Six Hong Kong banks hit by fake login pages and phishing in one week

According to the Hong Kong Monetary Authority, six banks in Hong Kong have reported fraudulent websites, fake login screens, phishing emails or phishing instant messages within the same alert. The banks are Bank of China (Hong Kong), DBS Bank (Hong Kong), The Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank and Chiyu Banking Corporation.

Each bank found a different version of the same trick. Bank of China customers were reached through phishing instant messages. DBS customers were reached through phishing emails. The other four banks, Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank and Chiyu Banking, each had fraudulent websites and fake internet banking login screens built to look like their own.

How the approach works

The message arrives first, by SMS, email or instant messenger, carrying a link. The link opens a page that copies the bank's real login screen closely enough to pass a quick glance. The customer types in a username and password, believing they are logging into their own account. That single action hands the details straight to whoever built the page.

What ties all six cases together is the moment the scam depends on: a customer clicking a link inside a message and typing a password on the page that opens. Everything before that, the message, the fake site, the copied login screen, is just staging. The scam only succeeds at the point of that one click and that one password entry.

The HKMA states plainly that no genuine bank will send an SMS or email with an embedded link asking a customer to carry out a transaction. No genuine bank will ask for a login password or a one-time password by phone, email or SMS, including through a link in a message. That single fact covers every version of the scam listed, phishing instant messages, phishing emails, fake websites and fake login screens alike. If a message asks for a password or pushes a link to log in and do something urgent, it did not come from the bank.

What to do

Anyone who has entered personal information or carried out a transaction through one of these fake pages should contact the relevant bank directly, using the contact details given in that bank's own press release rather than anything in the suspicious message. The matter should also be reported to the Crime Wing Information Centre of the Hong Kong Police Force, on 2860 5012.

The tell is the same across all six banks. A real bank does not need a link in a text message to get a customer to log in, and it never needs a password read back to it. The scam only works if that distinction gets missed in the moment.