Major Enhancements on Protection of Payment Card Customers

Our Ref. : B1/15C B9/29C B9/67C 20 June 2023 The Chief Executive All Authorized Institutions Dear Sir/Madam, Major Enhancements on Protection of Payment Card Customers I am writing to provide authorized institutions which are payment card issuers (“banks”) with guidance on enhancing protection of payment card customers. The Hong Kong Monetary Authority (“HKMA”) attaches great importance to the protection of banking consumers of payment cards. With the increase in popularity of electronic payments, payment cards have become an important aspect of the daily life of the public. Technological advancement and proliferation of digital channels in recent years have also promoted remote and online transactions using payment card credentials without the customers presenting their physical plastic cards for the transactions. Such change in transaction channels and customer behaviours is also accompanied by evolving modus operandi of card frauds and scams. In light of the above developments and following consultation with the banking industry since last year and through the taskforce set up under the Hong Kong Association of Banks earlier this year, the HKMA considers that banks should further strengthen protection of payment card customers in four areas, namely, empowerment; support, communication and education; unauthorised transactions handling and security; and responsible borrowing. The key enhancement measures under the respective areas are summarised below:

• 2 - A. Empowerment Cardholders should have more control on the usage of their payment cards and their credit card borrowings. Banks should allow cardholders to choose whether to undertake card-not-present transactions with their cards, and if so, the limits for such transactions. Banks should also facilitate cardholders to instantly suspend their cards through Internet banking platforms (including personal computers and mobile devices) when they spot any suspicious transactions. In addition, banks should agree with cardholders on their credit limits and any subsequent increases, as well as the provision of over-the-limit facilities. B. Support, Communication and Education Support Banks should set up specialised handling teams to better support cardholders reporting unauthorised transactions. Banks should also encourage merchants to use mobile point-of-sale terminals for cardholders to swipe/tap their cards in person when conducting transactions. Communication While banks are currently required to send timely notifications to inform cardholders of their card-not-present transactions, banks should adopt a risk-based approach to notifying cardholders of card-present transactions, for example, for the first three contactless mobile payment transactions after payment cards are newly bound. Frontline bank staff should also have clear communication with cardholders reporting unauthorised transactions, including provision of appropriate information and advice. Education The banking industry should enhance cardholders’ awareness of the need and their ability to protect themselves against unauthorised transactions as set out in the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” of 25 April 2023.

• 3 - C. Unauthorised Transaction Handling and Security Unauthorised Transaction Handling Banks should adopt a pragmatic and sensitive approach towards cardholders who report unauthorised transactions and adhere to the principles set out in the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” of 25 April 2023 when handling such transactions. In addition, banks should ensure transparency of the investigation process and the results, and put in place an appeal mechanism for cardholders. Security Banks should further enhance security of payment card transactions. Banks should allow cardholders to choose, as an alternative to SMS one-time￾password, an authentication factor that is more robust against phishing or malware for 3D Secured online transactions. There should also be further enhancement of fraud monitoring through utilisation of rich data and related tools and intelligence sharing, as well as additional confirmation with cardholders for suspicious transactions detected. In addition, banks should conduct additional authentication of binding of cards with new contactless mobile payment as detailed in HKMA Circular “Binding Payment Cards for Contactless Mobile Payments” of 25 April 2023. D. Responsible Borrowing In order to facilitate cardholders to properly consider their card borrowing and repayment arrangement, thus supporting their financial well-being, banks should enhance transparency by illustrating the financial implications of different card repayment practices. Banks should also in advance notify cardholders who use over-the-limit facilities when their card spending approaches the credit limits. In addition, banks should issue reminders to cardholders who have signs of developing into persistent debt reminding them to improve their repayments and providing them with possible financial options to deal with their borrowing situations. In addition to the above, the HKMA and the industry will continue to engage other relevant stakeholders (e.g. telecommunications companies) to explore the use of technology in enhancing protection of cardholders. Details of the enhancement measures can be found in the Annex. Banks are expected to take steps to comply with the requirements as soon as practicable.

• 4 - Requirements which do not involve system changes will take effect by the end of June 2023, taking into account preparatory time. For those requirements involving system changes, banks should comply with the requirements within 6 months (i.e. by the end of 2023). Should you have any questions regarding this circular, including bank-specific situations in the implementation arrangements, please send them to consumerprotection@hkma.iclnet.hk. Yours faithfully, Arthur Yuen Deputy Chief Executive c.c.: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)