Singapore Cannot Fight Financial Fraud by Making Victims Bear the Risk Alone

Scam losses are declining, but the economics of deception remain brutal. Singapore now needs a clearer answer to a question that digital finance has made unavoidable: when a payment is legitimate in form but fraudulent in purpose, who should bear the consequences?

A payment can be correctly authenticated, voluntarily approved and catastrophically mistaken. That is the uncomfortable reality behind a large share of modern financial fraud. Someone posing as an official convinces a frightened customer to transfer savings. A supposed investment adviser cultivates trust in a messaging group. A business receives an altered invoice from an apparently familiar supplier. In each case, the transaction may look authorized within the banking system even though the decision was engineered by a criminal.

Singapore has made measurable progress against scams, but the remaining scale is staggering. In the first half of 2026, Singapore Police Force figures reported by CNA recorded 16,821 cases and approximately S$410.6 million in losses. Reported cases were down 14.4% and losses down 17.9% year on year. This is progress, not victory.

The most revealing statistic is that about 80.8% of reported scams involved victims making transfers themselves, according to the same police account. This should change how the country frames the problem. The key vulnerability is often not a broken password but a manipulated person, persuaded to use a secure financial system in an insecure way. A defense based solely on telling customers to be more careful cannot be enough.

The answer is not an unconditional promise that banks refund every bad decision. It is a more intelligent division of responsibility that gives each participant a reason to stop fraud at the point where it has the greatest capacity to act.

The scale of the problem demands precision, not panic

Loss figures alone do not reveal the severity of individual harm or how much frozen money actually reaches victims. It matters.

The police’s half-year figures showed that investment scams caused roughly S$169.8 million in losses, making them the largest category by dollar amount. Government-official impersonation scams cost about S$90.8 million. Business email compromise losses rose to S$57.3 million, substantially higher than a year earlier, while e-commerce scams were the most common category by case count.

A serious strategy cannot treat these offences as interchangeable. An investment scam may unfold over weeks of persuasion. A compromised invoice might exploit a business’s payment workflow and supplier verification failures. A phishing attack may seek account credentials and allow an unauthorised account takeover. Prevention that works for one can miss another entirely.

The police also reported more than S$97.7 million in losses recovered or frozen through anti-scam efforts in the first half, and at least S$127.1 million in potential losses prevented. Those figures should not be added together and called money returned to victims. The recovered amount described funds secured in accounts or wallets, rather than automatically refunded, while prevention estimates refer to money that might otherwise have been transferred.

An important sign of progress appeared in a joint police-bank operation from July to August. Working with DBS, OCBC, UOB, Standard Chartered Singapore and GXS, authorities reported disrupting more than 400 ongoing scam attempts and averting over S$46 million in potential losses. The achievement shows what rapid intelligence-sharing can do. It also shows that the most useful intervention is often the one made before the transaction becomes irreversible.

The false boundary between ‘authorised’ and ‘fraudulent’

Banking law and payment systems need to determine whether a transaction was authorised. Customers need to determine whether the person asking them to pay is legitimate. Criminals exploit the gap between those two judgments. A person can authorise an instruction without understanding that the alleged identity, emergency or investment opportunity is fictitious.

From the bank’s operational perspective, the payment may have passed the required checks. From the customer’s perspective, the decision was based on deception. From a regulator’s perspective, the central challenge is to reduce the number of fraudulent transfers without imposing excessive friction on normal commerce. None of these perspectives is automatically complete.

The distinction matters because Singapore’s Shared Responsibility Framework, established by the Monetary Authority of Singapore and the Infocomm Media Development Authority, addresses a defined set of phishing scams and corresponding duties of financial institutions and telecommunications operators. It should not be represented as a universal, automatic reimbursement scheme for every investment scam, impersonation loss or unauthorised payment.

The MAS policy overview describes a duty-based approach to accountability, with expected payments when covered entities breach applicable duties. Outside its scope, other avenues of complaint, discretionary remediation and dispute resolution may still matter. A framework with boundaries can be useful, but misunderstanding those boundaries is dangerous for consumers.

Singapore therefore faces a policy question larger than the framework itself: should the treatment of authorised-but-fraudulent payments increasingly depend on whether an institution could reasonably have recognised and interrupted suspicious behaviour? If so, how can authorities define that standard without creating either limitless liability or a system so rigid that ordinary customers cannot transact?

