HKMA alerts public to bank-related phishing and scam websites
HKMA issued a public alert regarding fraudulent websites, phishing emails and scams impersonating a licensed bank.
HKMA flagged fraudulent websites and phishing campaigns targeting bank customers. It reiterated that banks do not send SMS or emails with embedded hyperlinks for transactions. Signals continued elevated impersonation risk in Hong Kong retail banking channels.
Heightened phishing activity increases conduct, operational, and reputational risk exposures for retail banks operating in Hong Kong.
Action Required
Review customer fraud controls, phishing detection, and external communications policies; reinforce customer education on impersonation scams.
Recurring HKMA scam alerts indicate sustained fraud pressure requiring continuous control reassessment.
Fraud and cyber risk remains elevated following HKMA scam alert. Controls over phishing detection, customer authentication, and brand monitoring should be reassessed; customer awareness messaging should be refreshed.
“The HKMA alerts the public to a press release from a bank concerning fraudulent websites, phishing emails and other scams, reminding that banks do not send SMS or emails with embedded hyperlinks directing customers to transact.”
Published: 2026-05-28