MAS is testing new and upgraded physical tokens as an extra layer of protection for online banking
Physical banking tokens might be making a comeback in Singapore—but this time, they’re smarter and more secure than before.
The Monetary Authority of Singapore (MAS) is currently testing a new layer of protection: a Fast IDentity Online (Fido) hardware token for online banking. Essentially, it resembles a small device, like a USB stick or Bluetooth key.
Unlike earlier physical tokens from the 2000s, which required users to generate one-time passwords (OTPs) manually, Fido tokens use unique, cryptographic key pairs to authenticate users. One key stays on the token, while the matching key is held by the bank.
When you log in or make a transaction, you plug it in or tap it to confirm your identity. You won’t need to copy SMS codes anymore—the token uses encryption to verify that it’s really you. Even if a scammer knows your password, they still can’t access your account without the physical token in hand.
Each Fido device can also store multiple keys, meaning you wouldn’t need separate tokens for different banks.
MAS and the Association of Banks in Singapore are still in the testing phase, gathering feedback from focus groups and surveys. They are considering user journeys and adoption challenges before finalising the scope and timing of any rollout.
But if it does get approved, Singapore could become one of the first countries to implement Fido tokens nationwide.
Scams are getting smarter
The push for hardware tokens comes as scams continue to evolve—they’re getting smarter and harder to detect, especially as digital transactions become more common.
Cybercriminals are exploiting new vulnerabilities, increasingly using artificial intelligence (AI) to deceive victims.
AI is now being used to generate highly convincing phishing attempts, including deepfake audio and video impersonation, realistic scam messages, and fake websites that are almost indistinguishable from the real thing.
In the first half of 2025 alone, losses from phishing scams in Singapore exceeded S$30 million, a 134% jump from S$13 million in the same period in 2024.
Police reported 3,779 cases, with many victims unknowingly submitting their card details and authentication codes to scammers while attempting to complete what appeared to be legitimate transactions.
Amid this surge in scams, public anxiety is rising too. A 2025 YouGov study across 17 markets found 72% of Singaporeans fear falling for financial phishing scams—the highest among all countries surveyed.
Could the Fido tokens reshape how S’pore protects its money?
MAS has worked with banks to tighten security over the past few years, rolling out multiple layers of safeguards to keep ahead of scammers. They’ve introduced measures like account freeze functions, money-lock features, and app safeguards against risky activity.
Its latest move is the introduction of the Fido physical tokens. At first glance, it might seem like a step backward in an age of digital banking. After all, Singapore moved from physical tokens to digital ones because the older devices were inconvenient, usage had declined, and more secure digital alternatives became available.
But even if the Fido tokens add a small layer of friction, the goal isn’t to make banking harder—it’s to make it safer. With scams becoming more sophisticated, the extra protection helps ensure that even if a password is compromised, accounts remain secure.
Yet, there are still concerns.
Setting them up could be confusing, especially for users who aren’t tech-savvy. For example, registering a token may require downloading apps, connecting it to a phone or computer, setting a PIN, and registering fingerprints—processes that can involve more than a dozen steps.
It’ll also cost more to roll out. Basic Fido tokens can range from US$29 to US$90, depending on features like fingerprint readers. Recovery procedures for lost or stolen tokens can be cumbersome, requiring users to deactivate them across every service linked to the device. Support is unclear, too—there’s no universal helpdesk, meaning banks may need to field millions of queries.
And unless every bank adopts it, scammers could still find weaker links to target.
For now, as the Fido tokens remain experimental, it’s too early to know exactly how the rollout will unfold. But they represent a solid extra barrier for account security, and could reshape how Singapore protects its money in the digital age.
- Read other articles we’ve written on Singapore’s current affairs here.
Featured Image Credit: Andy Quek via Facebook/ Thales