OCBC OneToken is a digital token (also known as a software token) that can be used to authenticate and authorise transactions made via the OCBC Digital app or Internet Banking (e.g. logging in, change in personal details, funds transfers, payments), and online card payments. It is securely integrated into the OCBC Digital app on your mobile device.

Authorisation using OCBC OneToken is the second step required in a 2-Factor Authentication (2FA) process – the first being the entering of an Online Banking Access Code and PIN. By protecting your online banking accounts from unauthorised access, OCBC OneToken enhances the security of your online banking activities. You can use it in place of hardware tokens and SMS OTPs.

• Requests (e.g. logging in to OCBC Internet Banking, adding new payees, changing personal details).
• Funds transfers and payments made via the OCBC Digital app and Internet Banking.
• Card payments made on certain merchant e-commerce websites and apps.

Yes. If you are making a transaction via the OCBC Digital app, OCBC OneToken authorisation will take place works seamlessly in the background – even if the transaction is a high-risk one.

If you are making a transaction via OCBC Internet Banking, you can authorise it with a tap on your mobile phone.

You may still do so, depending on the type of transaction you make.

• Transactions made via the OCBC Digital app or Internet Banking: No. Once you have activated your OCBC OneToken on your mobile device, you will not be able to use your hardware token or SMS OTPs to authorise such transactions.
• Transactions made via Phone Banking or SMS Banking: SMS OTPs may still be used to authorise such transactions.
• Online card transactions: SMS OTPs may still be required by some online merchants.

If you are an iOCBC user, you can continue to use your hardware token to access your iOCBC account.

• Seamless banking experience anytime, anywhere: Never have to carry a hardware token around or worry about misplacing it. Use just your mobile device to authorise the transactions you make.
• Fuss-free activation: Activating OCBC OneToken only requires a few taps on the OCBC Digital app. With it, you do not need to wait for a hardware token to be mailed to you to start authorising online transactions.
• Enhanced security: OCBC OneToken is securely integrated into your OCBC Digital app. It is protected by your mobile device’s screen lock and the security measures that are built into the OCBC Digital app.
• Planet-friendly choice: Do your part for the environment. Hardware tokens need to be replaced every few years as their batteries die or newer versions are released. By using OCBC OneToken (a digital token), you will reduce e-waste and the carbon footprint involved in the manufacturing and shipping of hardware tokens.

Yes, OCBC OneToken is securely integrated into the OCBC Digital app on your mobile device. Security can be further enhanced by your device's screen lock (e.g. biometric or PIN).

Do so easily via the OCBC Digital app using your card PIN. Activation should only be carried out on the primary mobile device you use for banking. For detailed instructions, refer to our illustrated step-by-step guide or the FAQs below.

Alternatively, activate OCBC OneToken using SMS OTP and Token Key or a hardware token.

First, download the latest version of the OCBC Digital app and ensure that you have enabled push notifications.

Then, activate OneToken:

• Using SMS OTP and Card PIN (available only if you have an active ATM/debit/credit card and PIN):
  • Step 1: Log in to the OCBC Digital app.
  • Step 2: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate with SMS OTP and card PIN’. We will send a 6-digit SMS OTP to your mobile number in our records.
  • Step 4: Enter the SMS OTP in the app.
  • Step 5: Enter the 6-digit PIN for your selected card.
  • Step 6: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide or video.

• Using SMS OTP and Token Key:

  If you do not have an active ATM/debit/credit card, you may activate OCBC OneToken using a Token Key that we will mail to your address in our records.

  • Step 1: Log in to the OCBC Digital app.
  • Step 2: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate with SMS OTP and Token Key’. We will send a 6-digit SMS OTP to your mobile number in our records.
  • Step 4: Enter the 6-digit SMS OTP in the app.
  • Step 5: Tap on ‘Confirm’ to confirm the mailing address that the Token Key will be sent to.
  • Step 6: Your OCBC OneToken is now almost activated.
    
