• Do not reveal the following information to anyone:

  • OTP generated by the 2FA token or sent to you via SMS

  • Serial number of your 2FA token

  • Your log-in credentials

  • Your personal, financial, bank account of credit/debit card information to strangers or little known or suspicious websites

• Do not allow others to keep, use or tamper with your 2nd factor authentication (2FA) security token. Please keep your token secure at all times

• Check your bank account information, balance and transactions frequently and report any discrepancies

• Be on the alert for suspicious emails and websites (which may contain malicious software) or mobile messages, purporting to be from the Bank. You should report these immediately by contacting us

• We will not make unsolicited requests for your personal, financial, bank account or credit/debit card information, or unsolicited requests that require you to log in and verify your account validity, through e-mail, mobile messages or on phone unless you have initiated the contact. Under no circumstances will the Bank ask you to reveal your PIN/Password

• Update us immediately when there is a change in your contact details such as mobile phone number and e-mail address so that you continue to receive SMS alerts or e-mail notifications for online banking transactions and activities

• Please inform us immediately if:

  • You are aware of any suspected fraud, including any compromise or loss of your security device or security details; or

  • You receive SMS or e-mail alerts for transactions which you did not perform; or

  • You are alerted on change of daily withdrawal limit or add beneficiary for transfer to an account which you do not know of or did not perform

  • You notice any unusual/unauthorised transactions. You also have the right to do the following under such circumstances:

    1. Suspend your access to OCBC online banking services

    2. Cancel the relevant services

    3. Request for a new set of OCBC online banking log-in credentials

    4. Obtain information from the Bank regarding your online transactions

Personal Banking

• Your PIN should be:

  • Six-digits long. Do not repeat any digit more than once

  • A unique number. It should not be drawn from your telephone number, birthday or other services you might have

  • Kept confidential

  • PINs must be changed regularly, or when you suspect it has been compromised or impaired

Business Banking

• Password should be 8 to 12 characters:

  • It must contain at least 2 letters and 2 numerals

  • Characters cannot be repeated more than twice

  • First two characters must be different from your User ID

  • Password and Organisation ID cannot be identical

  • Password cannot be identical to the previous 10 passwords that you have used

  • Example of a password: velocity01#

    Password is case sensitive, for example "Velocity01#" is a different password from "velocity01#"

Malware are malicious programs that targets customers' computers/mobile devices in order to steal their login credentials, for example your online banking access code, PIN and One-Time Password (OTP) or Organisation ID, User ID and Password. Once your computer is infected, a cybercriminal will be able to conduct fraudulent money transfers from your account.

Cybercriminals send emails with attachments that may appear to originate from trusted companies. Malware could be hidden in the attachments in emails and in the disguise of invoices or accounting documents.

A malware may also direct you to a fake webpage that looks like OCBC Bank's login page. It may prompt you to enter any of your log-in credentials or OTP from your security token.

By having an up-to-date anti-virus software on your computer or mobile device, you could greatly reduce your risk of getting infected. For more information on safeguarding measures, refer to Security for PC/Mac and Security for Mobile.

Phishing is a form of social engineering used by cybercriminals to convince you to install malicious software that leads to stealing your personal information.

Phishing attacks typically use emails or malicious websites to solicit personal information by posing as legitimate companies or trustworthy organisations.

For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers use it to gain access to the accounts.

Phishing attacks tend to intensify on significant current and seasonal events such as:

• Natural disasters
• Epidemics and health scares
• Economic concerns
• Major political elections
• Holidays

• Ensure that emails are authentic before acting on them:

  • Do not download or open any attachments from emails you find suspicious, even if they came from someone you know
  • Delete emails that come from unknown sources
  • Do not respond to emails asking for confidential information, e.g. your financial or personal information. Phishers like to use scare tactics and may threaten to disable an account or delay services until you update certain information
  • Do not use links in an email or instant message to connect to the Bank's website unless you are certain they are authentic. Instead, open your browser and type the URL directly into the address bar

• Protect your computer with firewall, spam filters, anti-virus and anti-spyware software. Ensure you are getting the most up-to-date software and update them regularly to ensure that you are protected against new viruses and spyware

• For specific safeguarding measures on phishing scams, refer to Security for PC/Mac and Security for Mobile

Watch out for these warning signs:

• The URL showing on the login page is different from the official page:
  Personal Banking: https://internet.ocbc.com/internet-banking/ or
  Business Banking: https://velocity.ocbc.com/login.html

