Singapore's Shared Responsibility Framework for phishing scams, explained

TrustScore.SG editorial team Published Last reviewed

The Shared Responsibility Framework (SRF) sets duties for financial institutions and telcos to reduce phishing scams. It also decides who bears the loss when those duties are not met. The Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority (IMDA) announced it on 24 October 2024. It took effect on 16 December 2024.

Who it applies to

The SRF applies to full banks, major payment service providers (including e-wallet providers) and telcos.

Which scams it covers

The SRF covers phishing scams, where a victim is deceived into entering account credentials on a fake website or app. It does not cover scams where the victim knowingly authorises a payment, such as most investment and impersonation scams.

Duties of banks and payment providers

  • A 12-hour cooling-off period when a digital security token is activated on a new device, during which high-risk transactions are blocked
  • Notification alerts when a digital security token is activated
  • Real-time notifications for outgoing transactions
  • A 24/7 reporting channel with a self-service "kill switch" to block accounts
  • Real-time fraud surveillance to detect unauthorised transactions (in force after a further six-month transition period)

Duties of telcos

  • Connect only authorised aggregators for SMS messages that use a Sender ID
  • Block SMS with Sender IDs that are not registered
  • Use anti-scam filters to block SMS containing known malicious links

Telco duties apply to SMS. They do not cover messages sent through RCS.

How losses are decided: the waterfall

If the financial institution breached any of its duties, it bears the full loss. If it did not, but the telco breached any of its duties, the telco bears the loss. If neither breached a duty, the consumer bears the loss. A consumer who disagrees with the outcome can go to the Financial Industry Disputes Resolution Centre (FIDReC) or the courts.

What the SRF does not change

Phishing made up 6,264 of the 37,308 scam cases reported in 2025. It accounted for about $39.9 million of the $913.1 million lost. Most losses came from scams outside the SRF, where victims paid willingly. For those, checking who is being paid before the transfer remains the main defence.

TrustEngine is one source institutions can use for that check on Singapore businesses. Using it does not by itself meet any SRF duty.

TrustEngine for institutions

Sources