Phished in Singapore: When the Bank or the Telco Has to Pay You Back

2026-11-06 · Philip Choo · AI9OS

A scam victim's usual route to their money runs through the courts. Our note on frozen accounts explains why a freeze is not a refund. There is one narrow route where the answer can be different, and it is not a lawsuit. It is the Shared Responsibility Framework, in force since 16 December 2024.

This note sets out what the guidelines say. It is general information, not legal advice.

The one kind of scam it covers

The framework applies to a "seemingly authorised transaction", and all four parts of the definition must be met (para 2.1):

1. the scammer impersonated a legitimate business or government body, such as a bank or an agency;
2. the scammer used a digital messaging platform, such as SMS, email, WhatsApp or social media, to get your account credentials;
3. you entered your credentials on a fake website or app; and
4. those credentials were used for transactions you did not intend.

That is phishing in the strict sense. If you were talked into sending the money yourself, to a fake investment, a fake romance or a fake job, the framework does not cover it. Credit, charge and debit cards issued in Singapore are also outside it; they have their own rules (footnote 1).

The account must be a personal one held by individuals, able to hold more than S$1,000 or be a credit facility (para 2.1, "protected account").

The bank's five duties

The bank (or a major payment institution that issued the account) is assessed on five duties (para 4.2):

1. a cooling-off period of at least 12 hours after a digital token is activated on a new device, during which high-risk activities such as adding payees or raising limits are blocked;
2. real-time alerts when a token is activated and when high-risk activities happen;
3. real-time alerts for outgoing transactions;
4. a reporting channel open at all times, with a self-service "kill switch" to block online access; and
5. real-time fraud surveillance, which for an account of S$50,000 or more losing over half its balance in 24 hours means blocking or holding the transfers (footnote 8).

If the loss arises from the bank missing any of these, the bank is expected to bear it in full (para 6.2).

The telco's three duties

If the scam came by SMS, the mobile operator is assessed on three duties (para 5.2): delivering Sender ID messages only from authorised aggregators, blocking Sender ID messages from anyone else, and running an anti-scam filter against a database of known malicious links.

The order matters. The telco pays only if the bank met all of its duties and the loss arises from the telco's breach (para 6.4). If neither breached a duty, the loss stays with the account holder (para 6.7). Losses are the transferred sums; consequential losses are excluded (footnote 11).

The deadlines that decide claims

• Report to the bank as soon as practicable, and no later than 30 calendar days from when the bank sent the alert (para 7.3).
• Within 3 calendar days of reporting, give the bank a valid email address and supporting material, such as a police report and the message trail (para 7.3).
• Keep the scam messages. The bank may ask for records showing the scammer posed as the entity, tried to get your credentials, and sent you to a fake site; for an SMS scam, your mobile number and a screenshot of the message with date, time and sender (para 7.4 and footnote 15).

The bank is your single point of contact, even when the telco is involved (para 7.1.1). Investigations should finish within 21 business days, or 45 for complex cases (para 7.9).

If you disagree with the outcome

Disputes with the bank go to the Financial Industry Disputes Resolution Centre (FIDReC). Disagreements with a telco's assessment go to IMDA in writing (para 7.11).

What to take from it

The loss test in section 6 of the guidelines does not ask whether you were careless. It asks whether the bank and the telco did eight specific things. So the paperwork decides more than the embarrassment does: confirm the scam fits the four-part definition, report within 30 days, send the evidence within 3, and keep every message.

Sources

• Monetary Authority of Singapore and Infocomm Media Development Authority, Guidelines on Shared Responsibility Framework, issued 24 October 2024, effective 16 December 2024. Read 5 October 2026; check mas.gov.sg for any later revision.

(General information, not legal advice.)