Short answer: The Monetary Authority of Singapore (MAS) and Association of Banks in Singapore (ABS) announced on 9 July 2024 that major retail banks would progressively replace SMS one-time passwords (OTPs) for bank-account logins by customers who had activated digital tokens. The rollout was intended to take about three months, ending around 9 October 2024. It was not a new three-month deadline in 2026, and it did not abolish every OTP used by every banking customer.
What the 2024 announcement actually changed
The industry measure covered the second authentication step for specified online banking logins. Instead of receiving an SMS code, a customer with an activated digital token generally signs in on the bank’s website and approves the request in the bank’s mobile app.
- Enter your banking credentials on the bank’s genuine website.
- Receive a login-approval request in the registered banking app.
- Open the app and review the login details.
- Approve with the digital token, which may use a device PIN, biometrics, an in-app confirmation or a locally generated code.
- Continue the browser session after approval.
The measure did not remove passwords, eliminate all second-factor checks or constitute a blanket legal ban on OTPs. MAS and ABS described the change as a phishing-resistance measure. Read the MAS/ABS announcement.
Which customers and banks were covered?
The announcement referred to major retail banks, including DBS, OCBC and UOB, while allowing bank-specific implementation details to differ. It targeted customers who had already activated a digital token for bank-account access.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Customer situation | Expected login route |
|---|---|
| Digital token activated | Approve the login in the registered banking app |
| Physical token in use | Continue using the physical-token route where the bank supports it |
| No token activated | Complete the bank’s registration or recovery process |
| Phone cannot run the bank app | Use a supported fallback, such as a physical token, or contact the bank |
UOB said its affected SMS-OTP login authentication was phased out from the end of July 2024 for customers with digital tokens. Its guidance still describes a physical-token option for Personal Internet Banking. See UOB’s digital-token FAQ. Do not assume another bank uses the same labels, dates or recovery rules.
What is a digital token?
A digital token is a security credential held inside the bank’s official mobile app and linked to an enrolled device. Depending on the bank and transaction, it may approve a push notification, display an in-app confirmation or generate a manual code.
It is not a third-party authenticator app. Use only the app supplied by your bank. UOB explains its login and token functions on its account-management and security page. DBS provides setup instructions and says a customer can have the digital token on only one device at a time. See DBS’s digital-token guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why SMS OTPs were considered weaker
An SMS code can be entered into a convincing fake banking site or read to a scammer posing as a bank employee. The attacker does not necessarily need control of the phone if the customer is tricked into disclosing the code.
A device-bound approval makes that particular attack harder because the request is sent to an enrolled device and normally requires an action in the bank app. It is risk reduction, not a guarantee. A customer can still approve a fraudulent request, surrender banking credentials, install remote-access malware or lose control of the enrolled phone.
What customers should do
- Install or update the official bank app from the device’s legitimate app store.
- Activate the bank’s digital token before relying on app approval. Setup may require registered contact details, card information, a card PIN or additional identity checks.
- Confirm that the bank has your current mobile number and email address.
- Enable a strong device passcode and, where available, Face ID, Touch ID or fingerprint authentication.
- Keep the registered phone charged and available when logging in through a browser.
- Read the account or transaction details in every approval request.
- Reject any request you did not initiate. Banks do not need you to tell a caller an OTP, digital-token code, card PIN or banking password.
Never follow a link in an unexpected SMS or email to “activate” a token. Open the bank app yourself or type the bank’s known web address.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the change did not cover
Online card purchases
Card-payment authentication is a separate process from account login. DBS began progressively replacing SMS OTP authentication for specified 3-D Secure online card transactions from 16 March 2024, but that does not mean every bank or merchant handles card payments identically. DBS’s 3-D Secure information explains that separate rollout.
Other banking journeys
OTPs may still appear for digital-token registration or recovery, new-device activation, password resets, exceptional access journeys and selected services. A digital token may also generate a one-time code for a particular transaction; DBS documents a manual-code option for selected situations, including poor connectivity. See DBS’s authentication details.
Recommended Free Tools
Physical security tokens
The MAS/ABS announcement said customers using physical tokens would not be affected by this login change. Do not discard a physical token until you have confirmed that the digital-token route supports every service you use, including recovery and any specialist banking access.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Lost, stolen or replaced phones
A digital token normally does not transfer automatically to a replacement handset. Act quickly if the registered phone is lost or stolen.
- Contact the bank through the number printed on your card or the bank’s official website and ask it to remove or suspend the token.
- Secure the phone account and device, and change banking credentials if you suspect compromise.
- Register the token on the replacement device using the bank’s official process.
- Complete any cooling-off period or identity checks before attempting important transfers.
- Use a physical token or branch assistance if the bank offers that fallback.
UOB says digital-token activation may involve a 12-hour waiting period and gives separate instructions for a lost device. Read UOB’s recovery guidance. DBS also documents one-device registration and alternative setup routes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If the approval notification does not arrive
- Check that the phone has internet access and that notifications are enabled for the bank app.
- Open the official app directly; do not use a link in an unexpected message.
- Look for the app’s Digital Token or equivalent approval area.
- Confirm that the token is registered to the phone you are using.
- Set the phone’s date and time to update automatically.
- Contact the bank using an official number if the request remains missing.
UOB says a missed prompt can be retrieved through the “Digital token” icon on its login screen. UOB’s current instructions may use different wording as its app changes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Unsupported phones and operating systems
Digital-token access depends on a compatible, unmodified device and supported app version. Check your bank’s current device requirements if you use an older Android or iOS version, a phone without Google Mobile Services, a rooted handset, a work-managed phone with restricted notifications or a device that cannot install the official app.
DBS warned that some Huawei devices affected by HarmonyOS Next could lose access to its mobile banking apps and digital token, with a physical token needed to continue online banking. Read the DBS compatibility notice.
Security mistakes to avoid
- Push-fatigue scams: reject repeated prompts you did not initiate.
- Fake support calls: no legitimate bank employee needs your approval code or password.
- Remote-access software: do not install it at a caller’s instruction.
- Premature disposal: keep a physical token until all required services work through the replacement method.
- Confusing login and payment: an OTP request for a card purchase does not necessarily indicate a failed account-login migration.
Timeline and current status
| Date | Event |
|---|---|
| 16 March 2024 | DBS began progressively replacing SMS OTP authentication for specified 3-D Secure online card transactions. |
| 9 July 2024 | MAS and ABS announced the bank-account-login transition for digital-token users. |
| End of July 2024 | UOB says its affected SMS-OTP login phase-out took effect for digital-token users. |
| About 9 October 2024 | Approximate end of the three-month industry rollout announced on 9 July. |
| 18 September 2024 | MAS and ABS announced Singpass Face Verification for higher-risk digital-token setup scenarios. Read the announcement. |
As of 2026, this is best understood as a 2024 security transition that has already been rolled out, not a newly announced deadline. Your bank’s current support page remains the authority for the exact login, payment, recovery and device rules that apply to your account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
