E-Banking Security ABCD

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B1/15C B9/29C 25 August 2025 The Chief Executive All Authorized Institutions Dear Sir / Madam, “E-Banking Security ABCD” I am writing to provide guidance on the enhancements to E-Banking security measures 1 to cover deepfake defence tactics, with immediate effect. It is accordingly rebranded as “E-Banking Security ABCD” – “Authenticate In-App”, “Bye to unused functions”, “Cancel suspicious payments”, “Deepfake detection”. The Hong Kong Monetary Authority (HKMA) has been closely monitoring the evolving fraud risks posed by deepfake technology. Progressive actions are being taken – including with the support of expert partners – to strengthen the Hong Kong banking sector’s capability to combat deepfake-related modus operandi, especially those targeting the identity verification solutions deployed by banks. As part of these efforts, we launched the Generative Artificial Intelligence (GenA.I.) Sandbox 2 in collaboration with the Hong Kong Cyberport Management Company Limited (Cyberport) in August 2024, hosted an Anti-Digital Fraud Workshop with the Hong Kong Police Force (HKPF), Digital Policy Office and Hong Kong Association of Banks in November 2024, and also unveiled a new GenA.I. Collaboratory series, under which a tailored cross-sectoral engagement session was held in July 2025 to bring together digital banks and technology firms to discuss the latest deepfake developments and effective prevention solutions. /…Page 2 1 Please refer to the HKMA’s circular on “New Anti-Digital Fraud Measures: “E-Banking Security ABC””. 2 Please refer to the HKMA’s press release on “HKMA and Cyberport Launch GenA.I. Sandbox to Bolster A.I. Adoption in Financial Sector”.

• 2 -
  Authorized institutions (AIs) have participated actively in these initiatives and also taken onboard the insights and learnings shared. Notably, some AIs successfully tested different anti-deepfake solutions under the first cohort of the GenA.I. Sandbox, while others have followed the advice provided by the HKMA at the Anti-Digital Fraud Workshop to implement advanced deepfake detection solutions. Our regular engagement with AIs showed that those which adopted relevant solutions, and related good practices (as summarised in the Annex), improved their capability to detect sophisticated, real-time deepfake attacks by more than 95% in number. The benefits extended across the ecosystem, as the identified fraud and scam cases have been shared by AIs with the HKPF, and facilitated law enforcement investigations as well as the early identification of emerging deepfake-related tactics before further proliferation. Noting the positive outcomes so far, and as the first initiative under Measure “D”, the HKMA expects AIs to review the relevance of the good practices to their institution and take appropriate action(s) to step up their deepfake detection capabilities. Going forward, the HKMA will continue to launch new initiatives under Measure “D”. Besides keeping the good practices under regular review, the HKMA will provide practical utilities to enhance AIs’ anti-deepfake capabilities. In particular, the second cohort of the GenA.I. Sandbox is currently open for applications with the theme of “A.I. versus A.I.”, and will allow AIs to examine how to use A.I. technology to combat the risks and threats elevated by A.I. advancements, including the emergence of deepfakes. Applications are welcome until the deadline of 31 August 2025 3 , and the resultant insights will also be shared in future GenA.I. Collaboratory sessions and/or in the form of further practical guidance, as appropriate. Leveraging on the Memorandum of Understanding (MoU) 4 signed between the HKMA and the School of Business and Management of the Hong Kong University of Science and Technology in May 2025, efforts will also be made to deliver resources that support growth in the industry’s anti-deepfake capabilities. More details will be announced in due course. /…Page 3 3 More details about the application process can be found in the HKMA’s circular on “Generative Artificial Intelligence Sandbox: Second Cohort”. 4 For details, please refer to the HKMA’s press release on “HKMA and HKUST sign MoU to advance cybersecurity innovation for Hong Kong’s financial sector”.

• 3 -
  Should you have any questions regarding this circular, please address them to ebanking@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Banking Supervision)

---

Annex
Good Practices for Countering Deepfake Attacks To further enhance AIs’ defence against common deepfake attacks that target their identity verification solutions, AIs should review the relevance of the following good practices and take appropriate action(s) to enhance deepfake detection capabilities:

1. Strengthen device security controls – implement robust controls to ensure
   that customers’ devices are secure and that mobile banking applications can directly access device cameras for secure image capture without manipulation (e.g. video injection 1 ).
2. Ensure the robustness of identity verification solutions – incorporate a
   diverse and randomised set of liveness action tests during identity verification, and take appropriate follow-up actions in response to abnormal verification attempts.
3. Equip systems with deepfake detection capabilities – as part of these
   deepfake detection capabilities, AIs are strongly encouraged to implement image analytics solutions, such as face similarity detection and background analysis, to further enhance their ability to detect fraudulent verification attempts.
4. Enhance fraud monitoring capabilities – collect and analyse abnormal
   digital footprints and transaction patterns that may signal potential deepfake attacks.
5. Implement end-to-end controls to support deepfake detection – establish
   comprehensive processes that integrate deepfake detection solutions with other security controls, such as device security checks, transaction monitoring, manual reviews, and quality assurance checks, to provide a multi-layered defence system.
6. Conduct regular reviews – conduct regular reviews to assess the
   effectiveness of facial recognition solutions, including deepfake detection capabilities.
7. Equip and train staff – provide comprehensive training to staff responsible
   for manual checks, equipping them with necessary skills to effectively identify and respond to deepfake attacks.

1
This involves compromising device security to feed images and videos directly to a device, thereby substituting the device’s genuine camera source.