Banks conducting 'thorough review' of practices on use of NRIC numbers: ABS

SINGAPORE: Banks are conducting a “thorough review” of their practices on the use of National Registration Identity Card (NRIC) numbers, the Association of Banks in Singapore (ABS) said on Thursday (Dec 19). 

It also assured consumer banking customers that NRIC numbers alone cannot be used to effect payment and fund transfers. 

“Banks apply multi-factor authentication at login for online financial services and there is an additional layer of control to authorise higher risk activities after login,” it said in a media release.

Higher-risk activities include high-value fund transfer, adding a new payee or raising fund transfer limits.

ABS' announcement on Thursday follows recent public anger and anxiety in relation to the saga over unmasking NRIC numbers. 

ABS said NRIC numbers serve important functions in various contexts to identify customers. For instance, they are useful for distinguishing individuals with identical names and facilitating efficient identification for customers seeking over-the-counter services. 

“In urgent situations, such as responding to ongoing scams, some banks have opted to use NRIC numbers to quickly identify customers in need of immediate assistance to prevent fraudulent transactions,” said ABS, adding that banks are now reviewing their practices. 

“We seek customers’ understanding that some existing practices may be changed as a result,” said the association. 

“Where customers adopt their NRIC number or other personal identifiable information as their password for login, ABS advises bank customers to change them.”

Some examples of personal identifiable information are name, NRIC number and date of birth.

The General Insurance Association of Singapore (GIA) and Life Insurance Association, Singapore (LIA) also issued a joint statement on the use of NRIC numbers on Thursday.

They assured policyholders that NRIC numbers alone cannot be used to purchase, surrender or alter existing policies, submit policy claims, nor change the nominated beneficiary or bank account information lodged with the insurer for receipt of policy payments. 

Insurers apply multi-factor authentication at login for online financial services and other forms of authentication for offline transactions, said GIA and LIA, adding that insurers are also conducting a “thorough review” of their practices on the use of NRIC numbers. 

ANXIETY, CONFUSION

Concern was raised last week after the Accounting and Corporate Regulatory Authority's (ACRA) Bizfile portal revealed NRIC numbers in their entirety in search results.

Addressing the incident, the government said on Saturday that it intends to change the practice of masking NRIC numbers.

But before it could first explain the rationale to citizens and prepare the ground, ACRA had gone ahead and launched its Bizfile portal, with a search function that produced people's names and full NRIC numbers.

This issue was addressed again at a press conference on Thursday, during which the government apologised to the public. 

“We are very sorry to have caused them much anxiety,” said Minister for Digital Development and Information Josephine Teo. 

ACRA’s chief executive Chia-Tern Huey Min also acknowledged the mistake and oversight on ACRA's part, apologising for the anxiety and confusion caused to the public. 

Mrs Chia-Tern said the Ministry of Digital Development and Information had in July “issued a circular for government agencies to cease any planned use of masked NRIC numbers in new business processes and services”.

This was part of a wider government effort to uphold the use of NRIC numbers as a unique identifier, and to move away from the use of masked NRIC numbers, which provides a false sense of security, she said.

“Unfortunately, there was a lapse of coordination between the staff on how this was to be implemented. ACRA then proceeded on the misunderstanding that it should unmask NRIC numbers in the new Bizfile portal,” explained Mrs Chia-Tern.