The HKMA has issued a scam alert on fraudulent websites and login screens for three banks. Lenders should review their own phishing defences and customer warnings.
On September 4, 2026, the Hong Kong Monetary Authority (HKMA) issued a scam alert in relation to three banks: The Bank of East Asia, Shanghai Commercial Bank, and OCBC Bank (Hong Kong). The alert covers fraudulent websites and internet banking login screens that have been reported to the HKMA. The HKMA reminds the public that banks will not send SMS or emails with embedded hyperlinks directing customers to bank websites to carry out transactions, nor will they ask for sensitive information such as login passwords or one-time passwords by phone, email, or SMS.
For licensed money lenders, this alert is a reminder that phishing and fraudulent websites are not limited to banks. Lenders should be aware that fraudsters may imitate their brand in similar ways, creating fake websites or sending messages that appear to be from the lender. While the HKMA alert specifically addresses banks, the operational lesson applies broadly: customers can be tricked into revealing personal data or making payments to fraudulent accounts.
Lenders should review their own communication practices. If your firm sends SMS or emails to customers, ensure that any links are clearly explained and that customers are educated to verify the authenticity of messages. The HKMA's warning that banks will not ask for passwords or OTPs via embedded links is a standard that customers may expect from all financial institutions. Consider aligning your own customer communications with this expectation to reduce confusion and fraud risk.
The alert also highlights the importance of reporting scams to the police. The HKMA directs affected individuals to contact the relevant bank and report to the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012. Lenders who become aware of phishing attempts against their own brand should consider similar reporting channels and may wish to alert customers promptly.
This is a general scam alert, not a new regulation. It does not change any legal obligations under the Money Lenders Ordinance or other laws. However, it serves as a practical reminder to maintain robust cybersecurity measures and customer awareness programmes, particularly as fraudsters increasingly target financial services users.
Covenant Desk publishes regulatory context for Hong Kong lending operations, not legal advice. Confirm how anything here applies to your licence with your own advisers.