocked to discover that his entire savings were depleted. When he queried the bank, he was told that no one from the bank had contacted him.
In this case, Mr Wong should not have given away his login credentials (e.g. User ID, password, OTP). Remember that your PIN and OTP are confidential and should not be disclosed to anyone. This applies even to requests purportedly from people claiming to be employees of banks. A bank will not ask customers to reveal their login credentials. Below are some tips that you can adopt to protect your PIN and OTP:
ONE-TIME PASSWORD (OTP) SECURITYTo further strengthen the security of Internet banking, banks have implemented two-factor authentication (2FA) system at login. This means that bank customers are required to enter an OTP generated by a token or received through SMS via a registered mobile phone number in order to use Internet banking services. Users of Internet banking services should continue to be vigilant even with the increased security afforded by 2FA.
Case 2: Mr Lim uses Internet banking services frequently to make online transactions. With the implementation of 2FA, Mr Lim’s bank decided to issue hardware security tokens for all Internet banking users. For convenience, Mr Lim wrote down his user ID and PIN on his security token which was kept in his desk drawer. While he was on holiday, a thief broke into his house, found his Internet banking security token and used it to access his bank account. When Mr Lim returned, he realized that his savings had disappeared from his bank account. He immediately alerted the bank and made a police report. However, his monies could not be recovered as under the bank’s Internet banking terms and conditions, it was not liable for any losses incurred due to his negligence.
In this case, Mr Lim should have kept his security token in a safe and secure place and not have casually placed it in an unlocked drawer. Mr Lim should have memorised his user ID and PIN, and not have written them on his security token.
Case 3: Joyce received a congratulatory SMS message indicating that she had won a lottery sponsored by XYZ bank. Soon after, Joyce received a call informing her that she needed to open an Internet banking account to enable the prize money of $20,000 to be credited into her bank account in XYZ bank. In addition, she would need to inform the caller of her Internet banking User ID and PIN as well as register a mobile phone number provided by the caller. Being eager to receive the prize money, Joyce was quick to oblige. A week later, Joyce checked her bank account at the ATM and realized that some funds had been withdrawn from her account. Here are some MoneySENSible tips to safeguard your security token and OTP:
PHISHY BUSINESSPhishing (pronounced “fishing”) is a technique used by fraudsters to obtain sensitive personal information such as your account details, PIN, OTP, credit card number, user ID or password through the Internet. Once such sensitive information is obtained from you, the fraudsters may be able to access your Internet banking account.
Many tricks are involved in phishing scams. The most common method is sending you an email purporting to be from your bank, credit card company or service provider. Usually, the bogus e-mail looks as if it comes from a bank or payment service provider, requesting confidential account information for verification. Often, they threaten to discontinue service if the information is not provided. Some scam emails may contain URL links which may appear to automatically connect you to the bank’s website. However, once you click on the link, you will be directed to a bogus website which may look exactly like the original.
Case 4: Grace received an email allegedly from her bank notifying her that the bank was conducting an online lucky draw and containing a hyperlink to the lucky draw website. Upon clicking on the hyperlink, she was brought to a page that looked identical to her bank’s Internet banking login page. She quickly keyed in her user-ID, password and OTP generated by her security token to participate in the lucky draw. Days later, she was shocked to discover money had been taken out from her account. When she contacted the bank about her losses, she learnt that the bank had not held any lucky draw. Grace became one of the many victims of an identity theft scam. Always remember that:
CONCLUSIONInternet banking has brought much convenience and many benefits. However, we must always be mindful of fraudsters and scammers who try to defraud us. We should always exercise vigilance and safeguard our login credentials, security tokens and registered mobile phones. This information is provided by the Monetary Authority of Singapore as part of the MoneySENSE national financial education program.
Copyright © SMARTINVESTOR
Smart Investor is available at leading magazine outlets |
tycho