HKICL Warns Public of Fraudulent Websites Impersonating FPS Services

Key Takeaways

• HKICL has identified multiple fraudulent websites impersonating its brand and Faster Payment System (FPS) services, using fake "Buyer Online Protection" schemes to steal personal data, banking credentials, and funds.
• Financial institutions should alert customers, strengthen fraud detection for FPS transactions, and ensure staff can direct affected customers to proper verification and reporting channels.

Deep Dive

This press release highlights an active phishing/impersonation scam targeting users of Hong Kong's Faster Payment System (FPS). Fraudulent websites (fpshkicl[.]courses, fpshkicl[.]garden, and hkrefundplatform[.]click) are posing as HKICL-affiliated "Buyer Online Protection" platforms, offering fake refund, dispute reporting, and transaction support services. The more sophisticated variant (Type 2) escalates the scheme by harvesting identity documents, ID photos, phone numbers, and banking details, and then redirecting victims to WhatsApp-based fraudsters posing as customer service agents—indicating a coordinated, multi-channel social engineering operation.

For compliance teams at banks and payment service providers, this is a customer protection and fraud risk issue requiring immediate attention. HKICL has clarified it does not operate retail-facing FPS platforms or proactively contact individual customers, meaning any communication claiming otherwise should be treated as fraudulent. Institutions offering FPS services should incorporate this alert into ongoing fraud awareness campaigns and transaction monitoring systems, particularly flagging unusual refund requests or account top-up/withdrawal patterns consistent with the scam's modus operandi.

No specific regulatory deadline is attached to this release, as it is an advisory rather than a binding rule change. However, compliance and fraud teams should treat it as time-sensitive given the active nature of the threat. Recommended actions include: (1) issuing customer-facing warnings via online banking portals, apps, and social media referencing the specific fraudulent URLs; (2) briefing customer service and fraud teams on the scam's characteristics to improve detection of victim reports; (3) reviewing AML/CFT monitoring rules for FPS transactions tied to "virtual wallet" top-ups or unusual refund patterns; and (4) coordinating with HKICL and the Hong Kong Police if customers report losses.

From a risk perspective, this incident underscores ongoing vulnerabilities in real-time payment systems to social engineering and phishing attacks. While HKICL itself bears no direct liability, participating banks face reputational, operational, and potential AML risks if customer funds are funneled through their accounts into fraudulent schemes. Proactive customer education and transaction surveillance are critical to mitigating these risks and maintaining trust in FPS as a payment rail.

Source: Hong Kong Monetary Authority