For financial institutions like banks, any form of an outage is simply unacceptable. Thousand of consumers rely on the bank’s digital services and were left fuming as transactions and online banking matters could not work.

CAN LEGACY BANKS STAY RELEVANT WITH BANKING AS A SERVICE?

Aaron Raj | 16 August, 2021

According to a report by The Straits Times, the disruption began on Tuesday morning as stated by outage monitoring website Downdetector. While the bank was able to sort the problem, the outage occurred again the next day, resulting in almost 15 hours of outage.

In a video message to customers, DBS Singapore Country Head Shee Tse Koon provided an update on the disruption in the bank’s digital banking services. “We have since been working round the clock, together with our third-party engineering providers, to fix the problem.”

As one of Southeast Asia’s largest banks, DBS Bank is known for using new technologies in its financial systems. It recently announced that its digital asset ecosystem, anchored by the DBS Digital Exchange, has enjoyed strong business momentum since it went operational 24/7 in August this year. DBS also recorded over SGD 600 million in digital assets under custody as of the end of October, triple the amount recorded in the previous month.

(Photo by ROSLAN RAHMAN / AFP)

The bank also announced that it will invest SGD300 million next year to grow the breadth and depth of its digital and Intelligent Banking capabilities powering all products and solutions for wealth and retail customers. The investment will go towards enhancing tech infrastructure and talent, embedding Intelligent Banking predictive technology in more financial solutions to better empower self-directed customers, and scaling the bank’s capabilities across both online and offline touchpoints across the region.

While the bank outage has been resolved, the reality is, outages can happen. The Monetary Authority of Singapore (MAS) said it will consider taking “supervisory action” on DBS for the disruption, Reuters reported.

“This is a serious disruption and the Monetary Authority of Singapore (MAS) expects DBS to conduct a thorough investigation to identify the root causes and implement the necessary remedial measures,” Marcus Lim, an assistant managing director from the banking and insurance team at MAS, said in a statement.

 Dealing with bank outage

To understand more about the bank’s outage, Tech Wire Asia caught up with Kevin Reed, Acronis CISO, and Alex Ivanyuk, Acronis Technology Director. Both of them explained how the bank could have dealt with the issue.

“For a renowned bank, like DBS, to have some services down for more than 24 hours – with none of the services available at some point – is quite unacceptable. In my experience of technical firefights, the worst-case scenario is recognized fairly quickly. Given how long it takes to resolve this issue (still being resolved), they may be still trying to locate the problem,” said Kevin.

Since DBS hasn’t shared much info about what happened, Kevin thinks the issue could be with their authentication systems. It’s hard for him to tell, but a system upgrade or some external event could be causing a significant overload of the authentication platform, leading to its malfunctioning. Many users have reported the issue, the access is sporadic, signs of an overload. Many similar events happened in the past, DDoS attacks are often the cause of system overload and not responding to legitimate user requests.

Kevin also pointed out that in the 21st century, banks need to modernize their infrastructure with advanced technology, including cyber protection – having a capable tech team helps achieve just that and be on top of the problem.

“As per stated on their website: “maintenance for Services involving foreign exchange is scheduled daily from 5am-6am”. Running scheduled maintenance that can possibly cause downtime – it’s simply not done in our day. Many sites have figured out how to upgrade without disrupting the operations by now,” added Kevin.

For Alex, this is not the best example of crisis handling. Not only the bank services were down, but customer support functions also weren’t working, and there was no announcement on any public DBS channel until hours later.

“That being said, in my experience, no bank is much better at that – and DBS is not the first bank to face such issues. Banks are known to still use outdated, legacy systems – especially if they were founded long ago. Large US banks are known to use COBOL and mainframes, but they are not exactly technological power horses, to say the least,” noted Alex.

Alex also commented that it’s not just the banking industry that can have outages. Transportation, telecom to some extent, manufacturing, industrial (like plants, various controls, etc), even military – many of them still rely on legacy systems, which poses a problem internally (to employees) and externally (to customers). This also makes them exposed to cybersecurity threats.

The post DBS Bank suffers worst outage in a decade   appeared first on Tech Wire Asia.

The EMV card, a global standard for payment cards, made more secure because account information is stored on the chip. (Image: Gemalto)

Following the recent incident, the Association of Banks in Singapore announced, in January 2012, that the industry will adopt the EMV standard in ATM cards to address the risk of card skimming. Its implementation will require infrastructure changes to the ATM networks, and will take two years for completion.

EMV stands for Europay, MasterCard and Visa. It is a global standard for payment cards based on chip card technology.

