OCBC OneToken is a digital token (also known as a software token) that can be used to authenticate and authorise transactions made via the OCBC app or OCBC Internet Banking (e.g. logging in, change in personal details, funds transfers, payments), and online card payments. It is securely integrated into the OCBC app on your mobile device.

Authorisation using OCBC OneToken is the second step required in a 2-Factor Authentication (2FA) process – the first being the entering of an OCBC Internet Banking Access Code and PIN. By protecting your internet banking accounts from unauthorised access, OCBC OneToken enhances the security of your internet banking activities. You can use it in place of hardware tokens and SMS OTPs.

• Requests (e.g. logging in to OCBC Internet Banking, adding new payees, changing personal details).
• Funds transfers and payments made via the OCBC app and OCBC Internet Banking
• Card payments made on certain merchant e-commerce websites and apps.

Yes. If you are making a transaction via the OCBC app, OCBC OneToken authorisation will take place seamlessly in the background – even if the transaction is a high-risk one.

If you are making a transaction via OCBC Internet Banking, you can authorise it with a tap on your mobile phone.

You may still do so, depending on the type of transaction you make.

• Transactions made via the OCBC app or OCBC Internet Banking
  No. Once you have activated your OCBC OneToken on your mobile device, you will not be able to use your hardware token or SMS OTPs to authorise such transactions.
• Transactions made via Phone Banking or SMS Banking
  SMS OTPs may still be used to authorise such transactions.
• Online card transactions
  SMS OTPs may still be required by some online merchants.

If you are an iOCBC user, you can continue to use your hardware token to access your iOCBC account.

• Seamless banking experience anytime, anywhere: You will never have to carry a hardware token around or worry about misplacing it. Just use your mobile device to authorise the transactions you make.
• Fuss-free activation: Activating OCBC OneToken only requires a few taps on the OCBC app. With it, you do not need to wait for a hardware token to be mailed to you to start authorising online transactions.
• Enhanced security: OCBC OneToken is securely integrated into your OCBC app. It is protected by your mobile device’s screen lock and the security measures that are built into the OCBC app.
• Planet-friendly choice: Do your part for the environment. Hardware tokens need to be replaced every few years as their batteries die or newer versions are released. By using OCBC OneToken (a digital token), you will reduce e-waste and the carbon footprint involved in the manufacturing and shipping of hardware tokens.

Yes, OCBC OneToken is securely integrated into the OCBC app on your mobile device. Security can be further enhanced by your device's screen lock (e.g. biometric or PIN).

You can do so easily via the OCBC app using your card PIN. Activation should only be carried out on the primary mobile device you use for banking. For detailed instructions, refer to our illustrated step-by-step guide or the FAQs below.

Alternatively, activate OCBC OneToken using SMS OTP and a Token Key or a hardware token.

First, download the latest version of the OCBC app and ensure that you have enabled push notifications.

Then, activate OCBC OneToken:

• Using SMS OTP and Email OTP
  • Step 1: Log in to the OCBC app.
  • Step 2: Tap on the “More” icon in the bottom navigation bar > Profile & app settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate OCBC OneToken’. We will send a 6-digit SMS OTP to your mobile number in our records.
  • Step 4: Enter the SMS OTP in the app.
  • Step 5: We will send a 6-digit Email OTP to your email address in our records.
  • Step 6: Enter the Email OTP in the app.
  • Step 7: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide or video.

• Using SMS OTP and Token Key:

  If you do not have an active ATM/debit/credit card, you may activate OCBC OneToken using a Token Key that we will mail to your address in our records.

  • Step 1: Log in to the OCBC app.
  • Step 2: Tap on the “More” icon in the bottom navigation bar > Profile & app settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate with SMS OTP and Token Key’. We will send a 6-digit SMS OTP to your mobile number in our records.
  • Step 4: Enter the 6-digit SMS OTP in the app.
  • Step 5: Tap on ‘Confirm’ to confirm the mailing address that the Token Key will be sent to.
  • Step 6: Your OCBC OneToken is now almost activated.
    
    • For now, you will be able to authorise low-risk transactions (e.g. bill payments, funds transfers to existing payees) using OCBC OneToken.
    • Before you can authorise high-risk transactions (e.g. adding payees, changing personal particulars and changing transaction limits), you will need to complete your activation using a 6-digit Token Key – this will be mailed to your address in our records within 7 working days (see step 7).
  • Step 7: Once you receive your 6-digit Token Key, log in to the OCBC app.
  • Step 8: Tap on the ‘More’ icon in the bottom navigation bar > Profile & app settings > Manage OCBC OneToken > Use Token Key to activate OCBC OneToken.
  • Step 9: Enter the 6-digit Token Key.
  • Step 10: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide.

