HKMA Guidance on Bogus Voice Message Phone Calls

Our Ref.: B1/15C 28 July 2015 The Chief Executive All Retail Banks Dear Sir/Madam, Bogus Voice Message Phone Calls The Hong Kong Monetary Authority (HKMA) notes the recent massive scale of bogus voice message (VM) phone calls purportedly from banks claiming irregularities in the customers’ bank or credit card accounts and asking them to input their personal information or contact the operator for account authentication. In this regard, the HKMA has earlier reminded banks to stay vigilant and to take appropriate actions to help protect customers’ interests. I am writing to set out some possible preventive measures as well as further steps that retail banks may take to help raise awareness of their customers about these calls. Over the past three weeks, retail banks in Hong Kong have received about 2,080 enquiries from their customers about these suspicious calls1 . For better protection of consumers, banks should raise their customers’ awareness of the issue and help protect the affected customers from potential financial loss as a result of disclosing their sensitive personal information in such calls. In particular, we encourage retail banks to take appropriate steps including but not limited to the following: (i) as soon as possible, publicise “fraud alerts” on banks’ websites and other channels (e.g. distribution of leaflets where readily available) to draw their customers’ attention to bogus VM phone calls. Messages should be delivered in a prominent and easily understandable manner. As an important reminder to customers, banks should highlight that they will not require customers to provide sensitive personal information (including login passwords or one-time passwords) through phone calls or emails. Nor will banks notify customers of account irregularities through pre-recorded messages. Customers should be reminded to protect their sensitive personal information at all times. Where customers are 1 As of 28 July, Bank of China (Hong Kong) Limited, Chong Hing Bank Limited, DBS Bank (Hong Kong) Limited, Hang Seng Bank Limited, The Hong Kong and Shanghai Banking Corporation Limited and Nanyang Commercial Bank Limited have received customer enquiries about suspicious calls.

2 suspicious about the identity of the callers, the customers should request for the callers’ contact numbers and information and verify with the banks concerned; (ii) ensure customer enquiries about bogus VM phone calls are properly handled. Upon receipt of such customer enquiries, banks’ staff should check with the customers whether and what kind of sensitive personal information has been divulged to the callers. Banks should report, and also advise affected customers to report such cases to the Police immediately for investigation. For customers who have not divulged any sensitive personal information to the callers, the bank staff should proactively remind customers concerned that they should never disclose any sensitive personal information through phone calls or emails. Banks should also ensure a high degree of alertness and sensitivity among front-line staff in handling customers’ enquiries about these calls; and (iii) take prompt and appropriate follow up actions to protect customers from suffering potential financial loss as a result of disclosing their personal information in these cases. If there are any questions about this circular, please contact Ms Yvonne Chan at 2878-1452 or Mr Larry Leung at 2878-1004. Yours faithfully, Carmen Chu Executive Director (Banking Conduct) c.c. The Hong Kong Association of Banks (Attn: Henry Chan)