What Changed
- HKMA notified the public of reported fraudulent websites and login screens affecting seven banks operating in Hong Kong SAR.
- The HKMA clarified regulatory standards, reiterating that banks will not send SMS or emails with transaction links or request sensitive credentials like passwords or OTPs.
- Individuals who disclosed information or conducted transactions via these scams were urged to contact their bank and report to the Hong Kong Police Force.
The Hong Kong Monetary Authority (HKMA) issued an official public scam alert on October 12, 2026, warning members of the public against fraudulent websites, unauthorized internet banking login screens, phishing emails, and related scams targeting seven financial institutions in Hong Kong SAR.
The banks affected by these reported fraudulent activities comprise The Bank of East Asia, Limited; Shanghai Commercial Bank Limited; Chong Hing Bank Limited; Chiyu Banking Corporation Limited; OCBC Bank (Hong Kong) Limited; Bank of Singapore Limited; and China Construction Bank (Asia) Corporation Limited. According to the regulatory notice, all seven institutions reported incidents involving fraudulent websites and internet banking login screens, with direct hyperlinks to individual bank press releases made available on the HKMA website.
In response to the identified security threats, the HKMA issued specific reminders to banking customers and the general public regarding standard banking security practices. First, legitimate banks operating in Hong Kong SAR will not send SMS messages or emails containing embedded hyperlinks directing customers to bank websites to carry out financial transactions. Second, banking institutions will never solicit sensitive customer information—such as account login passwords or One-Time Passwords (OTPs)—by phone, email, or SMS, including via embedded hyperlinks.
The HKMA advised any individual who has provided personal information or conducted financial transactions through or in response to these reported scams to take immediate action. Affected individuals should contact the relevant bank using the contact information provided in the corresponding bank press release and report the incident directly to the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012.
Who May Be Affected
Bank customers, members of the public, and financial institutions operating in or conducting transactions through Hong Kong SAR.
Cross-Border Context
Mainland Chinese and international customers, businesses, and investors utilizing Hong Kong SAR's banking channels.
What to check next
- Review the specific bank press releases hyperlinked on the official HKMA website.
- Verify official contact details for the seven named banking institutions prior to reporting potential disclosures.
- Contact the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012 if victimized by phishing scams.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.