Scam interventions: warn, cool off, hold

Why six actions, not one

Rules written for everyone show the two ends of the problem. Singapore’s Shared Responsibility Framework asks banks for a 12-hour cooling-off after a new device or digital token is activated, during which high-risk activity is blocked.¹ RBI’s April 2026 discussion paper floats a one-hour hold on every digital payment of ₹10,000 or more; it is not final.² Both slow everyone down, because nobody can tell which session is at risk. Singapore’s central bank has said as much: telling deceived, self-authorised transfers apart from legitimate ones “is not an easy task even for sophisticated fraud detection systems”.³

A decision per session can do better. When the session shows a call, a shared screen or a payee tied to mule accounts, the bank can act on that session and leave the rest alone. The action should fit the risk: a warning where something is merely new, a hold where someone is plainly being coached. Most customers never notice.

The signals are real and platforms have noticed too. Android now warns when a banking app is opened during screen sharing with an unknown caller.⁴ In June 2025, Singapore Police warned about impersonation scams that walk people through transfers over a shared screen.⁵ Banking malware now inserts random pauses between keystrokes to pass as human, so behaviour is read with the call and the device, never alone.⁶

The six, in full

When each applies, the signals behind it, the words on the customer’s phone and the line your FRM receives. The customer lines are illustrative; the bank’s own words replace them.

1. Allow

   No call, no shared screen, a usual payee and a usual amount. Most payments end here, with no added friction.

   Signals

   Known device and bound SIMUsual payee and amountNo call or shared screen

   The customer reads

   “Payment sent.”

   The FRM receives

   ALLOW · known device · bound SIM · usual payee

2. Warn

   Something is unusual, such as a first-time payee, but nothing suggests the customer is being directed.

   Signals

   First-time payeeNo call or shared screen

   The customer reads

   “This payee is new to you. Check the name before you send.”

   The FRM receives

   WARN · first-time payee

3. Step up

   The phone or the SIM is new, so the bank needs to know it is the customer before anything else.

   Signals

   New device, or the SIM in a new phoneIdentity in doubt

   The customer reads

   “Confirm it’s you with a quick face check.”

   The FRM receives

   STEP_UP · new device · face check requested

4. Cool off

   A new payee or device, with signs that call for time to think but not yet for a conversation.

   Signals

   New payee or new deviceA large or round amount

   The customer reads

   “You can send up to the starter limit now. You get the full limit in 12 hours.”

   The FRM receives

   COOL_OFF · new device 4 min · limit applied

5. Hold

   Signs of coaching: an active call or shared screen, dictated typing, or a payee tied to mule accounts.

   Signals

   Active callShared screen or remote accessPayee linked to mules

   The customer reads

   “Payment paused. Your money hasn’t left your account. We’ll call you on +91 •••• 3210.”

   The FRM receives

   HOLD · active call · screen share · mule-linked payee

6. Block

   The attack is clear and the session cannot be trusted, so nothing is allowed through.

   Signals

   Virtual camera or emulatorKnown mule payee receiving from many unrelated senders

   The customer reads

   “We couldn’t verify this session. Your money is safe.”

   The FRM receives

   BLOCK · virtual camera · emulator

Writing for someone under pressure

A customer being coached is often frightened and in a hurry. The words matter as much as the hold.

1. Say what is happening. “We’ve paused this payment” is clearer than any risk language. The customer should know the state of their money in the first line.
2. Name the scam, not a generic risk. A standard warning on every payment is easy for a scammer to coach the customer past. A message that names the pattern in front of them is harder to ignore.
3. Give one clear action. End the call, check the payee, or wait for our call. Never three choices at once.
4. Keep the customer in charge. They can cancel at any time. A hold is protection, not an accusation.
5. Never blame the customer. People are targeted because scams work on everyone. The message should read as help.

When a block is right

A scam involves a genuine customer, so blocking them outright is rarely the right answer: it leaves them alone with the caller. A block is for the clear attack, such as a virtual camera or an emulator, or a payee that is a known mule account already receiving money from many unrelated senders. The customer then reads: “We couldn’t verify this session. Your money is safe.”

A hold is the usual answer to coaching. The money stays in the account, the bank calls back on the registered number, and the customer can cancel at any time.

Where DeepID fits

DeepID reads the session around every login, new payee and payment: the scam signals such as the call and the shared screen, the owner’s behaviour, device integrity and the payee graph. It returns one decision with its reasons to the app and to the FRM, and the app shows the customer the words for that action. Thresholds and actions are your policy, set per journey and market.

The guide to coached payments follows one session from the first call to the hold.

Sources

Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.

1. MAS and IMDA (opens in a new tab), Oct 2024Response to consultation on the Shared Responsibility Framework
2. The Paypers (opens in a new tab), Apr 2026, press reportRBI proposes transaction delays and senior-citizen protections to combat digital payment fraud
3. MAS (opens in a new tab), Feb 2026Written reply to parliamentary questions on the SRF and fraud surveillance
4. Google (opens in a new tab), May 2025What’s new in Android security and privacy in 2025
5. Singapore Police Force (opens in a new tab), Jun 2025Police advisory on impersonation scams involving the WhatsApp screen-sharing function
6. ThreatFabric (opens in a new tab), Oct 2025New Android malware Herodotus mimics human behaviour to evade detection