JAPAN: A recent holiday to Japan became a financial nightmare for Singaporean Melvin Chan and his wife when their bank accounts were locked, and their credit cards were cancelled by identity thieves.
The criminals impersonated the couple by making phone calls to their banks, leaving them stranded in Tokyo without access to funds.
A STOMP report narrated how the ordeal began on Oct 7, when the couple visited Tokyo DisneySea, a popular theme park that operates on a cashless system.
Almost everything, from meals to express ride passes, requires card payments. However, when Mr. Chan tried to use his cards, none of them worked.
“DisneySea is a cashless attraction, and we quickly realized we couldn’t pay for anything. We tried calling our banks for help, but it was a nightmare,” said Mr. Chan, 35.
The couple spent hours calling DBS Bank, UOB, and OCBC from the theme park, racking up $200 in roaming charges as they tried to resolve the issue.
Eventually, they learned that someone had impersonated Mr Chan and convinced the banks to cancel all of their cards and block their accounts, citing a lost wallet.
“We were shocked to find out that all my credit cards were cancelled and our bank accounts were blocked. The banks said they could only reinstate them once we were back in Singapore,” Mr Chan explained. He has since filed a police report about the incident.
The couple, left without access to their accounts, had to rely on limited funds from Mr Chan’s wife’s Thai bank account and a YouTrip travel card to finish their trip.
While the couple did not lose any money, the incident highlights the growing issue of scams and fraud, as well as concerns over the security of identity verification processes at local banks.
In the first half of 2024 alone, Singapore’s police reported a record $385.6 million in scam-related losses, with nearly 27,000 cases.
UOB and OCBC emphasized that customer account security is a top priority, stating that blocking and cancelling cards are essential anti-fraud measures.
However, Mr Chan expressed frustration over the ease with which the scammer bypassed identity checks.
He pointed out that the caller had passed identity verification on several attempts despite initial failures and questioned why the banks didn’t contact him when the first verification attempt failed.
A UOB spokesperson explained that securing customer accounts swiftly is a priority and that callers are asked to provide detailed personal information, such as the account holder’s NRIC number and card details, in line with industry standards.
OCBC acknowledged the inconvenience to Mr Chan and said it would continue refining its processes to strike the right balance between security and customer convenience.
The bank also expressed its commitment to assisting with the ongoing police investigation.
DBS, which also received a request to block Mr Chan’s cards, stated that it followed its established protocol to secure his account.
The bank emphasized that, typically, callers must provide full personal details, including the account holder’s NRIC number or phone number, to initiate card blocking.
In response to the incident, DBS confirmed it had taken additional security steps on Mr Chan’s account, such as setting up alerts and requiring SMS-based verification for future actions.
Mr Chan raised concerns about what he sees as gaps in the banks’ verification procedures, particularly in allowing a third party to request cancellations based on minimal personal details like a full name and phone number.
He believes that these vulnerabilities could be exploited by fraudsters.
The couple later discovered that the scammer may have been someone Mr Chan’s wife knew from work after a phone number linked to the impersonator was traced through a gym they both frequented.
The caller had even attempted to transfer the couple’s gym memberships to another location.
Lawyer Sunil Sudheesan, who specializes in criminal law, warned that the low thresholds for identity verification could pose a significant risk.
He suggested that banks adopt more robust verification measures, such as a callback system or a temporary account freeze while further checks are conducted.
“Some level of verification is needed, and banks should consider implementing stronger safeguards, including requiring one-time passwords before cancelling accounts,” said Sudheesan.
He also noted that impersonation could be considered an offence under Singapore’s Penal Code, carrying penalties of up to five years in prison, a fine, or both.
As the Chan family’s story unfolds, it underscores the increasing urgency for financial institutions to strengthen their identity verification processes in the face of growing fraud risks.
Meanwhile, Mr Chan hopes that his experience will prompt banks to take stronger action to protect customers from similar scams in the future.