• The login screen looks different. The legitimate OCBC login process consists of two steps:
  Personal Banking
  First step: Access code and PIN
  Second step: Enter one-time password (OTP)
  Business Banking
  First step: Organisation ID, User ID and password
  Second step: Enter one-time password (OTP)

• You are prompted repeatedly for your log-in credentials even though you have entered the log-in credentials correctly

• A delayed pop-up screen that says the system is not available and repeatedly asks you to enter OTP or use your security token to generate an OTP

• You are prompted to authorise transactions which you have not initiated using OTP generated through your security token. For example: While trying to login, you are prompted to enter a 6-digit number shown on your computer screen into your security token. Then you are asked to press the 'Sign' button on the token and key in the OTP generated from the security token into the computer screen

• Your PIN/Password should be masked when you type it in

• You receive SMS messages on OTP or transactions which you did not initiate

• A redirection to a third-party website, which may feature a hotline number or an unsolicited request

• You receive a call purportedly from a staff in OCBC asking you to verbally reveal your Access Code/Organisation ID, PIN/Password, OTP or security token details

• When you mouse over the embedded URLs in an email message, the hyperlinked address is different from the Bank's official URL

• An email message that contains poor spelling and grammar

• The message is making big promises and the offer seems too good to be true

• The message is making unrealistic threats, e.g. the phisher use intimidation to scare victims into giving up confidential or personal information

• You receive a message notifiying you of transactions that you did not perform

• When a message asks for confidential or personal information. The Bank does not make unsolicited request for your information via email or phones

• Unfamiliar screen pop-ups. These may ask you to install unknown apps or to grant special permission to specific apps

• Shown a fake overlay login page which asks for your banking log-in credentials or credit card information

• Abnormal battery drainage due to malware uitilising the system resources

• Experience serious performance problems as the malware is actively running in the background

• Experience dropped calls or strange disruptions during a conversation due to interference of mobile malware

• Unusual phone/data bills as a result of malware sending SMS text messages to premium-rated number

• Unusual change in the look-and-feel of your smartphone (such as new icons or applications)

• Your smartphone shuts down abruptly or gets locked up with the screen displaying the message 'System update in progress' even after it has force-restarted

• When any hyperlinks provided in the message do not match our official pages:
  Personal Banking: https://internet.ocbc.com/internet-banking/
  Business Banking: https://velocity.ocbc.com/login.html

• The message in an email contains poor spelling and grammar

• The message is making big promises and the offer seems too good to be true

• The message is making unrealistic threats, e.g. the phisher use intimidation to scare victims into giving up confidential or personal information

• You receive notifications of transactions that you did not perform

• When a message asks for confidential or personal information. The Bank does not make unsolicited request for your information via email or phones

The Guidelines are issued by MAS to protect users of electronic payments. They aim to encourage wider adoption of e-payments in Singapore.

The Guidelines establish a common baseline protection that Financial Institutions will provide to individuals and sole proprietors from losses arising from unauthorised e-payment transactions from their protected accounts.

Protected accounts as defined in the Guidelines are those that:

• are held by either individuals or sole proprietors, including those held jointly by multiple account holders; and
• can hold a balance of more than S$500 or equivalent at any one time (Stored value facilities like EZ-Link card and NETS Cashcard are thus not covered by the Guidelines), or is a credit facility

The guidelines cover all payments initiated through electronic means, and where funds are received through electronic means. These include online payments and transfers.

The Guidelines set out your responsibilities as an e-payment user to adopt good security practices. These include how you should protect your device, login credentials, access codes and protected accounts.

We will provide you with transaction notifications and a reporting channel so that you may be alerted of unauthorised transactions and report them should they happen.

We will investigate claims of unauthorised transactions, with the aim of achieving a fair and reasonable resolution.

Please note that the Guidelines do not apply to scams or frauds, which will be investigated by the police.

The notifications safeguard you against unauthorised and erroneous transactions. They are to alert you of such transactions so that you may report them to us for quicker resolution.

Notifications will be sent by us for outgoing payments initiated through electronic means. These include online payments/transfers and debit/credit card transactions.

Some electronic transactions may not trigger notifications if they were not initiated or received through electronic means. Transactions initiated by us, such as credit card cashbacks, will not trigger notifications under the Guidelines.

