HKMA Issues Scam Alert on Fraudulent Websites and Login Screens Targeting Four Banks

Key Takeaways

• The HKMA has alerted the public to fraudulent websites and internet banking login screens impersonating four Hong Kong banks: The Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank, and Fubon Bank (Hong Kong).
• The alert restates that banks do not send SMS or emails with embedded hyperlinks for transactions and do not request sensitive credentials.
• Compliance teams should treat it as a prompt to review fraud controls, customer communications, and incident response procedures.

Deep Dive

The HKMA has alerted the public to fraudulent websites and internet banking login screens impersonating four Hong Kong banks: The Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank, and Fubon Bank (Hong Kong). The alert restates that banks do not send SMS or emails with embedded hyperlinks for transactions and do not request sensitive credentials. Compliance teams should treat it as a prompt to review fraud controls, customer communications, and incident response procedures.

The notice introduces no new obligations or deadlines, but it reinforces existing expectations. Banks should not send SMS or emails with embedded hyperlinks directing customers to transact, and should not ask for passwords or One-Time Passwords by phone, email, or SMS. Victims are directed to contact their bank and report to the Hong Kong Police Force Crime Wing Information Centre at 2860 5012. No effective dates apply. The notice is dated 15 September 2026, and its guidance applies immediately.

For compliance teams, including those at institutions not named, the notice is a useful benchmark. Teams should confirm that customer communications comply with the no-embedded-hyperlink standard, that scam warning content is current across channels, and that staff and call center scripts never request OTPs or passwords. Teams should also verify that threat intelligence and brand-monitoring processes can detect lookalike domains and fake login pages quickly, and that takedown procedures with registrars, hosting providers, and relevant authorities are documented and tested.

Recommended actions include reviewing the incident response playbook for phishing and impersonation events, including escalation to the HKMA, notification to customers, and coordination with law enforcement. Institutions should also check that fraud monitoring can flag suspicious logins and transactions following credential compromise, and that customer education campaigns reflect the HKMA's messages. Maintain records of the review as evidence of an effective control environment.

The risk implications are primarily consumer harm, reputational damage, and operational and fraud losses. Failure to respond promptly to impersonation incidents may attract supervisory scrutiny regarding fraud risk management, technology and cyber resilience, and fair treatment of customers. Although the notice carries low direct regulatory impact, repeated incidents across the sector suggest continued supervisory focus on anti-scam measures.

Source: Hong Kong Monetary Authority