The bank has information the consumer does not

A bank can observe transaction histories, unusual beneficiary patterns, sudden transfers, device activity and other signals that a customer usually cannot see. It may be able to identify a suspicious movement of funds across its network or cooperate with law enforcement more quickly than an individual victim. That informational advantage creates an obligation to invest seriously in monitoring and response.

In a November 4, 2026 parliamentary reply, the MAS chairman described safeguards including real-time fraud surveillance, transaction alerts and tools allowing customers to lock cards or contact emergency hotlines. These are meaningful measures, but their existence is not the same as proof that they catch every relevant pattern. The right questions are whether the alerts are timely, intelligible and effective, and whether a customer can obtain rapid assistance when something seems wrong.

Some transfers are anomalous for obvious reasons: an account suddenly sends large sums to unfamiliar recipients, or successive transactions rapidly drain savings. Other payments look routine until an external clue emerges—a fake commercial identity, a coerced beneficiary or an organised scam network. Banks should be judged against what their systems could reasonably know, not against an impossible expectation of omniscience.

There is a practical argument for narrowly designed delays on high-risk transactions. A pause can give a frightened customer time to speak with a trusted person, question the caller’s identity or contact the real institution using a verified channel. Delays can impede legitimate payments, so intervention must target demonstrable risk.

The strongest protection may be intelligently placed friction rather than universal friction. A system that quietly processes ordinary transactions while interrupting unusual, high-risk ones could protect both safety and convenience better than a blanket regime. Proving that requires measurement—false positives, prevented losses and customer outcomes—not slogans about innovation.

Platforms and communications networks are not innocent bystanders.

Many scams begin far from a bank. A fraudulent advertisement appears on a platform. A fake mentor builds credibility in a messaging group. A message impersonates a government office. An email thread is altered just before a supplier payment. By the time money reaches the banking system, crucial deception may already have happened elsewhere.

The mid-year police account highlighted investment-scam techniques involving impersonation and online chat communities. That makes digital platforms significant points of prevention. Verification of advertisers, rapid removal of impersonating accounts, better evidence preservation and effective escalation channels can affect whether the fraud is ever attempted successfully.

The challenge is to assign duties according to practical influence. Telecommunications providers can filter certain harmful communications. Platforms can moderate fraudulent ads and impersonation networks. Banks can assess money flows. Police can coordinate investigations and freeze illicit proceeds. Consumers still need reasonable opportunities to identify deception. A strategy that names only the victim at the end of the chain ignores the institutions able to intervene earlier.

Singapore’s September 2026 anti-scam legislative changes expanded tools for cooperation with service providers, including specified information-sharing and restrictions on accounts linked to scams. Such powers may reduce criminal opportunities, but they also need oversight. If a legitimate account is disabled in error, the disruption can be acute, particularly for someone who relies on it for wages or essential purchases.

It is possible to believe simultaneously that the state needs better anti-scam powers and that ordinary people need effective remedies when those powers are misapplied. A financial system worthy of trust should be able to hold both positions.

The overlooked issue of financial exclusion

Scam prevention increasingly intersects with the right to a basic bank account. Risk controls that are excellent at denying access can be poor at distinguishing malicious users from people caught in confusing or suspicious circumstances. For customers excluded from the payment system, a dispute over account access can quickly become a dispute over food, rent and employment.

In a November 3 parliamentary reply, the MAS chairman explained the availability of limited-purpose bank accounts for many Singapore citizens and permanent residents whose standard accounts are closed or denied, subject to exceptions. The principle is sound: severe restrictions should not automatically remove every avenue for essential lawful payment activity.

The implementation deserves scrutiny. Customers need understandable reasons to the extent legally possible, a realistic review process and accessible support. Regulators should study both the effectiveness of account restrictions against scams and the incidence of unjustified exclusion. If a protective system creates invisible hardship, it can erode trust even as it prevents crime.

A modern society increasingly treats digital payments as essential infrastructure. That raises the standard of fairness for institutions that control access. Banks should not be forced to take unlimited financial-crime risks, but neither should consumers be left without a credible path to resolve mistakes.

Artificial intelligence changes the economics of deception

The threat from AI is not merely a dramatic deepfake video. It is the ability to generate convincing messages at scale, tailor an impersonation to a specific victim, translate naturally across languages and maintain a persistent fictional identity. Criminals can lower the cost of experimentation while increasing the realism of some approaches.

