Internet banking can be safe, reliable and convenient so long as banks and customers take the appropriate security precautions.
Readers may be aware that banks in Hong Kong and the HKMA have been putting out more frequent alerts on fraudulent bank websites and e-mails recently. The HKMA alone has issued a total of 23 press releases and circulars relating to fraudulent bank websites so far this year. This is almost three times the number in the whole of 2003.
We have also been receiving a growing number of reports from the public about the problem: so far this year around 1,000 suspicious e-mails have been forwarded to the HKMA. We are always grateful for such information, and we hope that members of the public will continue to forward any suspicious messages purporting to be from banks to ourselves, the Police, and to the banks concerned. We are also aware that fraudulent bank websites and e-mails are getting more sophisticated. In the latest cases, a number of quite convincing-looking e-mails have requested bank customers to access fake bank websites through embedded hyperlinks, and then type in sensitive personal and bank account information such as Internet banking login name and password. This is what the banking industry calls "phishing". Earlier this month the Hong Kong Police Force announced that it had smashed a "phishing" syndicate suspected of having deceived bank customers in Hong Kong. The Police should be commended for this swift action. But we should also take heed that Hong Kong has now become a victim to this worldwide problem. This is part of an international trend, and although Hong Kong has not been as badly hit as some other economies, we should be on the alert.
Some of the fake websites display genuine logos and branding material and use a domain name close to the real thing. We have also received reports that some of them display an exact replica of a bank website with the actual bank website address on the address bar. It therefore becomes very difficult for a bank customer to distinguish a fake website from a genuine one.
To combat this crime, the banking industry, the Police and the HKMA have jointly launched since 2003 a continuous multi-channel consumer education programme on Internet banking safety, through the mass media and through educational leaflets, and, most importantly, through the banks themselves. In September 2004, we issued a circular to banks in Hong Kong to reiterate the importance of having appropriate precautionary measures in place. In particular, banks are reminded not to send e-mails to customers with embedded hyperlinks to transactional websites and speed up the implementation of two-factor authentication for high-risk retail Internet banking transactions. They should also inform their customers direct of the need for pre-cautionary measures (e.g. on monthly statements), and display alert messages prominently on their transactional websites. Above all, they should make it clear that neither they nor their agents or partners would ever ask their customers to provide sensitive personal and account details through an embedded link sent out by e-mail.
To help readers avoid falling victim to phishing, I would like to repeat a few useful tips I mentioned in an earlier viewpoint article published on 15 July 2004.
Bank customers should never access their accounts through hyperlinks embedded in e-mails, Internet search engines, suspicious pop-up windows, or other doubtful channels. Customers using Internet banking should connect to their bank website either through typing the website address in the address bar of the browser or by bookmaking the genuine website and using that for access. Customers should also change their passwords periodically and not use simple passwords. Further information and advice on Internet banking safety may be found on the HKMA website www.hkma.gov.hk and on the websites of most banks.
Banks in Hong Kong have been making good technological progress in strengthening security controls of their Internet banking services, particularly through the deployment of two-factor authentication. Customers are strongly advised to make use of the additional authentication for Internet banking services as soon as it is in place. So long as both bank customers and banks have taken appropriate security precautions, Internet banking services are safe to use.
Joseph Yam
21 October 2004
Related Press Release:
Related Circular:
Related Information:
Click here for previous articles in this column.
Document in Word format
