Liability is moving to banks, market by market

The timeline

1. Oct 2024United Kingdom. Mandatory reimbursement of authorised push-payment scams, shared by sending and receiving firms.¹
2. Dec 2024Singapore. Shared Responsibility Framework: banks and telcos pay when they miss their duties; 12-hour cooling-off after a new device or token.³
3. Jun 2025Philippines. AFASA rules: muling and social engineering criminalised; disputed funds can be held.⁶
4. Jan 2027India. Revised customer-liability framework for digital transactions applies.⁹
5. Mar 2027Australia. Scams Prevention Framework obligations: prevent, detect, disrupt, respond and report, with penalties.¹²

United Kingdom: reimbursement by default

Since October 2024, payment firms have had to reimburse customers who lose money to authorised push-payment scams, with the cost split between sending and receiving firms. In the first year, 88% of the money claimed was returned, about £173 million.¹

Liability moved the cost onto firms but did not, by itself, shrink the attack. In 2025, losses to scams in which customers are tricked into paying still rose 19%, to £576.4 million.² The UK is outside DeepID’s seven markets; it shows why prevention moves to the moment of payment.

Singapore: shared responsibility

The Shared Responsibility Framework has applied since 16 December 2024. Banks and telcos bear phishing losses when they miss their duties. Those duties include a 12-hour cooling-off after a new device or digital token is activated, during which high-risk activities are blocked, alongside real-time fraud surveillance.³

Since 1 July 2025, the Protection from Scams Act 2025 has let the police issue restriction orders directing banks to restrict the transfers of someone the police believe is about to send money to a scammer.⁴ MAS has said that telling deceived, self-authorised transfers apart from legitimate ones is “not an easy task”, even for sophisticated fraud detection systems.⁵

The Philippines: a deadline that has passed

The Anti-Financial Account Scamming Act criminalises money muling and social engineering, and lets financial institutions temporarily hold disputed funds. Its implementing rules took effect on 25 June 2025.⁶

BSP Circular 1213 requires stronger methods than SMS and email OTP for high-risk transactions, such as biometric, behavioural or passwordless authentication, with a deadline in June 2026.⁷ In July 2026, BSP’s general counsel said financial institutions that missed the upgrade may have to reimburse their customers’ losses.⁸

India: 1 January 2027

RBI’s amended customer-liability framework applies to digital transactions from 1 January 2027.⁹ As reported, the customer carries zero liability where the bank was negligent. Losses of up to ₹50,000 can be compensated at 85% or ₹25,000, whichever is lower, once per customer, if reported within five days.¹⁰

It builds on RBI’s 2017 circular, under which the customer carries zero liability when the bank is at fault or the fraud is reported in time.¹¹ The detail is in our guide to RBI’s 2027 framework.

Australia: 31 March 2027

The Scams Prevention Framework Act 2025 requires banks, telcos and digital platforms to prevent, detect, disrupt, respond to and report scams, with penalties of up to AUD 50 million.¹² Most of its obligations apply from 31 March 2027.¹³

Malaysia, the UAE and Saudi Arabia: controls first

No loss-sharing rule is mapped yet for these three markets, which is not the same as none existing. Their rules call for the controls that liability regimes elsewhere take for granted:

• Malaysia. Bank Negara Malaysia’s measures: migrate from SMS OTP, confirm suspicious transactions, cool off first enrolment and keep one registered device per account.¹⁴
• The UAE. Banks are moving authentication off SMS and email OTP and into their own apps, from 25 July 2025.¹⁵
• Saudi Arabia. SAMA’s Counter-Fraud Framework sets a required maturity for fraud prevention, detection and response, with full compliance due by 29 June 2023.¹⁶

What the regimes have in common

1. Duties are set in advance. Cooling-off after a new device, real-time surveillance, stronger authentication and mule detection.
2. The firm pays when it misses them. So it has to show what its controls saw and did, transaction by transaction.
3. Real-time rails leave little time. A payment settles in seconds, so prevention has to happen before it leaves.
4. Blanket friction is the fallback. When nobody can tell which session is at risk, everyone is slowed down. RBI’s April 2026 discussion paper floats a one-hour hold on digital payments of ₹10,000 or more; it is not final.¹⁷

What it means for a bank’s controls

The rule map tracks six controls across seven markets, from binding the customer to their phone to keeping the records that show what the bank did. Each market page lists its dated rules, with their status, and the DeepID modules that support each control.

DeepID checks every login, new payee and payment against what was bound at sign-up and returns one decision with reasons, logged with the message the customer saw. DeepID supports compliance and never guarantees it.

Start with the rule map, or with a free retrospective that shows the payee and mule links in your own closed cases.

Sources

Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.

1. Payment Systems Regulator (opens in a new tab), Oct 2025One year on: the impact of APP reimbursement on victims
2. UK Finance (opens in a new tab), Jun 2026Annual Fraud Report 2026
3. MAS and IMDA (opens in a new tab), Oct 2024Response to consultation on the Shared Responsibility Framework
4. MHA Singapore (opens in a new tab), 2026Restriction orders issued under the Protection from Scams Act 2025
5. MAS (opens in a new tab), Feb 2026Written reply to parliamentary questions on the SRF and fraud surveillance
6. Malaya Business Insight (opens in a new tab), 2025, press reportAnti-financial scam law’s IRR to take effect June 25: BSP
7. GMA News (opens in a new tab), 2025, press reportNo more SMS, email OTPs for high-risk financial transactions
8. Manila Bulletin (opens in a new tab), Jul 2026, press reportBanks now forced to reimburse victims of online account fraud
9. RBI (opens in a new tab), Jun 2026Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027
10. MediaNama (opens in a new tab), Jun 2026, press reportRBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027
11. RBI (opens in a new tab), Jul 2017Customer protection: limiting liability of customers in unauthorised electronic banking transactions
12. Federal Register of Legislation (opens in a new tab), Feb 2025Scams Prevention Framework Act 2025, as made
13. ACCC (opens in a new tab), as of Oct 2026Scams Prevention Framework
14. RinggitPlus (opens in a new tab), 2022, press reportBNM announces five additional safeguards against financial scams, including migrating from SMS OTP
15. Gulf News (opens in a new tab), 2025, press reportNew rule: UAE banks to stop sending OTPs via SMS and email from July 25
16. SAMA (opens in a new tab), Oct 2022SAMA Rulebook: Counter-Fraud Framework
17. The Paypers (opens in a new tab), Apr 2026, press reportRBI proposes transaction delays and senior-citizen protections to combat digital payment fraud