Circular on Bogus Telephone Calls

Our Ref: B1/15C B9/67C

21 June 2024 The Chief Executive All Authorized Institutions Dear Sir/Madam, Bogus Telephone Calls The Hong Kong Monetary Authority (HKMA) notes that bogus telephone calls purported to be made by banks (referred to as “bogus calls” thereafter) have incessantly continued to emerge. Among the 24,000 enquiries made to hotlines of retail banks (including virtual banks) by members of the public for verification of identity of callers purported to be representing banks in 2023, a significant portion of such calls are confirmed to be bogus calls. Bogus calls are usually associated with malicious intents, for example, frauds and scams, and/or dubious marketing of lending activities. Cases involving financial losses of consumers and other harms are noted from time to time. In this regard, there is a need for retail banks (including virtual banks) to further step up their measures to protect consumers from bogus calls as follows:

1. Reinforcing assistance to consumers on verification against bogus calls – When contacting consumers, retail banks have put in place measures such that callers representing the banks now properly identify themselves by providing their full names and “identifying numbers” (that is, their phone extension numbers, direct telephone numbers or staff identity numbers). Retail banks have also been providing hotlines to facilitate members of the public to verify the genuineness of callers purported to be representing the banks. Since these measures have been launched for an extended period of time since 2015, retails banks should now undertake a review to ensure that such measures continue to be implemented as intended. In addition, to enhance the accessibility and

• 2 - efficiency of the verification process, retail banks should consider providing the verification service through their Internet banking platforms (including mobile banking apps) with appropriate controls in place.

2. Providing assistance to customers affected by bogus calls – For any bogus calls identified, retail banks are reminded to check with the enquirers whether any sensitive personal and financial information has been divulged to the bogus callers, and whether any potential financial loss has been resulted. If there are any such cases, banks should advise the enquirers concerned to report to the Police immediately. Retail banks should also take prompt and appropriate follow up actions to protect the customers concerned from potential or further financial loss as a result of disclosing their information, for example, consider any need for temporary suspension of relevant banking services or additional authentication when providing banking services for such customers, depending on the extent of personal and financial information divulged.
3. Streamlined reporting of identified bogus calls to the Police – Upon identifying any calls received by enquirers as bogus calls, retail banks should report such cases to the Police to facilitate intelligence sharing and enhance the forces against bogus calls. In this regard, retail banks should: a. submit bogus call reports to the Police through a standard template; and b. obtain details about the bogus calls from the enquirers as far as possible, and provide such information to the Police, with the aim of facilitating any follow-up action by the Police. The standardised report template will be provided to retail banks separately.
4. Speedy reporting of identified bogus calls to the Police – It is important that any identified bogus calls are addressed promptly to contain their further impact on the public. Retail banks should submit the reports on bogus calls to the Police as soon as practicable, and in any case not later than 5 working days after the banks have completed any necessary internal checking.

• 3 -

5. Enhancing customer communication and education – For better consumer protection, retail banks should also raise the awareness of their customers and members of the public of bogus calls and their potential impact, as well as the measures that banks have put in place for verifying bank callers’ identities (as noted in measure 1 above). Other authorized institutions which are not carrying on retail banking business are also reminded of the need to assist customers, by making reference to the requirements above where appropriate, in tackling bogus phone calls purported to be representing their institutions as far as practicable. Should you have any questions regarding this circular, please send them to consumerprotection@hkma.iclnet.hk. Yours faithfully, Alan Au Executive Director (Banking Conduct) c.c.: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)