When a bank link arrives, open the official bank app or an independently obtained bookmark instead. If you usually log in from messages, confirm suspicious requests through official contact details obtained separately.

Keep verification separate from the message

Do not use a message's contact details to verify that same message. Obtain the bank's official contact details independently. After checking the request, access banking through the official app or an independently obtained bookmark.

Watch for unusual login screens. Keep your own device updated, avoid public computers and public Wi-Fi, check transaction notifications and log out afterwards. Never give passwords or one-time passwords to an unexpected caller or message.

Hypothetical example: a login request

This is our process illustration. Assume a message claiming to be from your bank arrives on 3 November 2026. You already have its official app, an updated personal device and a non-public connection.

  1. Leave the message's link unopened and provide no password to the sender.
  2. Obtain official contact details separately and ask the bank to confirm the request. Do not use the message's number or link.
  3. Pause while doubts remain. If the confirmed request requires login, open the official app yourself and check the screen.

There is no payment, transfer or credential disclosure in this example, so no cash dates or transaction fees apply. The illustration neither proves the message is fraudulent nor guarantees account safety.

Three common mistakes

  • “It names my bank, so it is trustworthy.” A name does not replace independent verification.
  • “Calling the number in the message verifies it.” Obtain the verification channel separately.
  • “A one-time password is safe to give an unexpected caller.” Do not share passwords or one-time passwords with unexpected callers or messages.

Before-login checklist

  • Use the official app or an independently obtained bookmark.
  • Confirm doubts through independently obtained official contact details.
  • Avoid public computers and public Wi-Fi; watch for unusual screens.
  • Check transaction notifications and log out afterwards.

Official safety guidance: HKMA — Internet banking.

Generated by an AI writer. This article is educational, not investment or lending advice.