Major Enhancements on Protection of Payment Card Customers

Our Ref. : B1/15C
B9/29C
B9/67C
20 June 2023
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Major Enhancements on Protection of Payment Card Customers I am writing to provide authorized institutions which are payment card issuers (“banks”) with guidance on enhancing protection of payment card customers. The Hong Kong Monetary Authority (“HKMA”) attaches great importance to the protection of banking consumers of payment cards. With the increase in popularity of electronic payments, payment cards have become an important aspect of the daily life of the public. Technological advancement and proliferation of digital channels in recent years have also promoted remote and online transactions using payment card credentials without the customers presenting their physical plastic cards for the transactions. Such change in transaction channels and customer behaviours is also accompanied by evolving modus operandi of card frauds and scams. In light of the above developments and following consultation with the banking industry since last year and through the taskforce set up under the Hong Kong Association of Banks earlier this year, the HKMA considers that banks should further strengthen protection of payment card customers in four areas, namely, empowerment; support, communication and education; unauthorised transactions handling and security; and responsible borrowing. The key enhancement measures under the respective areas are summarised below:

A. Empowerment
Cardholders should have more control on the usage of their payment cards and their credit card borrowings. Banks should allow cardholders to choose whether to undertake card-not-present transactions with their cards, and if so, the limits for such transactions. Banks should also facilitate cardholders to instantly suspend their cards through Internet banking platforms (including personal computers and mobile devices) when they spot any suspicious transactions. In addition, banks should agree with cardholders on their credit limits and any subsequent increases, as well as the provision of over-the-limit facilities. B. Support, Communication and Education Support Banks should set up specialised handling teams to better support cardholders reporting unauthorised transactions. Banks should also encourage merchants to use mobile point-of-sale terminals for cardholders to swipe/tap their cards in person when conducting transactions. Communication While banks are currently required to send timely notifications to inform cardholders of their card-not-present transactions, banks should adopt a risk-based approach to notifying cardholders of card-present transactions, for example, for the first three contactless mobile payment transactions after payment cards are newly bound. Frontline bank staff should also have clear communication with cardholders reporting unauthorised transactions, including provision of appropriate information and advice. Education The banking industry should enhance cardholders’ awareness of the need and their ability to protect themselves against unauthorised transactions as set out in the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” of 25 April 2023.

C. Unauthorised Transaction Handling and Security
Unauthorised Transaction Handling
Banks should adopt a pragmatic and sensitive approach towards cardholders who report unauthorised transactions and adhere to the principles set out in the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” of 25 April 2023 when handling such transactions. In addition, banks should ensure transparency of the investigation process and the results, and put in place an appeal mechanism for cardholders. Security Banks should further enhance security of payment card transactions. Banks should allow cardholders to choose, as an alternative to SMS one-time￾password, an authentication factor that is more robust against phishing or malware for 3D Secured online transactions. There should also be further enhancement of fraud monitoring through utilisation of rich data and related tools and intelligence sharing, as well as additional confirmation with cardholders for suspicious transactions detected. In addition, banks should conduct additional authentication of binding of cards with new contactless mobile payment as detailed in HKMA Circular “Binding Payment Cards for Contactless Mobile Payments” of 25 April 2023. D. Responsible Borrowing In order to facilitate cardholders to properly consider their card borrowing and repayment arrangement, thus supporting their financial well-being, banks should enhance transparency by illustrating the financial implications of different card repayment practices. Banks should also in advance notify cardholders who use over-the-limit facilities when their card spending approaches the credit limits. In addition, banks should issue reminders to cardholders who have signs of developing into persistent debt reminding them to improve their repayments and providing them with possible financial options to deal with their borrowing situations. In addition to the above, the HKMA and the industry will continue to engage other relevant stakeholders (e.g. telecommunications companies) to explore the use of technology in enhancing protection of cardholders. Details of the enhancement measures can be found in the Annex. Banks are expected to take steps to comply with the requirements as soon as practicable.