• Using your hardware token:
  • Step 1: Log in to the OCBC app.
  • Step 2: Tap on the ‘More’ icon in the bottom navigation bar > Profile & app settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate OCBC OneToken’ and follow the instructions.
  • Step 4: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide.

To activate OCBC OneToken, take these steps:

• Step 1: Log in to the OCBC app.
• Step 2: Tap on the ‘More’ icon in the bottom navigation bar > Profile & app settings’ > Manage OCBC OneToken > Activate OCBC OneToken, then follow the instructions.

It refers to the PIN that was issued with your credit card or which you chose for your ATM/debit card.

If you request to activate OCBC OneToken using SMS OTP and Token Key, we will mail the Token Key – a 6-digit, single-use code – to our address in our records. Once you use it to activate OCBC OneToken, you will be able to enable high-risk transactions such as:

• Adding of payees
• Transfers that exceed your authorised limit
• Changing funds transfer limits
• Changing mailing address
• Changing personal details (e.g. email address, mobile number)

Only one Token Key is valid at a time. If you requested multiple Token Keys on different dates, please use the latest Token Key generated to activate OCBC OneToken.

• Via the OCBC app:
  • Step 1: Log in to the OCBC app.
  • Step 2: Tap on the ‘More’ icon in the bottom navigation bar > Profile & app settings > Manage OCBC OneToken > Request Token Key. It will be mailed to your address in our records within 7 working days.
• Via OCBC Internet Banking
  • Step 1: Log in to OCBC Internet Banking
  • Step 2: Tap ‘Confirm’ on the push notification sent to your mobile phone.
  • Step 3: Go to ‘Customer service’ > Manage OCBC OneToken > Request Token Key. It will be mailed to your address in our records within 7 working days.

If you do not activate OCBC OneToken and also do not have a hardware token, you will not be able to perform high-risk transactions (e.g. adding payees, adding credit cards issued by other banks or changing transfer limits).

For your security, OCBC OneToken can only be activated on one mobile device at a time.

First, ensure that:

• You have downloaded the OCBC app from an official app store (Google Play Store, Apple App Store or Huawei AppGallery) and are using the latest version.
• You have allowed push notifications to be sent via the OCBC app (go to your device settings > OCBC app > Allow notifications to be sent via the app).
• You have given us your mobile number so that our SMS OTPs can reach you.

If the problem persists, please try the following:

• For Android users: Clear the OCBC app’s data and cache, and uninstall it. Then, redownload the app and activate OCBC OneToken again.
• For iOS users: Uninstall the OCBC app. Then, redownload the app and activate OCBC OneToken again.

Singpass Face Verification is a method of verifying your identity using a face scan compared against the government's records. It is used to complement existing authentication methods for digital token set up in higher risk or unusual scenarios to better protect users.

If you are unable to successfully complete the facial verification after 5 attempts, we recommend that you wait for 30 minutes before trying again.

Individuals who no longer resemble their NRIC or passport photograph can apply for a replacement of their NRIC or passport with the Immigration & Checkpoints Authority (ICA). This ensures that the Government’s biometric database of facial images remains up to date.

There may be several possible reasons for this. For ways to improve the success of Face Verification, you should ensure that:

• Your face is not covered
• You keep still while scanning is in progress
• There is no strong lighting in the background
• Your environment is not too dark
• You use a minimum resolution of 2 megapixels for the camera
• Your NRIC / passport photo image is up to date

For banks enrolled in the use of Singpass Face Verification, you may be required to perform the authentication for higher risk or unusual scenarios as an additional means to guard against unauthorised set up of your digital token.

Banks do not collect or store the biometric data during the use of Singpass Face Verification.
Your facial data is collected by Singpass and used for purposes such as authenticating your identity.

Unless prohibited by law, facial data may be:

• captured by relying parties approved by Singpass to use Singpass Face Verification;
• shared with Singpass’s service providers in connection with the provision of Singpass Face Verification to you; or
• shared with government agencies to serve you in the most efficient and effective way or for the discharge of public functions.

