Fraudulent Bank Websites and E-mails

The Hong Kong Monetary Authority (HKMA) wishes to alert members of the public to the growing number of reports received from customers, banks and the Police about suspected fraudulent bank websites and e-mails. The HKMA also draws the public's attention to the announcement this afternoon by the Hong Kong Police Force about the smashing of a "phishing" syndicate suspected of having deceived customers of a bank in Hong Kong. "Phishing" is a form of fraud in which the victims receive fake e-mails allegedly sent from banks asking them to provide sensitive personal and account information to a fake bank website accessed through a link embedded in the e-mail.

"Millions of phishing e-mails are sent out worldwide by criminals every day with the aim of duping unsuspecting members of the public," an HKMA spokesperson said. "Members of the public should exercise the highest degree of caution in handling e-mails that purport to come from banks. On no account should they access bank websites through links embedded in e-mails," the spokesperson said. "No bona fide bank in Hong Kong will ask you to access its website through an e-mail link, and any e-mail asking you to do this should be treated with suspicion," the spokesperson advised bank customers.

Customers who receive suspicious e-mails of this kind are advised to report them immediately to their bank, the Hong Kong Police Force, and the HKMA. Suspicious e-mails should be forwarded to the HKMA at hkma@hkma.gov.hk.

The HKMA takes this opportunity to remind bank customers that they should never access their accounts through Internet search engines, pop-up windows, or other doubtful channels. Customers using Internet banking should connect to their bank website either through typing the website address in the address bar of the browser or by bookmarking the genuine website and using that for access. Further information and advice on Internet banking safety may be found on the HKMA website www.hkma.gov.hk and on the websites of most banks.

The HKMA has, together with the Hong Kong Police Force and the Hong Kong Association of Banks, been conducting an intensive multi-channel campaign to educate bank customers about Internet safety. In September 2004 the HKMA issued a circular to banks emphasising the importance of measures against Internet fraud: in particular, banks are reminded not to send e-mails to customers with embedded links to transactional websites.

The HKMA also expects banks to implement two-factor authentication for high-risk retail Internet banking transactions by the middle of 2005. Under this arrangement, banks will adopt a second factor, in addition to the password as the basic factor of authentication, for customer authentication. Examples of second-factor authentication include digital certificates, one-time passwords generated by a security device, and SMS-based one-time passwords.

For further enquiries, please contact:
Jasmin Fung, Manager (Press), at 2878 8246 or
Thomas Chan, Senior Manager (Press), at 2878 1480

Hong Kong Monetary Authority
7 October 2004