The Hong Kong Monetary Authority (HKMA) has issued a public alert regarding a coordinated wave of cyber fraud targeting major banks across the territory. Six financial institutions have reported increased scam activity involving phishing emails, fraudulent websites, compromised login screens, and deceptive instant messages, the HKMA announced on September 3, 2026.
- Affected Banks: Bank of China (Hong Kong) Limited, DBS Bank (Hong Kong) Limited, The Bank of East Asia Limited, Shanghai Commercial Bank Limited, Chong Hing Bank Limited, and Chiyu Banking Corporation Limited
- Primary Scam Types: Phishing instant messages, phishing emails, fraudulent websites, and counterfeit internet banking login screens
- Information Targeted: Login passwords, One-Time Passwords, and sensitive personal data
Bank of China (Hong Kong) Limited reported phishing instant messages, while DBS Bank (Hong Kong) Limited flagged phishing emails. The remaining four institutions, The Bank of East Asia Limited, Shanghai Commercial Bank Limited, Chong Hing Bank Limited, and Chiyu Banking Corporation Limited, each reported fraudulent websites and spoofed internet banking login screens designed to capture customer credentials.
Banks will not send SMS or emails with embedded hyperlinks which direct them to the banks’ websites to carry out transactions. They will not ask customers for sensitive information, such as login passwords or One-Time Password, by phone, email or SMS (including via embedded hyperlinks).
The HKMA has advised customers who may have fallen victim to these scams to immediately contact their respective bank using official contact information from the bank’s verified press release. Victims should also file a report with the Hong Kong Police Force Crime Wing Information Centre at 2860 5012. The regulator emphasized that legitimate banks never request sensitive authentication credentials through unsecured channels or ask customers to click embedded links to conduct transactions.