    • For now, you will be able to authorise low-risk transactions (e.g. bill payments, funds transfers to existing payees) using OCBC OneToken.
    • Before you can authorise high-risk transactions (e.g. adding payees, changing personal particulars and changing transaction limits), you will need to complete your activation using a 6-digit Token Key – this will be mailed to your address in our records within 7 working days (see step 7).
  • Step 7: Once you receive your 6-digit Token Key, log in to the OCBC Digital app.
  • Step 8: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken > Use Token Key to activate OCBC OneToken.
  • Step 9: Enter the 6-digit Token Key.
  • Step 10: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide.

• Using your hardware token:
  • Step 1: Log in to the OCBC Digital app.
  • Step 2: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken.
  • Step 3: Select ‘Activate with your hardware token’ and follow the instructions.
  • Step 4: Wait 12 hours – OCBC OneToken will be activated on your device after that.
    

    You can also refer to this illustrated step-by-step guide.

To activate OCBC OneToken, take these steps:

• Step 1: Log in to the OCBC Digital app.
• Step 2: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken > Activate OCBC OneToken, then follow the instructions.

It refers to the PIN that was issued with your credit card or which you chose for your ATM/debit card.

If you request to activate OCBC OneToken using SMS OTP and Token Key, we will mail the Token Key – a 6-digit, single-use code – to our address in our records. Once you use it to activate OCBC OneToken, you will be able to enable high-risk transactions such as:

• Adding of payees
• Transfers that exceed your authorised limit
• Changing funds transfer limits
• Changing mailing address
• Changing personal details (e.g. email address, mobile number)

Only one Token Key is valid at a time. If you requested multiple Token Keys on different dates, please use the latest Token Key generated to activate OCBC OneToken.

• Using the OCBC Digital app:
  • Step 1: Log in to the OCBC Digital app.
  • Step 2: Tap on the menu icon (top left corner of the screen) > Profile & Settings > Manage OCBC OneToken > Request Token Key. It will be mailed to your address in our records within 7 working days.
• Using OCBC Internet Banking
  • Step 1: Log in to OCBC Internet Banking
  • Step 2: Tap on ‘Confirm’ on the push notification sent to your mobile phone.
  • Step 3: Go to Customer service > Manage OCBC OneToken > Request Token Key. It will be mailed to your address in our records within 7 working days.

If you do not activate OCBC OneToken and also do not have a hardware token, you will not be able to perform high-risk transactions (e.g. adding payees, adding credit cards issued by other banks or changing transfer limits).

For your security, OCBC OneToken can only be activated on one mobile device at a time.

First, ensure that:

• You have downloaded the OCBC Digital app from an official app store (Google Play Store, Apple App Store or Huawei AppGallery) and are using the latest version.
• You have allowed push notifications to be sent via the OCBC Digital app (go to your device settings > OCBC Digital > Allow notifications to be sent via the app).
• You have given us your mobile number so that our SMS OTPs can reach you.

If the problem persists, please try the following:

• For Android users: Clear the OCBC Digital app’s data and cache, and uninstall it. Then, redownload the app and activate OCBC OneToken again.
• For iOS users: Uninstall the OCBC Digital app. Then, redownload the app and activate OCBC OneToken again.

To make your online transactions even more secure, we have introduced OCBC OneToken as a mode of authorisation. If you have activated OCBC OneToken, you will no longer need to wait for or memorise SMS OTPs. Instead, authorise your purchases quickly and securely in a few simple taps.

We will send you a push notification when you make an online purchase. Tap on it to be brought to the OCBC Digital app. Then, tap ‘Confirm’ to authorise the transaction.

Please ensure that you:

• Have installed the OCBC Digital app on your mobile device;
• Have activated OCBC OneToken;
• Are connected to the Internet;
• Are not on ‘do not disturb’ or driving mode; and
• Have enabled push notifications for the OCBC Digital app.

Go back to the screen where you were asked to authorise the transaction, then click on ‘Have us send a new notification’.

