HKMA Steps Up Against Digital Scams With Fresh Safeguards

The Hong Kong Monetary Authority (HKMA) announced “E-Banking Security ABC,” a series of new anti-digital fraud measures to better protect the public from evolving digital fraud trends and strengthen public protection.

HKMA introduced the “E-Banking Security ABC” framework to combat the growing sophistication of fraud schemes, particularly those leveraging technologies like artificial intelligence and deepfakes. This initiative focuses on three key enhancements for authorised institutions.

Under “Authenticate in-App,” the measures encourage enabling customers to use bound devices as the default option instead of SMS One-Time Passwords (OTPs) for verifying Internet-banking-related activities. This includes for high-risk online banking activities such as logging in or transferring funds to unregistered third parties.

Next, under “Bye to unused functions”, customers need to be empowered with the option to deactivate higher-risk Internet banking functions. The measures suggested that an initial phased approach, starting with two functions related to the  online increases to transfer limits and the online registration of third-party payees.

Finally, under “Cancel suspicious payments”, the measure suggests that the effectiveness of alerts under the Suspicious Account Alert mechanism be improved by adjusting their duration and content.

The HKMA’s supervisory expectations for these enhancements, which should be implemented by authorised institutions for all retail bank customers, are explained in detail in the HKMA Annex.

Authorised institutions are expected to adhere to the implementation timelines. However, if the institution faces genuine challenges, the HKMA is open to discussing alternative proposals and mitigation measures.

Authorised institutions are also encouraged to apply these measures to other customer groups, like business or private banking clients, where relevant.

The HKMA will continue to monitor risks associated with emerging technologies, including deepfakes, and provide further guidance to authorised institutions. It is building on earlier efforts, such as the anti-digital fraud workshop and insights from the GenA.I. Sandbox, to better prepare the banking ecosystem to combat advanced fraud techniques.

To help customers effectively use the new anti-fraud measures, authorised institutions should clearly explain the implementation details, such as ‘cooling-off’ periods and other enhanced risk management controls, in plain, easy-to-understand language.

The HKMA plans to further strengthen consumer education efforts around the “E-Banking Security ABC” framework. It will work closely with the banking industry to enhance customer protection.

Notably, fraudsters have apparently increasingly targeted online payment card transactions and other high-risk activities. In response, the HKMA required authorised institutions to authenticate online card payments using bound devices as a default in late 2024 instead of SMS OTPs.

Since then, card-issuing banks in Hong Kong have reported a nearly 80% reduction in fraud rates.

The Suspicious Account Alert system, developed with the Hong Kong Police Force and the banking industry, also sent out over 50,000 alerts in H2 2024. These alerts helped customers think twice before making high-risk transactions.