Singapore's Shared Responsibility Framework allocates anti-scam duties to institutions and telecom operators for defined phishing scams. Controls link duty breaches with compensation for qualifying victims, supported by claim investigation, compliance and communication of outcomes.
TL;DR:
- Allocates defined phishing losses among financial institutions, telecom operators and account users.
- Applies from December 2024 to specified accounts and transactions, excluding specified card payments.
- Compensation depends on scam scope, facts and compliance with each party's duties.
Summary
A defined category of phishing
The Framework concerns seemingly authorised transactions arising through impersonation, digital messaging, entry of credentials on a fabricated platform and use of those credentials for unintended payments. Those elements delimit its scope. It is not a general reimbursement scheme for every investment, purchase or romance scam, nor does calling an event phishing by itself establish that the transaction meets all of the Guidelines’ requirements.
Protected accounts and responsible parties
The Guidelines identify responsible financial institutions issuing protected accounts, responsible mobile-network operators and account users. Their definitions determine the institutions, accounts and funds covered. The sharing arrangement does not apply to Singapore-issued credit, charge and debit-card transactions specified in the Guidelines. The applicable account and payment route therefore need to be established before the allocation of responsibility is considered.
Controls and evidence of compliance
Financial-institution duties include relevant cooling-off controls, real-time alerts and channels enabling prompt reporting and blocking of further access. Telecom duties address SMS pathways supporting the fraud, while users are expected to protect credentials and use official information sources. The assessment therefore needs evidence of the event and compliance with the applicable duties, rather than relying only on whether an instruction passed an authentication step.
Loss allocation and the claims process
The Framework sets out responsibility for qualifying losses and a workflow for reporting and reviewing the event. Its Guidelines took effect on 16 December 2024 and operate alongside the E-Payments User Protection Guidelines, legislation and other MAS or IMDA requirements. A particular outcome depends on the facts, defined scope and relevant duty failures; neither a scam report nor the presence of an SMS message alone establishes an automatic payout.
Keywords
- Singapore SRF
- phishing scams
- shared responsibility
- financial institutions
- telecom operators
- protected accounts
- SMS channel
- duty compliance
- loss allocation
- card exclusions