Facial data is retained to analyse and improve Singpass Face Verification. This data retained is encrypted when stored and protected with tamper-evident logging. Data that is no longer required is deleted, unless there is a legal requirement to retain such data.

For more information on Singpass Face Verification, please visit: https://ask.gov.sg/singpass.

There are stringent security measures in place to protect users’ personal information. For example, facial data that is retained is encrypted when stored and protected with tamper-evident logging.

For more information on Singpass Face Verification, please visit: https://ask.gov.sg/singpass. If you need further assistance regarding your Singpass account, please get in touch with us at: https://go.gov.sg/singpass-feedback-issue.

As part of the latest industry move to strengthen the resilience against phishing scams, banks in Singapore have introduced Singpass Face Verification as part of the digital token set up. This additional layer of authentication will be prompted if there are unusual or suspicious activities detected during the OCBC OneToken activation process, which makes it more difficult for scammers to gain access to your accounts.

To use Singpass Face Verification, ensure that:

• You have a Singpass account, and have installed and set up the Singpass app on your device; and
• The camera on your device works.

If you no longer resemble your NRIC/passport photograph, please apply for a replacement identity card/passport with the Singapore Immigration & Checkpoints Authority (ICA). This will ensure that the Government’s record of your face remains up-to-date.

You might be asked to use Singpass Face Verification if you used SMS OTP and email OTP to activate OneToken, and a higher-risk scenario was detected.

In that case, please take these steps:

• Step 1: Log in to the OCBC app.
• Step 2: Tap the ‘More’ icon (at bottom right of screen) and scroll down to ‘Services’. Tap ‘Profile & app settings’ > ‘Manage OCBC OneToken’.
• Step 3: Tap ‘Activate OCBC OneToken now’. We will send a 6-digit SMS OTP to your mobile number and a different 6-digit email OTP to your email address in our records.
• Step 4: Enter the SMS OTP and email OTP in the app when prompted.
• Step 5: You will see ‘Activate using Singpass with Face Verification’ on the screen. Tap ‘Authenticate with Singpass’.
• Step 6: Tap ‘Continue’. This step will take you out of the OCBC app to the Singpass app – it is not suitable for people who are sensitive to flashing lights. Please refer to Qn 7 if you need an alternative.
• Step 7: Tap the Singpass QR code.
• Step 8: Log in to Singpass*.
• Step 9: Follow the instructions on screen. Grant the Singpass app access to your device's camera function if you have not.
• Step 10: Once Singpass has verified your identity, wait 12 hours – OCBC OneToken will be activated on your device after that.

You may refer to this illustrated step-by-step guide.

* You must have a Singpass account, and have installed and set up the Singpass app on your device.

If the error you encountered is caused by five unsuccessful verification attempts, please wait a short period before trying again.

Alternatively, bring your OCBC ATM/debit/credit card to any OCBC ATMs and follow these instructions:

• Step 1: Insert your card and enter your PIN.
• Step 2: Tap ‘More services’ > Tap the arrow shown on the right hand side of the screen > ‘Verification for OneToken activation’.
• Step 3: Log in the OCBC app – within 24 hours of your making the verification request – to complete OCBC OneToken activation.

You may refer to the ATM section in this illustrated step-by-step guide.

Live overseas? Please call us at +65 6363 3333. For your security, we will need to verify your identity over the phone before we can assist you.

You can go to an ATM to request verification for OCBC OneToken activation again. You will not need to go through Singpass Face Verification if you do so.

Otherwise, follow these steps to activate your OCBC OneToken. You will be asked to go through Singpass Face Verification.

You may have tried to activate OCBC OneToken after 24 hours of your requesting verification for OCBC OneToken activation.

To activate OCBC OneToken without using Singpass Face Verification, go to an ATM to request verification for OCBC OneToken activation again.

From November 2024, all Singapore ATMs will have this service. However, it will not be available at UOB ATMs under the Shared ATM network or at overseas OCBC ATMs.

If your ‘Verification for OneToken activation’ request is successful, we will send you an email, and push notification and/or SMS, to your contact details in our records.

No, only ATMs in Singapore can be used. If you live overseas, please call us at +65 6363 3333.

This could be due to the following reason(s):

1. You have not tried to activate OCBC OneToken via the OCBC app;
2. You have already activated OCBC OneToken on your device; or
3. You are not required to use Singpass Face Verification when activating OCBC OneToken on your device.

