To fight scams, Singapore banks set up anti-mule team, hire ex-police officers

SINGAPORE: Unusual transactions or account activities that do not tally with a customer’s profile – these are the red flags that Mr Darren Eu looks out for in mule accounts.

For instance, an account holder making large deposits and withdrawals over consecutive days without a clear reason. They could have been deceived into giving away their banking credentials to scammers as part of a "job".

“No customer will admit they are a money mule, so it is our job to find out,” said Mr Eu, an investigation specialist with DBS’ anti-mule team.

Set up in September last year, the team, which is part of a broader anti-scam squad, is made up of eight former police officers and bank employees. Their job is to eliminate money mules – people who allow criminals to control their bank accounts and in doing so, help scammers move illicit money out of the financial system.

DBS, Singapore's biggest bank, formed its anti-scam squad in 2019. The squad includes more than a dozen people monitoring fraud alerts round-the-clock.

“We wanted to take a more proactive step in 2019 to try to identify and stop these scams as they are being committed … and if we’re not quick enough to catch that, then we help with fund tracing and funds recovery.

“Now, with the anti-mule team, we want to make sure that (the scammers) can’t run away with the money,” said DBS' head of investigations Yin Juon Qiang.

Since the anti-mule team was formed, it has worked with the police and provided critical tipoffs such as one that led to an islandwide raid last November against money mules. Five people were arrested and more than S$680,000 (US$506,000) was seized.

Mr Eu, who previously did data and surveillance work on the bank’s anti-scam team, was the lead analyst for the November raid. 

“It's quite rewarding to see all your work paying off, with people being held accountable,” he said.

RECRUITING EX-POLICE OFFICERS

Between December 2021 and January 2022, nearly 800 people were duped in an SMS phishing scam involving OCBC. More than S$13 million was lost. 

The bank ended up covering the full amount as "goodwill payouts". 

Several months after the incident, OCBC consolidated its anti-scam and fraud functions under one department then tripled its headcount for the team to more than 100. 

The move was in anticipation of an increase in the number and complexity of scams, said Mr Beaver Chua, the bank's head of anti-fraud.

Two-thirds of the team are involved in 24-hour surveillance work, while others are stationed at the police’s anti-scam command centre or involved in advisory and analysis.

Singapore banks also recruit former law enforcement officers for their anti-scam teams. Also in demand are those with experience in fraud risk management and advisory, as well as system analysts and fraud analytics experts.

This varied nature of talent needed reflected how scams were becoming more sophisticated and technologically driven, banks said.

“It is quite challenging,” said OCBC’s Mr Chua. “In the past, the team would normally just have ex-police officers but now we need people with diverse backgrounds and different kinds of expertise.”

One such hire was Beverly Teo, formerly with the Commercial Affairs Department (CAD), the police's white-collar crime investigation agency.

As an anti-fraud specialist with OCBC, Ms Teo advises on controls that can help prevent scams, such as the slew of security updates targeted at malware scams. She also works on various scam-related training and awareness programmes for both bank staff and customers.

Ms Teo said her experience at the CAD's Suspicious Transaction Reporting Office and the Public Institutional Fraud Division has come in handy.

“All those would have taught me things like understanding commercial transactions, how to investigate individuals and businesses by reading their ledgers,” she said.

“The bank has a lot of data, so my experience helps me to analyse and understand it, and identify any abnormalities in the financial transactions.”

UOB declined to reveal how big its anti-scam team is, citing operational sensitivities. It would only say it had a "significant increase" in hiring for various scam-related roles across the bank over the past three to four years.

“We do have a specific team, but scams are not only handled by one team as it cuts across different parts of the bank,” said the bank’s head of group human resources Dean Tong.

UOB has hired staff with expertise in new technologies, such as artificial intelligence, to identify emerging scams and develop preventive strategies.

The bank has also ramped up headcount at its call centres to have dedicated staff for scam-related calls in recent years.

“We need to make sure that we are beefing up capabilities across the board,” said Mr Tong.

“IT’S NOT EASY”

Still, even as banks step up their hiring, staying ahead of scammers is a huge challenge.

While malware scams – where victims are duped into installing apps that allow fraudsters to take control of their devices – were the key risk last year, phishing scams are now back on the rise.

More than 200 DBS customers have fallen prey to SMS phishing scams in the first two weeks of this year, losing S$446,000 in total. Another phishing scam that uses fake WhatsApp Web websites also deceived at least 93 people last year, with losses amounting to S$176,000.

“Every time we have a win (and) we managed to stem the scams at a certain point, that’s when the scammers start to move,” said DBS’ Mr Yin. “So, it’s not just a matter of manpower, but the ability to spot trends (and) the agility to scale up operations for what requires attention are important.”

By analysing vast amounts of data 24/7 and working with local and global law enforcement, banks are hoping they can better identify fraud patterns and anticipate and detect emerging ones. 

From there, security measures and preventive initiatives can hopefully be developed and rolled out in time. 

For example, the “money lock” feature took several months of development and user testing before it could be rolled out to bank customers.

When malware scams started emerging, Singapore banks quickly began working on anti-malware security updates. 

OCBC's work began last April. But no one knew in the early days that the malware could take over devices remotely, said Mr Chua.

“We could only guess … because the default was that (the scammers) would erase the phone and there was nothing to work on," he said.

“In the first phase, we guessed it was a remote sharing of the screen so we blocked that in May. Then, things changed and it became a complete malware takeover.” 

That led to the implementation of anti-malware security measures in August. These restricted customers' access to digital banking services if sideloaded apps – or apps downloaded from unofficial portals – are detected. But this resulted in complaints from some users.

Still, that is part and parcel of a scam buster’s work, said Mr Chua.

The local banks said they are adequately staffed for now but are open to the option of ramping up manpower if necessary.

“Across the industry, everybody has been very careful with hiring … given the outlook of the market. But anti-scam is one area that we are putting a lot of attention in beefing up the staff, not only in terms of numbers, but also in terms of training and capabilities,” said UOB’s Mr Tong.

OCBC is also using machine learning to help identify vulnerable customers. The pilot test, which started in May last year, has concluded.

“It's not easy because we are also guessing how the scammer is (taking) the next step so we just have to keep looking at trends and keep developing,” Mr Chua said.