While waiting for the new changes, Singapore banks are securing customer accounts by disabling overseas withdrawals — unless the customer requests for access when they travel. Customers now get SMS alerts for cash withdrawals that reach a pre-defined limit. DBS Bank replaced all the ATM cards affected in the skimming incident, and this will be a standard response in future incidents. Customers who are at risk of exposure to skimming will also get new cards.

MAS encouraged Singapore banks to beef up their surveillance and security systems, and to implement all the necessary changes as soon as possible. MAS acknowledged the severity of the problem and said it lookd at several options before deciding on EMV.

The industry has also evaluated various options, including biometrics to upgrade the overall security architecture of ATM systems… The timeline to move away from magnetic stripe is in line with those in other developed jurisdictions such as Australia and countries in the European Union.

DBS bank enacted new security measures last January, such as disabling of ATM card usage overseas, SMS alerts for suspicious overseas transactions and SMS alerts for local withdrawals and payments above a certain threshold. DBS also sent out new cards for customers affected by the January and February skimming incidents, as well as to customers who were at risk.

Three suspects were taken in for investigation last January, but no other suspects were reported for the February incident which saw $23,000 (US$ 18,348) taken from DBS customer accounts. DBS announced that a third ATM machine was compromised along with the two ATMs in Bugis, as reported earlier.

The EMV chip is already included in most of the ATM cards issued in Singapore, and merchants use the EMV system for payments. ATM technology has lagged in this area because majority of the machines in the island state still access account information from the magnetic strip at the back of every card.

While waiting for the ATMs to get upgraded, the onus is on every account holder to be vigilant.

The post Singapore To Tighten Banking Security appeared first on Tech Wire Asia.

Paraphernalia seized from two suspects in the DBS Bank ATM skimming incident.

DBS reimbursed almost S$ 1 Million (US$ 773,224) to 696 affected customers last January, and $23,000 (US$ 18,348) to 17 customers this week. Two machines at Singapore’s busy shopping district were tampered by the thieves last year. Three suspects were caught last month and were charged with possession of equipment for replicating ATM cards. DBS issued a statement in addition to their initial press release last Thursday.

On Sunday, the bank was alerted to unauthorised ATM withdrawals by 17 customers after they received real-time SMS alerts. After we were informed of this, we were able, through our customer analytics, to establish common patterns amongst the affected customers. From there, we now believe that a different ATM has been compromised at around the same time of the Bugis skimming. We are unable to disclose further details, as this may jeopardise the ongoing investigation.

The bank deactivated the cards of customers who were at risk of unauthorised ATM withdrawals and issued new cards. No new skimming  incidents have been reported so far. DBS enacted new security measures to curb further incidents, such as disabling of ATM card usage overseas, SMS alerts for suspicious overseas transactions and SMS alerts for local withdrawals and payments above a certain threshold.

Always be on the lookout for card skimming devices on ATMs, check for the vibrating function and blinking light in the ATM card slot. Cover your hand when entering your PIN, and keep your PIN secure by changing it regularly and using complex combinations.

The post ATM Skimmers Breach Another Machine appeared first on Tech Wire Asia.

DBS stemmed the tide of recent skimming incidents due to its latest security measures enacted last month. (Image: Ooi Boon Keong)

DBS Bank released a statement yesterday regarding the incident.

This incident is not a result of any new skimming activity but a residual effect of the same card skimming operation that took place at the end of last year. DBS fully compensated all 17 affected customers a total of SGD 23,000 within 24 hours.

Bank officials enacted new security measures to curb further incidents, such as disabling of ATM card usage overseas, SMS alerts for suspicious overseas transactions and SMS alerts for local withdrawals and payments above a certain threshold. DBS also sent out new cards for customers affected by the January skimming incident, as well as to customers who were at risk.

In the latest incident, the customers were the ones who noticed the unauthorized transactions and called DBS. Apparently the crooks made withdrawals below the predetermined threshold to stay off the radar, but vigilant customers spotted the missing cash from their accounts and informed the bank.

DBS promptly clamped down on the skimmers and disabled the affected accounts. The bank also deactivated “at-risk accounts”.

Based on the Sunday withdrawals, the DBS analytics team identified a further group of customers who were potentially at risk of fraudulent domestic withdrawals. To safeguard them against unauthorised ATM withdrawals, the bank proactively de-activated the cards of this group of customers, and took immediate steps to replace their cards. These customers were also informed of the card de-activation on the same day and new ATM/Debit cards have since been issued to them.

No matter how sophisticated the security measures become, the main line of defense appears to be vigilance, as proven in this case. Cybercriminals can strike your computer, your phone, your tablet as well as your wallet, so always keep passwords secure, check your accounts regularly, and report any suspicious activity as soon as you spot them. That spam email with you as sender means your email account has been compromised. That unauthorized payment for “manhood medication” should be looked into right away — unless you really ordered them. So stay alert, change your passwords regularly, keep your PINs close, and your accounts closer.

