“The digital token will authenticate customers’ login without the need for an OTP that scammers can steal, or trick customers into disclosing”
The Monetary Authority of Singapore gave DBS, OCBC and UOB three months to stop logging customers in with one-time passwords. Phishing sites, SIM swaps and Android SMS-stealing malware all harvest the codes. Customers move to a digital token bound to their phone. Customers who never activate the token keep getting OTPs, so the scammers keep their targets.