MAS and IMDA announced the Shared Responsibility Framework for phishing scams in October 2024, and it took effect on 16 December 2024. It covers one kind of scam: you click a phishing link and type your login into a fake site or app. Under the framework, banks, e-wallet providers and telcos each have set duties against that scam. If your bank broke one of them, it's expected to pay back your whole loss. When the bank and the telco both did their part, the loss is yours.
MAS and IMDA call the payout order a waterfall. Whoever broke a duty pays the full loss, and they're checked in a set order. MAS and IMDA have said they won't put a cap on these losses.
Here's the order. The table after it lists the duties, and breaking any one of them is what decides who pays.
| Who | Duty | What you see |
|---|---|---|
| Bank or e-wallet | 12-hour cooling-off | No new payees or contact changes for 12 hours after a new device login |
| Bank or e-wallet | Real-time alerts | An alert for a new device, a risky action and every outgoing payment |
| Bank or e-wallet | 24/7 reporting and kill switch | You can report at any hour and block your own account |
| Bank or e-wallet | Fraud surveillance, from 16 June 2025 | Transfers that drain an account are blocked or held |
| Telco | Authorised aggregators only | Sender-ID SMSes come from registered senders |
| Telco | Block other sender-ID SMSes | SMSes from unauthorised networks are stopped |
| Telco | Anti-scam filter | SMSes with known malicious links are blocked |
MAS added this duty after feedback on its draft. Banks had a six-month transition, so it took effect on 16 June 2025. It asks them to watch in real time for phishing transfers that rapidly drain an account of a large sum.
Malay Mail, citing The Straits Times, reported what counts. The account holds at least S$50,000, and someone tries to move out more than half of that balance. The bank must then block the transfer until it can confirm with you, or hold it for at least 24 hours.
This can catch your own payments too. The Association of Banks in Singapore (ABS) has warned about this. Real transactions may be held or blocked while banks try to reach customers to check them.
Say a digital security token is activated, or someone logs in to your account on a new device. The bank must then block high-risk actions for 12 hours. Adding a new payee and changing your contact details are two of them.
Malay Mail reported that the wait gives you more time to spot something odd on your account. The same 12-hour rule applies to logging in to an e-wallet on a new device.
Your bank also has to alert you in real time when a token is activated or a new device logs in. A high-risk action gets an alert too. Every outgoing payment gets a real-time alert as well. Our guide to setting up a bank's digital token covers the cooling period of at least 12 hours that one bank applies when you set up a token.
Banks and e-wallet providers must give you a reporting channel that works 24/7. You also get a kill switch, a self-service feature that blocks your account at once and stops more money going out.
Our guide to one bank's kill switch and Money Lock settings shows where these tools sit in one banking app.
Telcos carry three duties, and all of them are about SMS. They may only connect to authorised aggregators to deliver sender-ID SMSes, the texts that show a business's name. Sender-ID SMSes that don't come from those aggregators have to be blocked. Every SMS also goes through an anti-scam filter, which blocks messages carrying a link from a database of malicious ones.
Malay Mail reported a separate rule for the sender name. A text shows a business's name only if the sender is registered with IMDA's SMS Sender ID Registry. Texts from senders that aren't registered are flagged as "likely scam".
The framework covers phishing with a digital link. You're tricked into clicking a phishing link and typing your login into a fake site or app. The business or agency being faked must be based in Singapore, or be based overseas and offer its services to Singapore residents.
Here's who is in and who is out:
Banks have their own goodwill schemes beyond the framework. The ABS says each case is weighed on its own. Banks look at how sophisticated the scam was, what the customer did to protect themselves and the customer's finances.
Where a scam was completely outside the customer's control, the ABS says banks would consider paying up to the full loss. For scams outside the framework, Fintech News Singapore reported two routes. You can ask your bank to assess a goodwill payment, or file a dispute with FIDReC.
Our guide to how the fake active ageing centre scam works walks through a scam that gets victims to install an app file.
Your bank is your first and main contact, even if a telco ends up paying. The bank checks whether your case falls under the framework and tells the telco where it applies.
The framework also expects you to do your part. Fintech News Singapore, setting out the aims of MAS and IMDA, says that means good cyber hygiene and not sharing your login details. If it happens anyway, here's how a claim runs:
Only if your case is in scope. That means you clicked a phishing link and typed your login into a fake site or app of a business or agency based in, or serving, Singapore. You also reported it to your bank within 30 calendar days of its alerts. Then your bank is expected to repay your whole loss if it broke any of its duties. If it met them all and your telco broke one, the telco pays. If both met their duties, the loss is yours, though FIDReC and the courts are still open to you.
No. It leaves out scams where you meant to make the payment at the time, such as investment scams and love scams. It also leaves out malware scams, and cases where you gave your login to a scammer by text, phone call or face to face.
The bank and the telco investigate at the same time, each on its own. They should finish within 21 business days for a straightforward case, or within 45 business days for a complex one. The bank then tells you the outcome.
No. MAS and IMDA have said the Shared Responsibility Framework doesn't apply to corporate customers. It covers customers of full banks and of e-wallet providers with a major payment institution licence.
This is general financial information for Singapore, not personal financial advice. Figures change, so verify current rates against the official sources above before acting. See our full disclaimer.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).