New phishing framework redefines accountability for banks and telcos

The framework outlines responsibilities but adds cost burdens.

Singapore’s new phishing framework sharpens the roles of banks, telecom companies, and consumers in combating phishing scams, with provisions for victim compensation when responsibilities are unmet.

The clarification, while beneficial, brings challenges, especially for financial institutions and telcos, according to Rakesh Kirpalani, Director of Dispute Resolution & Information Technology and Chief Technology Officer at Drew & Napier.

Kirpalani emphasised that the framework does not significantly alter existing responsibilities but provides much-needed clarity. “Actually, it doesn't really change responsibilities very much. It clarifies the roles that financial institutions, telcos, as well as their users, have in respect of dealing with this issue of phishing scams,” he said.  

While clarity is a key advantage, Kirpalani pointed out that financial institutions and telecom companies face added effort and costs to comply with the framework. “I imagine the key drawback to be the effort and cost in dealing or complying with their obligations under the phishing framework,” he said.  

On the other hand, the framework distributes responsibilities across stakeholders, easing the burden on any single entity. “The good thing about the framework is that it shares that burden across the financial mission to telcos as well as the users,” Kirpalani added.  

To further bolster Singapore’s defences against phishing scams, Kirpalani stressed the importance of public education. “I think that it is important that education, public education and awareness of scams, phishing scams and other new types of scams keep appearing these days, particularly with the advent of artificial intelligence,” he said.  

Education, he argued, is the most effective tool for combating rapidly evolving threats. “These issues tend to develop and move very quickly with technology, and so it's the only way to effectively, continuously combat them, is if potential victims are able to spot the signs of these scams and these phishing attacks and get out ahead in front of them, rather than being behind the curve,” Kirpalani explained.