The post DBS ATM Skimmers Strike Again appeared first on Tech Wire Asia.

Suspected ATM Skimming Tools

DBS revealed last week that it reimbursed almost S$ 1 Million (US$ 773,224) to 696 affected customers, almost twice the amount and customer tally of the initial reports. The bank also announced new security measures to protect customers from similar incidents.

For added security, with immediate effect, DBS/POSB ATM/ Debit card-holders who have not used their cards outside Singapore, since 1 July 2011, will not be able to make ATM cash withdrawals overseas unless the bank is otherwise instructed. In other words, this group of customers who historically only used their ATM/ Debit cards locally, will now have to inform the bank should they want to make cash withdrawals overseas.

With effect from Tuesday, 17 January 2012, customers who have chosen to enable their cards for overseas use will also receive a real-time SMS alert confirming their request.

The bank already implemented SMS alert functions for overseas transactions that reach a pre-defined limit, as well as for particular local cash withdrawals. DBS/POSB also revealed that the two ATMs hacked into by the skimmers did not have the “jitter” function deployed in the card receiving slot. This function would have made card skimming difficult because customer cards would be shaken during entry and exit from the slot. Existing security measures on ATMs include the surveillance camera, flashing and  translucent card slots, as well as the card-shaking entry and exit function. DBS said different ATMs have varying security features enabled due to the machine type and location.

Singapore netizens reacted to this statement from the bank.

How can DBS make such a statement that only some ATMs are fully secured sometime(s). So it depend(s) on the users luck when using the ATMs if it has all the security features turned on?

It now falls on every ATM user to be vigilant of the machines they use. Users should visually inspect the ATM for the proper security options — the flashing card slot lights; presence of new or suspicious attachments near or above the keypad; and the card-shaking in the slot whenever they put in and take out their ATM cards. It is still a good idea to cover  one’s hand when keying in the PIN, and to retain transaction receipts. DBS bank advocates regular changing of one’s PIN for further safety. Some users tend to become complacent — especially if they are in a hurry, or when the ATM queues get too long.

The post 3 Suspects Nabbed in S$1M DBS ATM Fraud appeared first on Tech Wire Asia.

DBS and POSB merged in 1998, making it one of the leading local banks in the island. The bank lost almost S$ 500,000 (US$ 386,667) in reimbursing the 400 customers affected by the unauthorized withdrawals from 4 to 5 January.

Bugis area DBS ATMs

The world of hackers and crooks out there is getting smarter everyday. It is incumbent on us as your bank to stay ahead of them. Banks have to make it difficult for them to capture data and if data is stolen, for them to use the data.

Mr. Gupta announced enhanced security measures, including SMS alerts to customers when withdrawals to their accounts exceed a predefined limit. DBS/POSB customers can set these limits through online banking or over the bank counters.

Cybercrime is a growing threat worldwide, and this involves various activities, including identity theft, financial fraud, and the like. Cybercrime can involve mobile devices, such as malware in smartphones, stolen credit card information, stolen online account information, and this time, ATM accounts. Security experts have warned that end-user involvement is usually the best line of defense. If you feel that a mobile application asks for too much access, or if you think an ATM terminal has an installed skimming device, then simply walk away.

The post DBS CEO Apologizes for Stolen ATM Card Information appeared first on Tech Wire Asia.

A typical DBS Bank ATM

Bank officials identified two ATM machines in the Bugis shopping district as the source of the stolen ATM and debit card accounts. Skimmers collected account numbers and PINs of more than 2,700 customers over three days in November 2011, and then withdrew the money in neighbouring Malaysia. All DBS ATM machines are equipped with anti-skimming devices, and security staff regularly check the machines when replenishing the cash, but the culprits managed to circumvent the security system. The bank contacted all affected customers, deactivated their cards and sent out replacement cards.

Bank personnel replaced the anti-skimming devices on the two ATM machines and cleared the machines for continued use, finding no indications that they are still being compromised.

DBS has suffered from technical difficulties affecting customers in October 2009 and July 2010. An “isolated technical glitch” in 2009 prevented customers from updating their passbooks and withdrawing over S$ 2,000.  The bank resolved the problem in three hours. A seven-hour back-end problem in 2010 prevented customers from using ATMs and accessing their accounts online. DBS worked with their back-end vendor IBM to resolve the matter and resume services.

The post Skimmers Milk Almost US$ 400,000 From Singapore Bank appeared first on Tech Wire Asia.