Unsolicited cash rewards almost always come with a hidden cost. Hong Kong Interbank Clearing Limited (HKICL) has demonstrated this once again: in a July 10 notice, it exposed several fraudulent websites impersonating the institution, luring victims with cash prizes, and draining their personal and banking data.
The scheme is sophisticated. The copycat sites advertise a fake service called “Buyer Online Security Protection” to convince victims to undergo ‘real-name identity verification.’ At this stage, victims are asked to provide their Hong Kong identity card number, ID card photo, phone number, bank account details, and account holder name - all in exchange for the promise of a cash reward. Afterwards, victims are directed to deposit or withdraw funds via virtual wallets using the FPS fast payment system.
Layers of Deception, from ‘Refunds’ to ‘Customer Service’
To appear legitimate, the websites also claim they can help victims obtain refunds, report unauthorized transactions, or access transaction support. The operators then prompt victims to communicate with bogus ‘customer service representatives’ as part of the scheme. HKICL emphasized that the websites have no connection whatsoever to its operations, and most importantly: the institution never provides direct FPS services to individuals and never initiates contact with users regarding such services.
Its official addresses are solely hkicl.com.hk and fps.hkicl.com.hk. Anyone receiving suspicious messages claiming to be from the institution is urged to verify them through official hotlines before sharing any information, and to report to the Hong Kong police immediately if they believe they have fallen victim.
Regulators Respond by Closing Old Entry Points
The case comes as Hong Kong authorities are actively tightening defenses. Earlier this week, the Securities and Futures Commission (SFC) mandated that licensed virtual asset platforms and online brokers phase out SMS-based authentication over the next 12 months. This means one-time passwords sent via SMS, email, or apps must be abandoned in favor of phishing-resistant methods such as passkeys, hardware security keys, and device binding. The takeaway for everyone remains as old as the internet itself: legitimate institutions do not chase you with rewards, and your ID data plus bank account are not raffle tickets - they are the keys to your vault.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
