Faulty access-control servers took DBS digital banking down for two days

On 23 November 2021 Singapore's DBS Bank lost digital banking services including PayNow to a fault in its access-control servers — the layer that handles logins and payment verification via biometrics, authentication tokens and one-time passwords. Services were restored around 2 a.m. on 24 November, then the same problem recurred at about 9 a.m., leaving the website and mobile app inaccessible into the night.

It was DBS's worst disruption since 2010, when a major systems failure took down all consumer and business banking for about seven hours. The Monetary Authority of Singapore said it expected a thorough investigation into root causes and would 'consider appropriate supervisory actions', noting rules that cap unscheduled downtime for critical systems at four hours within any 12-month period and require banks to report incidents within an hour.

DBS country manager Shee Tse Koon apologised in a Facebook video and assured customers deposits were safe, with branches and phone banking still working. Customers described failed PayNow payments to suppliers and cancelled care bookings. The bank also debunked rumours linking the outage to the sale of Myanmar treasury bonds.

Digital banking, PayNow and website down across 23-24 Nov 2021; ATM withdrawals, card payments and PayLah! partly hit; MAS weighing supervisory action

Login and payment verification both ran through the access-control servers, so one fault disabled every digital channel at once.

The fix that restored service at 2 a.m. failed within hours, showing the root cause had not been isolated before restoration was declared complete.

Customers had no in-app fallback for PayNow-dependent payments that small traders and families rely on daily.

The disruption exceeded MAS's four-hour downtime expectation for critical systems within a 12-month period.

Authentication is a chokepoint: when login and payment verification share one fragile server layer, one fault takes every digital channel down — and regulators treat it as a breach.

DBS said digital services were 'returning to normal' by 10:35 p.m. on 24 November. MAS said it would decide on supervisory action after DBS's investigation; the bank apologised and pledged remedial measures.