Singapore Shared Responsibility Framework Guide: Bank and Telco Duties for Phishing Losses

When a customer is phished and their account is drained, someone has to decide who pays, and Singapore's Shared Responsibility Framework (SRF) answers that question with a fixed set of duties and a strict order of liability. The SRF was set out by the Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority (IMDA) in the MAS Guidelines on Shared Responsibility Framework, issued on 24 October 2024 and effective from 16 December 2024. It makes banks and major payment institutions answer first for phishing losses when they miss a prescribed control, puts mobile network operators second in line for SMS-borne phishing, and leaves the loss with the account holder only when both have done their part. This guide explains who is covered, each duty, the "waterfall", the claims workflow and what compliance teams should build. It is for fraud, compliance and security leads in Singapore institutions and for anyone in another market studying the SRF as a model for scam liability.

Key takeaways

• It covers phishing, not every scam. The SRF applies to "seemingly authorised transactions": a scammer impersonates a legitimate business or government body over a digital messaging platform, the victim enters credentials on a fake site, and those credentials are used for payments the victim did not intend.
• Banks pay first if they miss a duty. A responsible financial institution (FI) that breaches any of five duties, from the 12-hour cooling-off period to real-time fraud surveillance, bears the loss, even if the telco also failed.
• Telcos pay second, and only for SMS. A responsible telco bears the loss only where the FI met all its duties, the telco breached one of its three SMS duties, and the scam came in by SMS.
• Clocks matter on both sides. Account holders should report within 30 calendar days of the FI's alert and send supporting documents within 3 calendar days; investigations run to 21 business days, or 45 for complex cases.
• Malware and authorised scams are out. MAS and IMDA excluded malware-enabled scams and scams where victims knowingly authorise payment, such as investment, job and love scams, so those losses follow other rules.

Scope: who and what is covered

The Guidelines bind two kinds of organisation. A responsible FI is a bank, or a relevant payment service provider, that issued the protected account; the MAS page lists full banks (locally incorporated and branches) and major payment institutions as the institutions it applies to. A responsible telco is a Singapore mobile network operator that owns or controls cellular network infrastructure and holds radio spectrum rights.

Protected accounts

The SRF reuses the "protected account" concept from the MAS E-Payments User Protection Guidelines (EUPG). Under the SRF definitions, a protected account must be held by individuals only, be capable of holding a balance above S$1,000 or be a credit facility, and be usable for electronic payments; e-wallets issued by payment service providers count where they store specified e-money. Singapore-issued credit, charge and debit cards are excluded, as are accounts opened with business units or used for business transactions.

The four limbs of a seemingly authorised transaction

All four limbs must be met. A victim who was talked into sending money themselves (an authorised push payment) or whose phone was taken over by malware is outside the framework, although the FI's ordinary EUPG unauthorised-transaction process still applies to claims that do not qualify. For the wider picture of authorised scams, see the Authorised Push Payment (APP) Fraud Guide.

The SMS definition

For telco liability, "SMS" excludes messages sent over social media and over-the-top apps such as WhatsApp, iMessage and RCS. A phishing lure delivered by WhatsApp can still qualify the loss for FI liability (limb (b) covers any digital messaging platform), but it can never move the loss to the telco.

Key obligations

Responsible FI duties

FIs must meet all EUPG duties. Five specific duties in paragraph 4.2 are the ones assessed when losses are allocated:

"High-risk activities" are defined as adding payees, increasing outgoing transaction limits, disabling transaction notifications and changing contact details (mobile number, email or mailing address). The rapid-drain trigger in footnote 8 is a balance of S$50,000 or more immediately before the transaction, with more than 50% transferred out within the last 24 hours; recurring instructions, GIRO deductions, certain bill payments, debit card transactions and intrabank transfers are excluded from the calculation. Duties continue during scheduled downtime, which should avoid high-volume periods.

