The Hong Kong Monetary Authority (HKMA) wishes to alert members
of the public to the growing number of reports received from
customers, banks and the Police about suspected fraudulent bank
websites and e-mails. The HKMA also draws the public's attention to
the announcement this afternoon by the Hong Kong Police Force about
the smashing of a "phishing" syndicate suspected of having deceived
customers of a bank in Hong Kong. "Phishing" is a form of fraud in
which the victims receive fake e-mails allegedly sent from banks
asking them to provide sensitive personal and account information
to a fake bank website accessed through a link embedded in the
e-mail.
"Millions of phishing e-mails are sent out worldwide by
criminals every day with the aim of duping unsuspecting members of
the public," an HKMA spokesperson said. "Members of the public
should exercise the highest degree of caution in handling e-mails
that purport to come from banks. On no account should they access
bank websites through links embedded in e-mails," the spokesperson
said. "No bona fide bank in Hong Kong will ask you to access its
website through an e-mail link, and any e-mail asking you to do
this should be treated with suspicion," the spokesperson advised
bank customers.
Customers who receive suspicious e-mails of this kind are
advised to report them immediately to their bank, the Hong Kong
Police Force, and the HKMA. Suspicious e-mails should be forwarded
to the HKMA at hkma@hkma.gov.hk.
The HKMA takes this opportunity to remind bank customers that
they should never access their accounts through Internet search
engines, pop-up windows, or other doubtful channels. Customers
using Internet banking should connect to their bank website either
through typing the website address in the address bar of the
browser or by bookmarking the genuine website and using that for
access. Further information and advice on Internet banking safety
may be found on the HKMA website www.hkma.gov.hk and on the
websites of most banks.
The HKMA has, together with the Hong Kong Police Force and the
Hong Kong Association of Banks, been conducting an intensive
multi-channel campaign to educate bank customers about Internet
safety. In September 2004 the HKMA issued a circular to banks
emphasising the importance of measures against Internet fraud: in
particular, banks are reminded not to send e-mails to customers
with embedded links to transactional websites.
The HKMA also expects banks to implement two-factor
authentication for high-risk retail Internet banking transactions
by the middle of 2005. Under this arrangement, banks will adopt a
second factor, in addition to the password as the basic factor of
authentication, for customer authentication. Examples of
second-factor authentication include digital certificates, one-time
passwords generated by a security device, and SMS-based one-time
passwords.
For further enquiries, please contact:
Jasmin Fung, Manager (Press), at 2878 8246 or
Thomas Chan, Senior Manager (Press), at 2878 1480
Hong Kong Monetary Authority
7 October 2004