3D-Secure (or Three Domain Secure) is the payment industry’s internet authentication feature developed to safeguard your online transactions. 3D-Secure enables OCBC OneToken (and the digital tokens offered by other banks) to be used to authorise payments to online merchants. You will only be asked to provide additional authorisation for merchants that have been enrolled for 3D-Secure.

First, ensure that:

• You have downloaded the OCBC Digital app from an official app store (Google Play Store, Apple App Store or Huawei AppGallery) and are using the latest version.
• You have allowed push notifications to be sent via the OCBC Digital app (go to your device settings > OCBC Digital > Allow notifications to be sent via the app).
• You have given us your mobile number so that our SMS OTPs can reach you.

If the problem persists, please try the following:

• For Android users: Clear the OCBC Digital app’s data and cache, and uninstall it. Then, redownload the app and activate OCBC OneToken again.
• For iOS users: Uninstall the OCBC Digital app. Then, redownload the app and activate OCBC OneToken again.

To use OCBC OneToken, your mobile device must comply with our security policy. If the steps shown above do not work, your device may not meet our security requirements (e.g. it is jailbroken or using a ‘fake GPS’, ‘library tampering’ has been detected, or remote access has been enabled). 

Please uninstall any apps downloaded from unknown sources before restarting your phone, clearing the OCBC Digital app’s cache and redownloading the app, if necessary. Still facing issues? Call us at +65 6363 3333 so we may assist you.

• Transactions made via the OCBC Digital app: No. Your mobile device must be connected to the Internet for transactions to be authenticated/authorised in the background.
• Transactions made via Internet Banking: It depends on the type of transaction you are authenticating/authorising.
  • To authenticate log in requests, your mobile device must be connected to the Internet. Only then will we be able to send you an authentication prompt via push notification.
  • To authorise other transactions, such as changing your personal details, your mobile device must be connected to the Internet to receive an authorisation prompt via push notification. However, you can choose to generate an OTP offline using OCBC OneToken via the OCBC Digital app instead*. Here are the steps:

    • Step 1: Submit your request (e.g. change to personal details).

    • Step 2: An authorisation prompt will be shown on the screen. Click on ‘Alternatively, you may generate an OTP manually on your mobile device’.

    • Step 3: Launch the OCBC Digital app on your mobile device.

    • Step 4: Tap on ‘More’ > ‘OneToken’ > ‘One Time Password’ to generate a OTP (for low-risk transactions), or ‘Transaction Code’ (for high-risk transactions).

    • Step 5: Enter the 6-digit OTP in the web browser to authorise the transaction

    *This option will be phased out by 2025.

• Online card transactions: No. Your mobile device must be connected to the Internet. Only then will we be able to send you an authorisation prompt via push notification. 

  Do note that even if OCBC OneToken is activated, certain merchants may still require you to authorise your purchases using SMS OTP.

I did not receive a push notification to authorise my transaction. Why?
First, please ensure your mobile device is connected to the Internet. Do also check that you have allowed push notifications for the OCBC Digital app and that you have enabled push notifications via the app. 

To allow push notifications to be sent via the app

• For iOS devices:
  • Step 1: Access Settings > Select Notifications
  • Step 2: Select ‘OCBC Digital app’ > Turn on Notifications
• For Android devices:
  • Step 1: Access Settings > Select Apps & Notifications
  • Step 2: Select Notifications > Select App Notifications
  • Step 3: Select OCBC Digital app > Turn on Notifications

To enable push notifications

• Step 1: Launch the OCBC Digital app

• Step 2: Tap on the bell icon (at top right)

• Step 3: Tap on the gear icon (at top right) to view Settings

• Step 4: Toggle on ‘Receive reminders and alerts’

  For details, refer to our FAQs.

Next, please note that you will not receive push notifications for transactions made via the OCBC Digital app as they are authorised in the background. 

