Singaporeans say PayNow’s new name masking method is ‘still too weak’

SINGAPORE: Singapore’s planned changes to PayNow display names have sparked concern online, with some users arguing that the new masking system could expose more personal information than the nickname feature it is replacing.

The Association of Banks in Singapore (ABS) announced on Apr 29 that PayNow nicknames for retail users will be discontinued from Jun 6 as part of efforts to combat impersonation scams.

Under the new system, display names shown during PayNow transfers will automatically switch to partially masked versions of users’ registered bank account names. According to ABS, selected letters of a payee’s name will still be visible while other characters are replaced with asterisks.

The change will happen automatically and does not require any action from users. All other PayNow functions will remain unchanged.

ABS said the move is intended to strike a balance between preventing scams and protecting privacy.

“This approach balances the use of real names as a safeguard against account impersonation, while being mindful of privacy considerations,” the association said.

The banking industry body explained that scammers had been abusing the nickname feature by using the names of legitimate businesses or trusted individuals as their PayNow aliases to deceive victims into sending money to fraudulent accounts.

“With this enhanced security measure, scammers will no longer be able to masquerade as legitimate entities or persons, significantly reducing their ability to deceive unsuspecting users through PayNow,” ABS said.

PayNow’s nickname function has existed since the service launched in 2017, allowing users to avoid displaying their full registered names when receiving payments linked to their mobile numbers or NRIC numbers.

ABS said that while the feature was originally introduced to address privacy concerns, the current scam environment made the change necessary.

Businesses receiving payments through PayNow linked to their UENs will not be affected because they do not have access to the nickname function and already use registered business names by default.

ABS director Ong-Ang Ai Boon said protecting consumers from scams remained a key priority for the banking sector.

“Discontinuing the nickname feature removes an avenue that scammers can exploit while safeguarding customer privacy. This enhancement will help ensure that PayNow users continue to enjoy a secure and trusted payments experience,” she said.

Despite the explanation, the new masking format quickly became the subject of criticism online after examples circulated showing how names would appear.

A user named Chan Shi Hui Jacqueline, for instance, could appear as “Ch** Sh* Hu* Jacqu*****”, while Muhammad Hakeem bin Osman might appear as “Muham*** Hak*** bi* Osm**”.

Some Singaporeans online have argued that the masking is “still too weak” and would allow people to infer someone’s full legal name.

One commenter questioned how the move improved privacy at all. They asked, “Wait, I don’t understand. How is this more secure? I can input anyone’s phone number, and instead of the nickname previously can pretty much get your full name? Which scammers can now use to call you? Is there something I am missing?”

Another user replied that the change was aimed specifically at preventing impersonation scams, “Scammers were setting their PayNow nicknames to other business/people’s names to trick people into sending them payments. This is the fix to prevent that but opens up another can of worms.”

Others began suggesting alternative masking methods that they believed would better protect privacy.

One Redditor proposed adding more masking characters than necessary to obscure the original name length.

“I think one workaround is to include more X than there actually is masked. So like, if it’s Josephine, maybe can put JOXXXXXXXXXXX,” the commenter wrote, adding that fixed but extra masking characters could make it harder to reverse-engineer names.

Another user suggested a simpler method and said, “Or just replace it with one single X all the time. So Josephine, Joanne, Jonathan, Josh, and Jordan will all be JoX, way less calculation needed.”

Several netizens also argued that users should be allowed to choose how their names are displayed instead of having a single mandatory format.

“A far better way is to give users choices,” one commenter wrote. “One can just be an acronym of their full name, the other can be this masking, and users who want to show their full name can opt to do so as well.”

Concerns escalated further after one individual claimed to have tested the masking system using an artificial intelligence language model.

The netizen said they masked several friends’ names according to the new format and asked the AI model to decode them. Revealing that the AI model got four out of six names correct, they sarcastically said, “At this point, just make a national database of our full name, NRIC phone number, save the scammers some time.”

Another commenter highlighted how readable the masked names remained by writing an entire sentence with letters obscured by asterisks. Asking why bother masking names that can easily be guessed and which genius thought of this idea, they wrote, “Whx botxxx masxxxx namxx ix thxx cax easxxx bx guexxxx? Whixx genxxx thoxxxx ux ox thxx shxx? Samx misxxxx ax NRXX sagx…”

A fellow Redditor responded bluntly: “Amazing, I can read that so the censor really suxx”.