News
The Hong Kong Monetary Authority says a bogus HKICL lookalike site lures FPS users with cash rewards to harvest ID photos and bank account details.
Reported by
Hong Kong Monetary AuthorityAccording to the Hong Kong Monetary Authority, a fraudulent website has been posing as Hong Kong Interbank Clearing Limited, the company that runs the FPS payment system used across Hong Kong. The site copies HKICL's identity and offers to protect buyers who made an FPS payment.
The bait is a refund. The fake site calls itself "Buyer Online Protection" and offers three things: a refund to the buyer, a way to report an unauthorised online transaction, and support for an online transaction. Anyone who has made an FPS payment and worried about it going wrong is the target.
The scam works in stages, and each stage extracts something different. First it asks for a personal document number and an ID photo, along with a phone number, framed as "real name verification" needed to unlock a cash reward. That is a full identity kit handed over voluntarily, because it is presented as the price of getting money back, not the price of losing it.
Once that trust is established, the site asks for more: a bank name, account number, and the account holder's name. It frames this as topping up and withdrawing from a virtual wallet inside its own platform, using FPS. In reality this hands over the exact details needed to move money out of a real bank account.
If a user hesitates or asks questions, the site does not leave them stuck. It connects them to a person impersonating HKICL customer service, who can talk them through the remaining steps. The scam depends on that handoff. The website alone collects data; the fake customer service agent closes the loop and reassures the user through the parts where they might otherwise stop.
HKICL does not contact individual members of the public proactively under usual circumstances, and it does not provide FPS services directly to individuals. Its genuine websites are www.hkicl.com.hk and fps.hkicl.com.hk. Any offer of a refund, a reward, or a support case that starts on a different domain has already broken the first rule of how HKICL actually operates.
The tell sits earlier than most people look for it. It is not in the payment details asked for near the end. It is in the very first request, an ID photo and document number offered in exchange for a reward, before any real transaction dispute has been verified by anyone official.
Anyone who receives a suspicious call, website, or message claiming to be from HKICL can call HKICL's general line, 2533 1111, to check. Anyone who believes they have already been caught out should report it to the police promptly.