In remarks accompanying the MAS 2025/2026 annual report, the regulator discussed more personalised AI-assisted scams and the need for banks to improve fraud-detection models. It also disclosed that roughly S$47 billion was protected under the Money Lock function as of May 2026. The function illustrates an important concept: the freedom to move money instantly is not always the same as the freedom to preserve it safely.

But there is also risk in overconfident automated decision-making. A model that labels a lawful transaction suspicious can trap customers in opaque procedures. A model that fails to recognise a new scam variant can provide false comfort. Human review, explainable escalation processes and testing against real outcomes should accompany claims of AI-driven protection.

The relevant innovation is not an impressive detection dashboard. It is a measurable reduction in losses and harm without intolerable collateral damage to legitimate financial life.

A fair counterargument: unlimited reimbursement would make matters worse

Those sceptical of expanded bank responsibility have a legitimate concern. If customers believe every authorised transfer will be reimbursed, some may take fewer precautions, while criminals devise new ways to abuse the guarantee. Banks may respond by charging more, rejecting more transactions or withdrawing services from customers they perceive as risky. A poorly designed liability regime could hurt the very households it intends to protect.

Such incentives must be taken seriously. Responsibility should be calibrated to what an institution could reasonably prevent and whether it fulfilled defined duties. Customers must retain agency, and payment systems must remain usable. A uniform compensation rule would be blunt; it could make ordinary financial activity less accessible without solving the underlying deception.

Yet the opposite extreme—treating every customer-approved transfer as solely the customer’s problem—would also produce bad incentives. A bank might invest less than socially optimal amounts in detection if most of the losses fall on households. A platform might profit from advertising while leaving expensive cleanup to police and banks. An effective framework makes prevention worthwhile for the parties best placed to prevent harm.

What a better Singapore model would measure

Singapore should report consistent statistics on preventable losses, intervention success, complaint outcomes and false-positive restrictions, alongside headline scam losses. It should distinguish money frozen from money repaid and publish clear explanations of how different scam types fit within different compensation regimes. Greater transparency would help the public understand actual protections rather than rely on vague assurances.

Banks and platforms should be encouraged to test interventions jointly, including targeted payment pauses, beneficiary warnings, suspicious-ad takedowns and rapid information-sharing. Police and regulators should assess which interventions prevent the most harm per unit of cost or inconvenience. Firms should have incentives to fix recurring weaknesses, while consumers should have practical routes to appeal and recovery.

At the same time, legal protections must respect privacy, proportionality and due process. Fighting financial crime does not justify indefinite, unexplained restrictions on innocent users. The system should protect both personal savings and access to the infrastructure of everyday life.

For policymakers, the central test is whether responsibility follows capacity. If one party controls a risky communication channel, another holds the money and a third maintains investigative powers, each should carry obligations aligned with the harm it can realistically prevent. Responsibility shared in this manner does not dissolve accountability; it makes it operational.

Trust is the ultimate financial infrastructure

Singapore’s falling scam totals are an achievement. But hundreds of millions in losses during six months remain a profound challenge for an economy built on trust, efficient transactions and sophisticated financial institutions. A victim who authorised a payment while being expertly deceived may bear part of the responsibility. That does not justify ignoring the systems that enabled the deception and the transfer.

The goal should not be to guarantee a world without financial crime, which no jurisdiction can promise. It should be to build a system in which fraud is harder to initiate, easier to interrupt, less devastating when it occurs and subject to remedies that ordinary people can understand.

Digital finance has reduced the friction of sending money. The next phase of progress must reduce the friction of keeping it safe. Singapore’s institutions have the skills and coordination capacity to do that. Whether they allocate the costs of prevention fairly will determine how much of the public’s trust they retain.

Singapore’s scam losses declined in the first half of 2026, but still reached S$410.6 million. Many victims authorised transfers themselves under deception, exposing a gap between technical payment security and real-world protection. An effective response should assign clear, proportionate duties to banks, platforms, telecommunications operators and regulators while preserving consumers’ access to essential financial services.

Singapore’s scam losses are falling, yet victims still lose hundreds of millions. The unresolved question is who should act—and who should pay—when fraud succeeds through a valid payment.