BREAKING: The Monetary Authority of Singapore (MAS) and IMDA have Verifiedly enforced the Shared Responsibility Framework (SRF) today, February 10, 2026. This is a massive shift in liability laws that affects every bank account holder in Singapore.
Previously, phishing victims bore the full brunt of financial losses. Under the new SRF, financial institutions (FIs) and Telcos must now reimburse scam victims 100% of losses if they fail to meet strict new anti-scam security duties. Here is what you need to know right now.
- 🚨 Who Pays for the Loss? (The “Waterfall” Liability)
- 🛡️ Mandatory Anti-Scam Protocols 2026 (New Rules)
- ⚡ Emergency: How to Claim Your Refund (SRF Process)
- ⚠️ Warning: The “Negligence” Loophole
- 🧮 Scam Refund Probability Check (SRF Logic)
- 📌 SRF 2026: Urgent Key Takeaways
- ❓ Frequently Asked Questions About SRF 2026
🚨 Who Pays for the Loss? (The “Waterfall” Liability)
The SRF introduces a “Waterfall” approach to liability[cite: 8]. This means responsibility cascades down from Banks to Telcos, and finally to the Consumer.
If the Bank fails its duty, the Bank pays. If the Bank is safe but the Telco fails, the Telco pays. Check the tabs below to see the specific duties.
🏦 Financial Institutions (FIs)
Banks are now the first line of defense. They MUST reimburse you if they fail to:
- Impose 12-Hour Cooling Period: When a digital token is activated on a new device, high-risk transactions must be blocked for 12 hours.
- Send Real-Time Alerts: Immediate notification for any transaction activation or limit increase.
- Provide 24/7 Kill Switch: A working function to freeze accounts instantly.
📡 Telco Operators (IMDA)
If the bank is compliant, liability shifts to the Telco. They MUST pay if they fail to:
- Block Spoofed SMS: They must connect to the Singapore SMS Sender ID Registry (SSIR) and block non-registered alphanumeric sender IDs.
- Anti-Scam Filter: Failure to implement the mandated spam filter for known malicious URLs puts the liability on them.
👤 Consumer Responsibility
If both the Bank and Telco have done their jobs perfectly, the loss falls on you ONLY if:
- Negligence: You voluntarily gave away your OTP or SingPass credentials to a third party.
- Failure to Check: You ignored the real-time security alerts sent by the bank.
- Important: The burden of proof is now shared, but you must still practice cyber hygiene.
🛡️ Mandatory Anti-Scam Protocols 2026 (New Rules)
The SRF isn’t just about refunds; it enforces strict operational protocols. Banks have updated their apps overnight to comply. You will notice these changes immediately.
“Money Lock” Feature
All local banks (DBS, OCBC, UOB) now mandate a “Money Lock” feature where a portion of your funds cannot be transferred digitally at all. You must visit a branch to unlock it.
The 12-Hour Freeze
If you change your phone or reinstall your banking app, you will be unable to make transfers for 12 hours. This is not a bug; it is a mandatory SRF safeguard.
No Clickable Links
Banks are strictly forbidden from sending clickable links in SMS or Emails. If you see a link in a “bank” SMS, it is 100% a scam. No exceptions.
👇 Critical Scam Defense Tips (Click Icons)
Malware Rules
The SRF mainly covers Phishing. Malware scams (sideloaded apps) are treated differently. Banks may offer “goodwill payments” but full SRF liability is stricter for malware.
Kill Switch
Find the “Kill Switch” number for your bank NOW and save it. Activating this within minutes of a hack can save your life savings and strengthen your claim.
Police Report
You MUST file a police report (SPF) before you can initiate an SRF claim with your bank. This is the first required document.
⚡ Emergency: How to Claim Your Refund (SRF Process)
If you have just been scammed, speed is your only ally. Follow this Verified 4-step SRF claim protocol immediately.
Step 1: Freeze
Immediate Action
Activate Kill Switch
Call your bank’s emergency hotline or use the app’s “Kill Switch” immediately.
This freezes all accounts and prevents further outflow. Do this within minutes.
Step 2: Police
Verified Record
File SPF Report
Go to the nearest Neighborhood Police Centre or file online via SingPass.
You need the Police Report Number to submit a bank claim.
Step 3: Claim
Submit to Bank
SRF Dispute Form
Submit the Verified SRF Claim Form to your bank.
The bank has 21 days (maximum) to assess liability and payout if they were at fault.
Step 4: FIDReC
Last Resort
Dispute Resolution
If the bank rejects your claim, you can approach FIDReC (Financial Industry Disputes Resolution Centre).
They act as an independent mediator for claims up to S$150,000.
⚠️ Warning: The “Negligence” Loophole
🛑 Do NOT Give Your OTP!
The SRF protects you from system failures, not user error. If investigation shows that you voluntarily read out your OTP to a scammer over the phone, the bank is NOT liable.
The framework is clear: “Consumers bear the loss if they give away credentials.” Never share your SingPass or OTP, even if the caller claims to be from the police or MAS.
🧮 Scam Refund Probability Check (SRF Logic)
Use this tool to check the likelihood of a refund based on your reaction time. (Verified expectation is immediate reporting).
Hours taken to report scam after incident:
Reaction Time: 2 Hours
*Simulation based on MAS guidelines. Reporting within 24 hours drastically improves claim success.
📌 SRF 2026: Urgent Key Takeaways
The new law is live. Ensure you understand your rights and the new “Waterfall” liability structure.
SRF Summary
- Effective Date: February 10, 2026 (Today).
- Liability: Bank Pays first -> Telco second -> You last.
- Action: Activate “Money Lock” and save the Kill Switch number.
❓ Frequently Asked Questions About SRF 2026
No. SRF specifically covers “Phishing Scams” where digital tokens (like OTPs) are stolen. It does not cover scams where you voluntarily transfer money to a “lover” or “investment agent” (Authorized Push Payment fraud).
If no transaction occurred, you are safe. However, clicking a malicious link might install malware. Perform a factory reset on your phone immediately if you suspect malware.
No. The bank has a timeline (typically 2 to 4 weeks) to investigate who breached their duty (Bank vs Telco vs User). However, the SRF mandates a faster resolution compared to previous years.
Credit card disputes generally fall under a different chargeback mechanism (Visa/Mastercard rules). SRF is focused on bank transfers (PayNow, FAST) resulting from phishing.
The SRF is primarily designed for retail customers (individual accounts). Corporate and SME accounts have different liability clauses stated in their business contracts.