Hong Kong clearing house warns of fake “crypto wallet” websites stealing IDs and bank details
Hong Kong Interbank Clearing Limited (HKICL) has uncovered multiple counterfeit websites masquerading as the clearing house and luring users with cash rewards and “Buyer Online Security Protection” offers — a scam that harvests personal and banking data and pushes victims into virtual-wallet transactions via the Faster Payment System (FPS).
What the scam does
- Fraud sites pose as HKICL and advertise fake real-name verification or refund/transaction-support services.
- Victims are asked to submit Hong Kong ID numbers and photos, phone numbers, bank account details and account-holder names in return for promised cash rewards.
- Targets are then directed to deposit or withdraw funds through virtual wallets using FPS and urged to chat with bogus customer-service agents to complete the scheme.
HKICL response and guidance
- HKICL says the sites have no connection to the company and stresses it does not provide FPS services directly to individual members of the public or proactively contact users about such services.
- Its official domains are hkicl.com.hk and fps.hkicl.com.hk; anyone receiving suspicious outreach claiming to be HKICL should verify via the organization’s official hotline (listed on its website) before sharing personal information.
- Anyone who believes they’ve been scammed should report the incident to the Hong Kong Police immediately.
Broader regulatory context
- The alert arrives as Hong Kong financial regulators tighten online-security rules around digital assets. The Securities and Futures Commission (SFC) this week mandated licensed virtual-asset trading platforms and online brokers replace SMS-based authentication with phishing-resistant login methods within 12 months.
- The SFC requires firms to stop relying on one-time passwords sent via SMS, email, or app codes, and to adopt stronger methods such as passkeys, cryptographically verified registered devices, hardware security keys and device binding to reduce phishing risks.
- The SFC has also been active against suspicious crypto operators: in June it added Aurum/Aurum Foundation to its Alert List after alleging the platform may have offered virtual-asset, futures and derivatives trading without the required authorization.
Why this matters
- The campaign underscores growing targeting of digital-asset users and payment channels by phishing operations, and regulators’ push to harden account security and crack down on unlicensed providers.
- Crypto users should verify websites and communications, avoid sharing ID or bank details in response to unsolicited offers, and use stronger, phishing-resistant authentication where possible.
Practical tips for readers
- Never provide HKID, ID photos or full banking details to platforms contacted via unsolicited messages.
- Check domain names carefully and use official sites (hkicl.com.hk / fps.hkicl.com.hk) or published hotlines to verify communications.
- Report suspicious sites or messages to the platform if possible, and to Hong Kong Police and relevant regulators if you suspect fraud.
- Move to phishing-resistant authentication methods (passkeys, hardware tokens, device binding) on exchanges and wallets where supported.
Taken together, recent enforcement and security rule changes signal heightened scrutiny in Hong Kong over both phishing scams and unlicensed crypto operations — and a clear message to users: verify sources and lock down authentication before sharing sensitive information or completing transactions.
Read more AI-generated news on: undefined/news
