Singapore’s PayNow use of ‘X’ to mask customer names spells out inappropriate words, ABS cites system limitations

SINGAPORE: A recent change to Singapore’s PayNow system has triggered a wave of complaints after some users discovered their masked names were displaying unintended and sometimes inappropriate words.

The problem emerged after the Association of Banks in Singapore (ABS) removed PayNow’s nickname feature on June 6 as part of efforts to combat impersonation scams. In place of nicknames, users’ registered names are now displayed, with certain letters replaced by the letter “X”. The bank’s action was intended to improve customer security. Instead, it caught public attention for a different, or rather, for all the wrong reasons.

Several users shared screenshots of their X-ed names on Reddit and Facebook, showing how the new masking format had transformed parts of their names into combinations that spelt words such as “SEX”. The posts received hundreds of comments and reactions, with some poking fun at the unexpected results and others questioning the choice to use “X” as the masking character. ABS said it was aware of the feedback and was reviewing customer responses, according to a June 11 Channel NewsAsia (CNA) report.

Symbol limitations in PayNow systems

ABS explained that not all PayNow-related systems across its 29 participating financial institutions currently support special characters, symbols such as asterisks or dashes, which couldn’t be used consistently across the network.

As that was the case, ABS opted for the letter “X” instead because it’s generally recognised as a marker for concealed or missing information and visually resembles a crossed-out character.

Ong-Ang Ai Boon, Director of the Association of Banks in Singapore, said the approach was chosen so the nickname feature could be removed quickly while keeping the payment system running smoothly for users. She added that ABS hopes customers will understand the need for the fast change and said customer feedback will continue to be reviewed for improvements.

A security fix that created a public relations headache

The nickname feature has been part of PayNow since its launch in 2017. It was originally introduced to address privacy concerns among people who didn’t want their full registered names displayed when receiving payments through their mobile numbers or revealing their National Registration Identity Card (NRIC) details.

However, ABS recently found that scammers were exploiting the feature by creating nicknames that resembled trusted organisations or individuals. This made it easier to trick victims into sending money to fraudulent accounts.

The removal of nicknames was therefore aimed at reducing impersonation risks, a growing concern as scam cases continue to affect Singapore residents.

While the security rationale is understood, the naming mishaps show how even well-intentioned technical fixes can produce unexpected outcomes once they reach millions of users.

Changes made to solve one problem create another

PayNow has become a routine part of daily life in Singapore. From splitting restaurant bills to paying small businesses and transferring money to friends and family, many people use the service regularly. So when such a system touches everyday transactions, even a minor design choice can become highly visible.

The incident also brought to light a common challenge in technology and policy decisions. Changes made to solve one problem can sometimes create another, even if the new issue is far less serious than the original one.

For now, businesses receiving payments through their Unique Entity Number (UEN) are unaffected, as they have always used their registered business names and never had access to the nickname feature.

Nevertheless, security remains the bigger priority, and customer responses do suggest that user experience matters too. A small adjustment to how names are masked could go a long way towards preventing future awkward moments at the payment screen.