Broad bank freezes cut scams but block rent payroll and medical payments too

ManageEngine and Okta say banks hardening identity controls with behavioural analytics is more effective than defaulting to freezes.

Banks in Asia are gaining stronger intervention powers to fight scams, but experts warn that broad account freezes and silent controls could damage customer trust if they are not tied closely to risk.

Subhalakshmi Ganapathy, Chief IT Security Evangelist at ManageEngine, said banks should treat fraud prevention as a duty of care rather than a default restriction on customers’ access to their money.

“Customers' money is theirs, and they have the right to move it,” Ganapathy said. “The bank's job is a duty of care, not control.”

She said protection should be invisible when risk is low and more assertive when warning signs appear, such as a new payee, unusual transfer amount, suspicious session or possible account compromise. Customers should also know why a control has been triggered and have a fast way to verify or override it.

Dan Mountstephen, Senior Vice President and General Manager for Asia Pacific and Japan at Okta, said fraud risks in Asia are rising, including one-time password hijacking, phishing, SMS phishing and social engineering. He said banks need to move from one-time login checks to continuous authentication based on risk signals.

Account freezes and transaction delays can stop scams, but Ganapathy said they work differently. Delays and cooling-off periods can disrupt authorised push payment scams by breaking manufactured urgency. Freezes can stop money leaving an account, but they can also block rent, payroll or medical payments if applied too broadly.

For Mountstephen, freezes are often downstream measures. Banks should instead harden identity controls earlier through phishing-resistant multi-factor authentication, behavioural analytics and step-up checks when activity looks unusual.

The same principle applies to regulation. Wider bank intervention powers may help stop scams, but broad blocking can create false positives and slow resolution for legitimate customers.

For banks, the test is whether they can stop fraud before money moves without treating ordinary customers as suspects.