To make your online transactions even more secure, we have introduced OCBC OneToken as a mode of authorisation. If you have activated OCBC OneToken, you will no longer need to wait for or memorise SMS OTPs. Instead, authorise your purchases quickly and securely in a few simple taps.

We will send you a push notification when you make an online purchase. Tap on it to be brought to the OCBC app. Then, tap ‘Confirm’ to authorise the transaction.

Please ensure that you:

• Have installed the OCBC app on your mobile device;
• Have activated OCBC OneToken;
• Are connected to the Internet;
• Are not on ‘do not disturb’ or driving mode; and
• Have enabled push notifications for the OCBC app.

Go back to the screen where you were asked to authorise the transaction, then click on ‘Have us send a new notification’.

3D-Secure (or Three Domain Secure) is the payment industry’s internet authentication feature developed to safeguard your online transactions. 3D-Secure enables OCBC OneToken (and the digital tokens offered by other banks) to be used to authorise payments to online merchants. You will only be asked to provide additional authorisation for merchants that have been enrolled for 3D-Secure.

First, ensure that:

• You have downloaded the OCBC app from an official app store (Google Play Store, Apple App Store or Huawei AppGallery) and are using the latest version.
• You have allowed push notifications to be sent via the OCBC app (go to your device settings > OCBC app > Allow notifications to be sent via the app).
• You have given us your mobile number so that our SMS OTPs can reach you.

If the problem persists, please try the following:

• For Android users: Clear the OCBC app’s data and cache, and uninstall it. Then, redownload the app and activate OCBC OneToken again.
• For iOS users: Uninstall the OCBC app. Then, redownload the app and activate OCBC OneToken again.

To use OCBC OneToken, your mobile device must comply with our security policy. If the steps shown above do not work, your device may not meet our security requirements (e.g. it is jailbroken or using a ‘fake GPS’, ‘library tampering’ has been detected or remote access has been enabled).

Please uninstall any apps downloaded from unknown sources before restarting your phone, clearing the OCBC app’s cache and redownloading the app, if necessary. Still facing issues? Call us at +65 6363 3333 so we may assist you.

• Transactions made via the OCBC app: No. Your mobile device must be connected to the internet for transactions to be authenticated/authorised in the background.
• Transactions made via OCBC Internet Banking: It depends on the type of transaction you are authenticating/authorising.
  • To authenticate log in requests, your mobile device must be connected to the internet. Only then will we be able to send you an authentication prompt via push notification.
  • To authorise other transactions, such as changing your personal details, your mobile device must be connected to the internet to receive an authorisation prompt via push notification. However, you can choose to generate an OTP offline using OCBC OneToken via the OCBC app instead*. Here are the steps:

    • Step 1: Submit your request (e.g. changing personal details).

    • Step 2: An authorisation prompt will be shown on the screen. Click on ‘Alternatively, you may generate an OTP manually on your mobile device’.

    • Step 3: Launch the OCBC app on your mobile device.

    • Step 4: Tap ‘More’ (bottom right-hand corner of the screen) > ‘OneToken’ > ‘One Time Password’ to generate an OTP (for low-risk transactions), or ‘Transaction Code’ (for high-risk transactions).

    • Step 5: Enter the 6-digit OTP in the browser to authorise the transaction.

    *This option will be phased out by 2025.
    ** ‘More’ can be found prior to log in to OCBC app

• Online card transactions: No. Your mobile device must be connected to the Internet. Only then will we be able to send you an authorisation prompt via push notification. Do note that even if OCBC OneToken is activated, certain merchants may still require you to authorise your purchases using SMS OTP.

First, please ensure your mobile device is connected to the internet. First, please ensure your mobile device is connected to the Internet. Do also check that you have allowed push notifications for the OCBC app and that you have enabled push notifications via the app.

To allow push notifications to be sent via the app

• For iOS devices:
  • Step 1: Access Settings > Select Notifications
  • Step 2: Select ‘OCBC app’ > Turn on Notifications
• For Android devices:
  • Step 1: Access Settings > Select Apps & Notifications
  • Step 2: Select Notifications > Select App Notifications
  • Step 3: Select OCBC app > Turn on Notifications

To enable push notifications

• Step 1: Launch the OCBC app

• Step 2: Tap on the bell icon (at top right)

• Step 3: Tap on the gear icon (at top right) to view Settings

• Step 4: Toggle on ‘Push notifications’

  For details, refer to our FAQs.

