How fake bank sites and login pages trick HK bank customers

According to the Hong Kong Monetary Authority, two banks have reported scams built around fake login pages and a fake social media account. Chong Hing Bank Limited reported a fraudulent social media account. OCBC Bank (Hong Kong) Limited reported fraudulent websites and fake internet banking login screens.

The HKMA has posted alerts on its website with hyperlinks to each bank's own press release describing the specific scam reported.

How the login page trick works

A fraudulent website is built to look like a bank's real site. It often carries a fake internet banking login screen. A customer who lands on it, through a search result, a social media link or a message, types in their login details as normal. Those details go straight to the scammer, not the bank.

The fraudulent social media account works differently. It is set up to look like it belongs to Chong Hing Bank Limited. Anyone who follows it, messages it or trusts its posts is dealing with an impersonator, not the bank.

The step the scam depends on

Both versions depend on the same moment: a customer treating something that looks official as if it were verified. A login page that looks right is not the same as a login page that is right. A social media account with the bank's name and logo is not the same as the bank itself. The scam only works if that gap goes unnoticed.

What the HKMA says banks will never do

The HKMA states plainly that banks will not send SMS messages or emails containing embedded hyperlinks that direct customers to the bank's website to carry out transactions. Banks will also not ask for sensitive information, such as login passwords or one-time passwords, by phone, email or SMS, including through embedded links. Any message that does either of those things is not from the bank, regardless of how convincing it looks.

What to do

Anyone who has entered personal information or carried out a financial transaction through one of these fraudulent sites or accounts should contact the relevant bank directly, using the contact details given in that bank's own press release. The matter should also be reported to the Crime Wing Information Centre of the Hong Kong Police Force, on 2860 5012.

The safest way to reach a bank's internet banking page is to type the bank's known web address directly into a browser, rather than following a link sent by message or found through a social media post.