Hong Kong Interbank Clearing Limited has uncovered multiple counterfeit websites that use cash rewards and virtual wallet transactions to steal personal and banking information from users.
According to a July 10 notice from Hong Kong Interbank Clearing Limited (HKICL), the fraudulent websites impersonate the clearing company and advertise fake “Buyer Online Security Protection” services to convince users to complete so-called real-name verification.
The websites ask victims to submit Hong Kong ID numbers, ID card photos, phone numbers, bank account details, and account holder names in exchange for promised cash rewards before directing them to deposit or withdraw funds through virtual wallets using the Faster Payment System (FPS).
HKICL says fake websites have no link to official FPS services
While presenting themselves as official platforms, the scam websites also claim to help users obtain refunds, report unauthorized online transactions, or access transaction support. HKICL said the operators then encourage victims to communicate with fake customer service representatives as part of the scheme.
The clearing company stated the fraudulent websites have no connection to its operations or businesses. HKICL also reminded the public that it does not provide FPS services directly to individual members of the public and does not proactively contact users regarding such services.
It identified its official websites as hkicl.com.hk and fps.hkicl.com.hk, urging anyone who receives suspicious communications claiming to represent the organization to verify them through its official hotline before sharing personal information.
Separately, HKICL advised anyone who believes they have fallen victim to the scam to report the incident to Hong Kong police as soon as possible.
The warning comes as financial authorities in Hong Kong continue to tighten protections against online fraud targeting digital asset users and payment services.
Hong Kong regulators continue tightening crypto security measures
Earlier this week, the Hong Kong Securities and Futures Commission (SFC) introduced new cybersecurity requirements requiring licensed virtual asset trading platforms and online brokers to replace SMS-based authentication with phishing-resistant login methods within the next 12 months.
According to the SFC, firms must stop relying on one-time passwords delivered through SMS, email, or app-generated codes and instead implement stronger authentication methods combined with device binding.
The regulator identified passkeys, cryptographically verified registered devices, and hardware security keys as acceptable alternatives designed to reduce phishing attacks against customer accounts.
The latest warning also follows recent enforcement activity against suspicious crypto businesses. In June, the SFC added Aurum/Aurum Foundation to its Alert List after alleging the platform may have been offering virtual asset, futures, and derivatives trading services without the required authorization.
According to the regulator, Aurum/Aurum Foundation claimed to be registered in Hong Kong under the Companies Ordinance, but the SFC said the entity does not hold a license to conduct regulated virtual asset activities. The regulator added the platform to its Alert List, which identifies entities that may pose risks to investors.
Taken together, the recent actions show Hong Kong authorities increasing scrutiny of both phishing campaigns and unlicensed crypto operations, while warning users to verify platforms and protect sensitive information before completing transactions or identity checks.