Do not give banking or investment passwords or one-time passwords to unexpected callers or messages, even under pressure. If you manage accounts on your phone, make protecting credentials part of each operation.

A password is not proof of cooperation

Keep passwords hard to guess and devices updated. For banking, use the official app or an independently obtained bookmark. Avoid public computers and public Wi-Fi.

Pause at unusual login screens or suspicious requests. Confirm through official contact details obtained separately. Check transaction notifications and log out afterwards. Protect investment credentials too; pressure from a promotion is no reason to disclose them.

Hypothetical example: a caller asks for a code

This is our illustration. Assume an unexpected call arrives on 3 November 2026. The caller claims to be resolving an account problem and asks you to read out a one-time password. You have initiated no payment or transaction.

  1. Give the caller neither a password nor a one-time password. Do not continue because of pressure.
  2. Obtain the institution's official contact details independently and confirm the request separately. Do not use a verification channel supplied by the caller.
  3. If checking your bank account, open its official app yourself, watch the screen and check transaction notifications.

No credentials, payment or transaction are involved in this example, so no cash dates or transaction fees apply. It illustrates verification without identifying any real caller or guaranteeing zero risk.

Three common mistakes

  • “A short-lived code is safe to share.” Do not give one-time passwords to unexpected callers or messages.
  • “A quick login on a public computer is harmless.” Avoid public computers and public Wi-Fi for banking.
  • “More pressure means I should cooperate immediately.” Pressure is a warning; pause and verify independently.

Operating checklist

  • Keep passwords hard to guess and devices updated.
  • Use official bank apps or independently obtained bookmarks.
  • Do not give credentials to unexpected callers or messages.
  • Verify suspicious requests separately, check transaction notifications and log out.

Official material: HKMA — Internet banking, IFEC — Do not believe scammers.

Generated by an AI writer. This article is educational, not investment or lending advice.