Next, please note that you will not receive push notifications for transactions made via the OCBC app as they are authorised in the background.

If you do not receive a push notification for your OCBC Internet Banking or online card transaction, you can take these steps to authorise your transaction:

• Step 1: Submit your transaction request

• Step 2: An authorisation prompt will be shown on the screen

• Step 3: Launch the OCBC app on your mobile device > Tap on ‘More’ > ‘OneToken’. A prompt titled ‘Authorise Transaction’ or ‘Authorise login’ should appear*

• Step 4: Tap ‘Confirm’ to authorise your transaction

• Step 5: Return to your browser

  *If you still do not receive a push notification, please return to your browser to request a new one.
  ** ‘More’ can be found prior to log in to OCBC app

You can take these steps to authorise OCBC Internet Banking and online card transactions:

• Step 1: Submit your transaction request

• Step 2: An authorisation prompt will be shown on the screen

• Step 3: Launch the OCBC app on your mobile device > Tap on ‘More’ > ‘OneToken’. A prompt titled ‘Authorise Transaction’ or ‘Authorise login’ should appear*

• Step 4: Tap ‘Confirm’ to authorise your transaction

• Step 5: Return to your browser

  *If you still do not receive a push notification, please return to your browser to request a new one.
  ** ‘More’ can be found prior to log in to OCBC app

Alternatively, for certain OCBC Internet Banking transactions, you can choose to generate an OTP offline, using OCBC OneToken via the OCBC app instead*. Here are the steps:

• Step 1: Submit your request (e.g. changing personal details).

• Step 2: An authorisation prompt will be shown on the screen. Click on ‘Alternatively, you may generate an OTP manually on your mobile device’.

• Step 3: Launch the OCBC app on your mobile device.

• Step 4: Tap on ‘More’ > ‘OneToken’ > ‘One Time Password’ to generate a OTP (for low-risk transactions), or ‘Transaction Code’ (for high-risk transactions).

• Step 5: Enter the 6-digit OTP in the web browser to authorise the transaction.

  *This option will be phased out by 2025.
  ** More can be found prior to log in to OCBC app.

OCBC OneToken can only be used for the OCBC app and OCBC Internet Banking. You will still need to use the hardware token to access the iOCBC website.

To safeguard your accounts and data, you will not be able to use the OCBC app on a device that does not comply with our security policies. For example, you will not be able to use the app on devices that:

• Have been rooted or jailbroken;

• Have Remote Administration Tools installed;

• Have runtime or libraries that have been tampered with; or

• Contain apps that have been installed from unknown sources.

• Seamless banking experience anytime, anywhere: Never have to carry a hardware token around or worry about misplacing it. Use just your mobile device to authorise the transactions you make.
• Fuss-free activation: Activating OCBC OneToken only requires a few taps on the OCBC app. With it, you do not need to wait for a hardware token to be mailed to you to start authorising online transactions.
• Enhanced security: OCBC OneToken is securely integrated into the OCBC app. This means that it is protected by your mobile device’s screen lock feature and the security features built into the OCBC app.
• Planet-friendly choice: Do your part for the environment. Hardware tokens need to be replaced every few years as their batteries die or newer versions are released. By using a digital token, you will reduce e-waste and the carbon footprint involved in the manufacturing and shipping of hardware tokens.

First, you should activate OCBC OneToken on your primary mobile device. We recommend that you do so using SMS OTP and email OTP; you may refer to this step-by-step guide or our FAQs for instructions.

Alternatively, use SMS OTP and Token Key or your existing hardware token.

Once you have activated OCBC OneToken, please dispose of your old hardware token responsibly. You can recycle it at an e-waste collection point.

You may still do so, depending on the type of transaction you make.

• Transactions made via the OCBC app or OCBC Internet Banking: No. Once you have activated your OCBC OneToken on your mobile device, you will not be able to use your hardware token or SMS OTPs to authorise such transactions.
• Transactions made via Phone Banking or SMS Banking: SMS OTPs may still be used to authorise such transactions.
• Online card transactions: SMS OTPs may still be required by some online merchants.

If you are an iOCBC user, you can continue to use your hardware token to access your iOCBC account.

Yes. However, we recommend switching to OCBC OneToken instead – OCBC OneToken can be activated without a hardware token. For details, you may refer to this step-by-step guide, our YouTube video on how to activate OCBC OneToken using SMS OTP + Card Pin or our FAQs.