The notifications you receive may also depend on your instructions to us. For instance, you may have instructed us that a notification be sent only for certain types of outgoing transactions or if a transaction is above a certain amount.

For Individuals:

For Sole Proprietors:

*Transactions initiated by the bank, such as credit card cashbacks, will not trigger notifications under the Guidelines.

Where you have set thresholds for transaction notifications previously, those thresholds will continue to apply. Otherwise, the default threshold set by us will apply.

Notifications may be sent via any of these channels:

You are automatically enrolled for notifications of outgoing transactions initiated through electronic means. This is applicable for new and existing customers (please refer to the default threshold limit set out in Question 7).

Please update us with your* latest mobile number or email address to ensure that you receive the notifications.

* in the case of sole proprietors, the person appointed at point of application/maintenance

This service is currently free.

The notifications are a safeguard against unauthorised and erroneous transactions. There is a default threshold limit set for certain types of transactions (refer to Question 7 above). Based on your payment patterns, you may wish to adjust your notification thresholds so that you receive notifications that are most relevant to you. For instance, you may wish to be notified only if the transaction is above a certain amount.

Your existing notification thresholds will continue to apply and you may visit the notification settings to change it anytime.

For Individuals:

You may choose to customise the alert settings via OCBC Online Banking. For those alerts with selection of threshold limit available (such as ATM/card transactions), you can change the alert threshold to your preferred setting.

For more enquiries, please call 1800 363 3333 or visit any of our OCBC branches.

For Sole Proprietors:

• For Corporate ATM Card, download Corporate ATM Services SMS Alert Update form
• For Business Debit Card, call 1800 363 3333
• For online banking settings call +65 6538 1111 or
• Visit any of our OCBC branches

To ensure you are kept informed of your account/transaction details, it is important for the bank to be updated with your current mobile phone number.

You may update your mobile phone number via the following methods:

For Individuals:

You may choose to customise the alert settings via the following methods:

• OCBC Online Banking or OCBC Mobile Banking app
• Any OCBC ATM or Kiosk
• Call 1800 363 3333 using your telephone PIN

For Sole Proprietors:

• For Corporate ATM Card, download Business Account Update form
• For Business Debit Card, download Change of Address/Contact Details form
• For online banking via https://velocity.ocbc.com
• Visit any of our OCBC branches

This could be an unauthorised transaction and you should inform the Bank immediately. Please provide the following information to us:

1. The bank account affected;
2. Your identification information;
3. The type of authentication device, access code/login credentials and device used to perform the payment transaction;
4. The name or identity of any account user;

5. Whether the account number, authentication device, or access code/login credentials was lost, stolen or misused and if so,

   • the date and time of the loss or misuse,
   • the date and time that the loss or misuse, was reported to you, and
   • the date, time and method that the loss or misuse, was reported to the police;
   • any access code/login credentials that is applicable to the account,
   • how the account holder or any account user recorded the access code/login credentials, and
   • whether the account holder or any account user had disclosed the access code/login credentials to anyone

We should complete an investigation of any relevant claim within 21 business days for straight forward cases, and up to 45 business days for complex cases.

For erroneous/unauthorised transactions on credit cards, charge cards or debit cards, the dispute resolution process established under the respective card scheme will apply.

You will not be liable for any loss that arises from any action or omission by us, if you have complied with your duties as an account holder. For losses due to any other independent third party other than you and us, subject to the below, you will also not be liable if the outgoing transaction value is within S$1,000.

You will, however, be liable if it is ascertained that the primary cause was recklessness on your part, such as failing to protect your access code/login credentials or access to your protected account. Your liability will be capped at the transaction limit or daily payment limit, where applicable.

In all cases, we will conduct an assessment to determine the appropriate liabilities and work towards a fair and reasonable resolution.

For transactions on credit cards, charge cards and debit cards issued in Singapore, the apportioning of liabilities is governed by the ABS Code of Consumer Banking Practice.

Please inform us as soon as possible. You may be facilitating criminal activities, such as money laundering and unlicensed money lending, if you knowingly receive money from strangers, dubious sources or other unverified sources. It is a criminal offence if your bank account is used to receive money linked to criminal activities or keeping erroneously sent funds.

Please contact us immediately to log your case. Reasonable efforts will be taken by us to recover the money sent, where possible. We and the receiving bank will facilitate communication between you and the recipient to help you recover the money that was sent wrongly.