Responsible telco duties

Telco duties come from IMDA Directions issued under section 31 of the Telecommunications Act 1999, and the Guidelines state that the Directions prevail if there is a conflict:

• Sender ID registry (5.2.1): deliver Sender ID SMS (alphanumeric sender names such as a bank's name) only if sent from authorised aggregators licensed by IMDA and listed in the SMS Sender ID Registry.
• Blocking (5.2.2): block Sender ID SMS from any other source.
• Anti-scam filter (5.2.3): scan all SMS on the network, including Sender ID SMS and messages from local or overseas numbers, for URLs that match known malicious URLs in a designated database.

For how operators implement sender ID protection and SMS filtering in general, see the Scam Prevention in Telecoms Guide.

Account user duties

Consumers keep the EUPG duties: practise good cyber hygiene, never give credentials to anyone, take FI contact details only from official sources such as the MAS Financial Institutions Directory or the back of a card, and do not click links in SMS or email unless they are informational links the user expects. MAS and IMDA were explicit that if both FI and telco have met their duties, no payout is required.

The liability waterfall

Two refinements matter. Where the mobile subscriber differs from the account holder, the telco can still be liable if that number is the one designated to receive the account's notifications and it received the phishing SMS (6.6). For joint accounts, responsibility applies jointly to each holder (6.9). MAS and IMDA put FIs first because they are the custodians of consumers' money.

Timeline and current status

As checked on the MAS guidelines page on 8 November 2026, the October 2024 Guidelines remain the published version. Singapore has continued to legislate on scams more broadly, so check the MAS and IMDA sites for amendments before relying on the detail above, particularly on scope, which MAS said would exclude malware-enabled scams while mitigations were still developing.

Enforcement and penalties

The SRF does not create fines. Its teeth are financial and procedural: an FI that cannot show it met each paragraph 4.2 duty for the transaction in question carries the full loss, and a telco that cannot show it met its IMDA-directed SMS duties carries it where the scam came by SMS. The telco duties themselves rest on IMDA Directions under the Telecommunications Act 1999, so they are enforced through IMDA's telecoms regime as well as through loss allocation.

• Crediting: charges on disputed transactions are withheld or waived under EUPG section 8; the FI credits the account with the loss it owes, and the telco credits the account holder with the verified loss using an agreed payment method.
• Disputes with the FI: go to the Financial Industry Disputes Resolution Centre (FIDReC), including where the FI says the claim is out of scope.
• Disputes with the telco: go to IMDA.
• Independence: investigations must be carried out by staff independent of the business units concerned.

Claims workflow

1. Claim: the FI is the first point of contact. The account holder reports as soon as practicable and no later than 30 calendar days after the FI sends the notification alert (late reports may need reasons), and provides a valid email address and supporting information, such as a police report and the message trail, within 3 calendar days.
2. Records: the FI may ask for communication records, the telco's name, the mobile number and SMS details (sender, date, time, screenshot) showing impersonation, intent to obtain credentials and direction to a fake site. On request, the FI gives the holder transaction dates, timestamps and counterparties.
3. Investigation: if the scam came by SMS, the FI informs the telco and both investigate concurrently; otherwise only the FI investigates. Claims that are not seemingly authorised transactions go through the FI's standard unauthorised-transaction process.
4. Outcome: within 21 business days for straightforward cases, or 45 for complex ones such as an overseas, uncontactable party, the FI sends each holder a written outcome and responsibility assessment and seeks acknowledgement.
5. Recourse: FIDReC for FI disputes, IMDA for telco disputes.