If you do not receive a push notification for your OCBC Internet Banking or online card transaction, you can take these steps to authorise your transaction:

• Step 1: Submit your transaction request

• Step 2: An authorisation prompt will be shown on the screen

• Step 3: Launch the OCBC Digital app on your mobile device > Tap on ‘More’ > ‘OneToken’. A prompt titled ‘Authorise Transaction’ or ‘Authorise login’ should appear*

• Step 4: Tap ‘Confirm’ to authorise your transaction

• Step 5: Return to your browser

  *If you do not see it, please return to your browser to request a new push notification.

• Step 1: Submit your transaction request

• Step 2: An authorisation prompt will be shown on the screen

• Step 3: Launch the OCBC Digital app on your mobile device > Tap on ‘More’ > ‘OneToken’. A prompt titled ‘Authorise Transaction’ or ‘Authorise login’ should appear*

• Step 4: Tap ‘Confirm’ to authorise your transaction

• Step 5: Return to your browser

  *If you do not see it, please return to your browser to request a new push notification.

Alternatively, for certain OCBC Internet Banking transactions, you can choose to generate an OTP offline, using OCBC OneToken via the OCBC Digital app instead*. Here are the steps:

• Step 1: Submit your request (e.g. change to personal details).

• Step 2: An authorisation prompt will be shown on the screen. Click on ‘Alternatively, you may generate an OTP manually on your mobile device’.

• Step 3: Launch the OCBC Digital app on your mobile device.

• Step 4: Tap on ‘More’ > ‘OneToken’ > ‘One Time Password’ to generate a OTP (for low-risk transactions), or ‘Transaction Code’ (for high-risk transactions).

• Step 5: Enter the 6-digit OTP in the web browser to authorise the transaction.

  *This option will be phased out by 2025.

OCBC OneToken can only be used for the OCBC Digital app and Internet Banking. You will still need to use the hardware token to access the iOCBC website.

To safeguard your accounts and data, you will not be able to use the OCBC Digital app on a device that does not comply with our security policies. For example, you will not be able to use the app on devices that:

• Have been rooted or jailbroken;

• Have Remote Administration Tools installed;

• Have runtime or libraries that have been tampered with; or

• Contain apps that have been installed from unknown sources.

• Seamless banking experience anytime, anywhere: Never have to carry a hardware token around or worry about misplacing it. Use just your mobile device to authorise the transactions you make.
• Fuss-free activation: Activating OCBC OneToken only requires a few taps on the OCBC Digital app. With it, you do not need to wait for a hardware token to be mailed to you to start authorising online transactions.
• Enhanced security: OCBC OneToken is securely integrated into your OCBC Digital app. It is protected by your mobile device’s screen lock and the security measures that are built into the OCBC Digital app.
• Planet-friendly choice: Do your part for the environment. Hardware tokens need to be replaced every few years as their batteries die or newer versions are released. By using a digital token, you will reduce e-waste and the carbon footprint involved in the manufacturing and shipping of hardware tokens.

First, you should activate OCBC OneToken on your primary mobile device. We recommend that you do so using SMS OTP and Card PIN; you may refer to this step-by-step guide or our FAQs for instructions.

Alternatively, use SMS OTP and Token Key or your existing hardware token.

Once you have activated OCBC OneToken, please dispose of your old hardware token responsibly. You can recycle it at an e-waste collection point.

You may still do so, depending on the type of transaction you make.

• Transactions made via the OCBC Digital app or Internet Banking: No. Once you have activated your OCBC OneToken on your mobile device, you will not be able to use your hardware token or SMS OTPs to authorise such transactions.
• Transactions made via Phone Banking or SMS Banking: SMS OTPs may still be used to authorise such transactions.
• Online card transactions: SMS OTPs may still be required by some online merchants.

If you are an iOCBC user, you can continue to use your hardware token to access your iOCBC account.

Yes. However, we recommend switching to OCBC OneToken instead – OCBC OneToken can be activated without a hardware token. For details, you may refer to this step-by-step guide, our YouTube video on how to activate OCBC OneToken using SMS OTP + Card Pin or our FAQs.