Phishing for trouble: Physical bank token is no silver bullet

The latest effort to counter phishing could rattle less tech-savvy customers. It also needs a digital ecosystem to work.

- Irene Tham

Physical tokens in the early 2000s made way for digital tokens embedded in mobile banking apps in 2017. Now, there is a Fido hardware token. ST FILE PHOTO

(ST FILE PHOTO)

Physical banking tokens are making a comeback.

The Monetary Authority of Singapore (MAS) is working with banks on a Fast IDentity Online (Fido) hardware token that must be connected to a customer's device to approve high-value online banking transfers - in what would be a world-first nationwide roll-out.

The return of the physical token brings back memories of the pocket bulge of the early 2000s, when banks here issued a similar device with a number pad for generating onetime passwords (OTPs) to offer an extra layer of protection for online access.

Customers of multiple banks had to carry multiple tokens until 2017, when the industry shifted to digital tokens embedded in mobile banking apps.

Is Singapore reversing years of digital progress?

MAS often alludes to more friction to manage expectations.

As recently as August 2025, the authority was quoted as saying in The Straits Times: "While banks will do their best to minimise the inconvenience and give time for customers to get used to the new measures, there will be a need to prioritise security over convenience in the ongoing fight against scams."

It is hard to argue with that, but there are two potential issues with the upcoming token.

One, it will not be easy to register, especially for those who are not tech savvy.

Two, even after the token is registered, it will not provide an ironclad guarantee against scams unless all websites support the technology.

SCARRED BY PHISHING

This is not to downplay the scale of the problem. Singapore's wealth and high internet penetration make the country a profitable target for transnational syndicates.