What it means for AI agents and non-human identities

The SRF is about consumer credentials, but its duties are identity controls, and several touch machine identities directly:

• Device binding is the target. The 12-hour cooling-off exists because phishing kits now aim to bind the victim's digital token to an attacker device. The token, the device key and the session it creates are credentials in their own right; treat token activation as a high-risk identity event in your logs. See the Account Takeover Prevention Guide.
• Automated surveillance must be explainable. Paragraph 4.2.5 is usually met by a fraud engine making real-time block or hold decisions. If an AI model makes that call, the FI must still prove, claim by claim, that the duty was performed, so log model version, inputs and decision for each held transaction.
• Agents acting on a customer's behalf. A customer who lets an AI agent or aggregator act with their credentials muddies limbs (c) and (d). FIs should decide now how agent-initiated payments and delegated tokens are authenticated and logged, rather than during a disputed claim. See the Agent Payments Protocols Guide.
• Telco systems are machine identities too. Sender ID registry access depends on aggregator accounts and API credentials; a compromised aggregator credential defeats duty 5.2.1. Manage those keys as privileged secrets.

Compliance steps

1. Map scope: list every product that is a protected account (individual, balance above S$1,000 or credit facility, electronic payments) and exclude cards and business accounts explicitly.
2. Prove each duty per transaction: for each paragraph 4.2 duty, identify the system of record and confirm it can produce, for any given account and time, evidence that the duty was in force (cooling-off start and end, alerts sent with timestamps, block requests, surveillance decisions).
3. Test the cooling-off: run test cases that try each high-risk activity inside the 12-hour window after token activation and new-device login, including non-straight-through registration paths, which count towards the 12 hours.
4. Test the kill switch out of hours: confirm the self-service block works at all times, through each channel, and also during scheduled downtime.
5. Tune rapid-drain rules: implement the S$50,000 and 50% in 24 hours trigger with the footnoted exclusions, choose the block or the notify-and-hold option, and record which you use.
6. Build the claims workflow: intake that captures the four limbs, the 30-day and 3-day clocks, telco referral for SMS cases, an independent investigation team, and outcome letters within 21 or 45 business days.
7. Agree telco interfaces: FIs and telcos need a working channel for concurrent investigation and evidence exchange on SMS cases.
8. Monitor and report: track claim volumes, duty breaches found, time to outcome and losses borne by FI, telco and customer.

Metrics that show it is working

• Percentage of claims closed within 21 business days (straightforward) and 45 (complex).
• Number of claims where the FI could not evidence a 4.2 duty, by duty.
• High-risk activities attempted and blocked during cooling-off periods.
• Median time from security event alert to customer kill-switch use.
• Value held under 4.2.5 rapid-drain rules and value later released as genuine.

Framework mapping

For comparison with Australia's Scams Prevention Framework, the UK's APP reimbursement rules and other regimes, see the Online Fraud Regulation Map and the Australia Scams Prevention Framework Guide.

Practitioner checklist

• Confirm which of your accounts are protected accounts under the SRF and EUPG definitions.
• Enforce a minimum 12-hour cooling-off that blocks all four high-risk activities after token activation or new-device login.
• Send real-time alerts for security events and outgoing transactions, and keep delivery evidence.
• Offer a reporting channel and self-service account block that work at all times, including downtime.
• Implement rapid-drain surveillance (S$50,000 balance, more than 50% out in 24 hours) with a block or 24-hour hold.
• Telcos: deliver Sender ID SMS only from registered aggregators, block the rest, and filter all SMS for known malicious URLs.
• Run claims against the 30-day, 3-day, 21-day and 45-day clocks with an independent investigation team.
• Log every automated fraud decision with enough detail to defend it in a FIDReC or IMDA dispute.

Standards and references

• Monetary Authority of Singapore: Guidelines on Shared Responsibility Framework (PDF)
• Monetary Authority of Singapore: Guidelines on Shared Responsibility Framework
• Monetary Authority of Singapore: E-Payments User Protection Guidelines
• Monetary Authority of Singapore: MAS and IMDA Consult on Shared Responsibility Framework for Phishing Scams
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Online Fraud Regulation Map · Scam Prevention in Telecoms Guide · Authorised Push Payment (APP) Fraud Guide · Singapore PDPA Guide. This guide summarises the MAS Guidelines on Shared Responsibility Framework and is not legal advice.