HKMA Issues Scam Alert Covering Five Hong Kong Banks

Key Takeaways

• The HKMA has issued a public alert regarding fraudulent websites, phishing emails, and spoofed internet banking login screens impersonating five Hong Kong banks: Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank, Chiyu Banking Corporation, and Ele Bank.
• Compliance teams should note this as part of an ongoing pattern of scam activity targeting the banking sector and ensure customer communication and fraud response protocols remain current.

Deep Dive

This press release is part of the HKMA's routine public awareness function, aggregating individual bank scam disclosures into a single consolidated alert. While it does not introduce new regulatory requirements, it signals continued and active targeting of Hong Kong's banking sector by fraudsters using fake websites, spoofed login portals, and phishing emails. For compliance and fraud risk teams at affected or similarly situated institutions, this underscores the need for robust digital brand protection, takedown procedures for fraudulent domains, and real-time monitoring of phishing campaigns referencing their institution's name or branding.

The HKMA reiterates a key consumer protection message: legitimate banks will not send SMS or emails containing embedded hyperlinks directing customers to transact, nor will they request sensitive credentials (login passwords, One-Time Passwords) via phone, email, or SMS. This serves as a reminder for compliance teams to audit their own institution's customer communication practices to ensure strict adherence to this standard, as any deviation could inadvertently legitimize similar scam tactics or create confusion among customers.

No specific deadlines are imposed by this alert, as it is informational rather than a directive requiring remediation by a set date. However, affected banks should continue to monitor for recurrence of phishing infrastructure, maintain updated customer-facing alerts and FAQs, and coordinate with the HKMA and Hong Kong Police Force's Crime Wing Information Centre for reporting and takedown of fraudulent sites.

Recommended actions for compliance professionals across the sector include: (1) reviewing and reinforcing internal protocols for identifying and escalating phishing/scam incidents; (2) ensuring customer education materials align with HKMA guidance on legitimate communication practices; (3) coordinating with IT security and legal teams on domain monitoring and takedown procedures; and (4) tracking HKMA scam alerts on an ongoing basis to identify emerging fraud trends relevant to the broader industry, even if the institution is not directly named. The reputational and operational risk from unresolved scam activity—including potential customer financial loss and erosion of trust in digital banking channels—remains the primary concern, though the direct regulatory/compliance burden from this specific alert is low.

Source: Hong Kong Monetary Authority