Banks bolstering security

PETALING JAYA: Banks are already doing what they can to make it difficult for scammers who cheat people by using fund transfer, say regulatory authorities.

Such an example includes introducing the “kill switch”, a digital facility for victims to freeze their accounts to prevent any movement of funds as an immediate measure to thwart scammers if the victims suspect they are being taken for a ride, said Bank Negara Malaysia (BNM) as well as the Malaysian Communications and Multimedia Commission (MCMC).

The other is the proposed imposition of a 48-hour cooling-off period for fund transfers.

However, BNM and MCMC stopped short of saying they will impose a 48-hour cooling-off period on all commercial banks as a broad countermeasure to deter scams (a cooling-off period is a certain lapse of time before a banking transaction is approved by financial institutions at both ends) in their response to The Star’s May 2 article titled “Fighting chance to beat scammers”.

While BNM stated that commercial banks are currently free to self-impose an appropriate cooling-off period to deter fraud, given that fraud patterns differ between banks, MCMC said the agency is only willing to play a supportive role to BNM in policing financial scams.

“All banks are subject to high standards of security. Over the years, BNM issued various guidelines and regulations to the banks to progressively elevate security safeguards against the latest financial scam threats.

“In September 2022, BNM announced five countermeasures to strengthen online banking security, which includes requirements for banks to migrate from SMS OTP (one-time password) to more secure forms of authentication; tighten detection rules and triggers to detect and block suspicious transactions; implement a cooling-off period for first-time enrolment of online banking services and secure devices; limit the number of registered devices that can be used for authenticating transactions; and establish dedicated scam hotlines for victims to contact the banks to report scam incidents promptly.

“Other measures include a kill switch for victims to freeze their banking accounts temporarily to stop further loss of funds,” said BNM, adding that it has observed steady progress by banks in implementing these countermeasures, along with system enhancements and upgrades, additional training, and awareness activities.

“As fraud patterns differ between banks, each bank must ensure that the countermeasures commensurate with the level of risk observed. Hence, banks will apply an appropriate cooling-off period that effectively deters fraud whilst maintaining a reasonable customer experience, without excessive friction.

“Generally, most banks have adopted a cooling-off period of between 12 and 48 hours, depending on the type of transaction or banking activity.

“This is not inconsistent with practices observed in Singapore and Australia,” said BNM in an e-mail to The Star.

On May 12, MCMC chairman Tan Sri Mohamad Salim Fateh Din said statistics obtained from the Commercial Crime Investigation Department (CCID) of the police for the period between 2021 and April 2023 revealed losses as a result of scams amounted to RM1.2bil.

“Since the inception of the National Scam Response Centre (NSRC) in October 2022, 11,858 scam complaints have been received as of April 2023,” he said.

When asked about the 48-hour cooling off period, MCMC replied that the agency preferred that the issue of scamming be handled mainly by BNM and the police.

“MCMC is a regulator responsible for information security and integrity in a network. As scams using networks, including the digital transfer of funds, are growing concerns, we will be discussing with BNM and other agencies on measures that can be utilised.

“As a technical agency and regulator of digital communications, MCMC will support lead agencies under NSRC in implementing remedial action,” said MCMC.

Commenting on The Star’s May 2 story, cybersecurity law expert Derek John Fernandez said the 48-hour cooling off period may offer scam victims enough time to pull their money back as victims typically realise they’ve been duped after 24 hours.

Fernandez, who proposed the 48-hour cooling-off period, among other things, in a paper to government agencies last year, argued that MCMC has a critical role to play, including using its powers under the MCMC Act 1998.

“If consumers suspect the transfer they initiated is to a scammer, they can cancel immediately. MCMC can then publish these account numbers on its website to alert others,” he said in his proposal.