Singapore to ban NRIC banking authentication amidst identity fraud risks

Banks must stop using NRIC numbers for verification by January 2027 under MAS, PDPC rules.

Singapore banks are phasing out the use of NRIC numbers for authentication, in line with new guidance from the Personal Data Protection Commission (PDPC) and the Monetary Authority of Singapore (MAS).

The Association of Banks in Singapore (ABS) said banks are aligning with a PDPC advisory requiring organisations to cease using NRIC numbers for authentication by 1 January 2027.

ABS director Ong-Ang Ai Boon said NRIC numbers cannot be used on their own to carry out financial transactions such as payments or fund transfers, which already require multi-factor authentication.

Most banks have already stopped using NRIC numbers for non-transactional authentication, including opening encrypted email attachments. Banks that still rely on NRIC numbers for such purposes are expected to shift to alternative methods in the coming months.

In its advisory, the PDPC said NRIC numbers were designed for identification, not authentication, and their use as verification credentials increases the risk of identity fraud if the information is exposed.

Organisations are expected to adopt stronger authentication measures, such as passwords, one-time passwords, or multi-factor authentication, instead of NRIC numbers.