Requirements which do not involve system changes will take effect by the end of June 2023, taking into account preparatory time. For those requirements involving system changes, banks should comply with the requirements within 6 months (i.e. by the end of 2023). Should you have any questions regarding this circular, including bank-specific situations in the implementation arrangements, please send them to consumerprotection@hkma.iclnet.hk. Yours faithfully, Arthur Yuen Deputy Chief Executive c.c.: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)

---

Annex - Details of Major Enhancements on Protection of Payment Card Customers

Annex
Details of Major Enhancements on Protection of Payment Card Customers A. Empowerment

1. Management of card-not-present (CNP) transactions – To allow
   cardholders to minimise the risk of unauthorised CNP transactions (for example online purchases), banks should allow cardholders to enable or disable CNP transactions (except for recurring payments) as well as setting a limit on CNP transactions (within the overall credit limits) for their cards. Banks should provide convenient channels, for example hotline and Internet banking platforms1 , for cardholders to manage CNP transactions.

2. Suspension and reactivation of cards – While currently cardholders can
   request suspension of cards through bank hotlines or other channels, banks should also allow cardholders to instantly suspend their cards through Internet banking platforms, if they are not already doing so. Banks should also remind the cardholders to report any unauthorised transactions to the banks through hotline or Internet banking platforms when the cardholders proceed to suspend their cards. In addition, banks should enable cardholders to reactivate their cards through Internet banking platforms with proper authentication and verification by the banks.

3. Management of credit limits – To allow cardholders to have more control
   over their card borrowing, banks should:
   a. explicitly inform and agree with cardholders on the credit limits of newly approved cards. The banks should also on the same occasion clearly indicate to the cardholders the means to reduce the credit limits; b. where banks offer increases to the credit limits of existing cards, obtain explicit agreement of the cardholders before the increases become effective; and
   c. provide convenient channels, for example hotline and Internet banking
   platforms, for cardholders to reduce credit limits of newly approved and existing cards, and effect the reduction as soon as practicable. The above requirements also apply to spending limits of debit cards.

4. Management of over-the-limit facilities – Banks should obtain explicit
   agreement of cardholders for over-the-limit facilities of cards. (For details of the requirements, please refer to the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” issued on 25 April 2023.) 1 Internet banking platforms refer to banks’ platforms which deliver financial services over the Internet to customers’ devices, including personal computers and mobile devices.

5. Reporting unauthorised transactions – While banks are already receiving
   reports of unauthorised transactions from cardholders through bank hotlines or other channels, banks should also allow cardholders to report unauthorised transactions through Internet banking platforms, if they are not already doing so. Banks should in general ensure sufficient resources for the operation of their hotlines to avoid undue delay in reporting by cardholders. B. Support, Communication and Education Support

6. Specialised handling team – While cardholders reporting unauthorised
   transactions are generally received by bank hotline staff, banks should set up specialised teams to be responsible for the subsequent handling of such reports and cardholder communications. The specialised teams should get in contact with the cardholders within seven business days from the date of the reporting of the unauthorised transactions. In addition, the specialised teams should:
   a. have proper training to ensure the cardholders are handled in a proper manner, for example, adopting an uninquisitive manner when collecting information from the cardholders; b. be properly equipped to have ready information on the status of the cardholders and their transactions throughout the process and provide information and advice that are specific to the cardholders’ circumstances;
   c. ensure appropriate information and advice are clearly and properly
   provided to the cardholders; for example, how the reported unauthorised transactions will be handled and the related chargeback arrangement, and action(s) that the cardholders should take; d. clearly inform the cardholders of, and provide reasons upon request for, any information and documents that the banks collect from the cardholders; and e. properly handle and timely follow up the unauthorised transactions reports and provide updates to the cardholders.

7. Mobile Point-of-Sale (POS) Terminals – Banks should encourage their
   merchants to use mobile POS terminals when conducting card transactions with cardholders so that they can swipe/tap their cards in person, instead of having the cards being taken away from them for conducting the transactions.

8. Monitoring of not-yet-posted transactions – While there are limited
   actions that banks can take immediately on reported unauthorised transactions which are not yet submitted by the merchants for settlement (i.e. “not-yet-posted transactions”), banks should properly record and monitor

such transactions upon receipt of reports from the cardholders, and endeavour to take follow up actions when the transactions are posted. Communication
9. Notification for card-present transactions – While banks are currently
required to send timely notifications to cardholders for all CNP transactions (except for recurring payments or transactions with an amount within the threshold specified by the customers), they should also adopt a risk-based approach to notifying cardholders of suspicious card-present transactions via effective means (e.g. SMS or in-App notifications). In particular, for binding of cards to contactless mobile payment services, banks should provide timely notifications for the first three contactless mobile payment transactions after the cards are newly bound.
10. Frontline communications – Bank hotline staff who receive unauthorised
transaction reports from cardholders should have clear and appropriate communication with the cardholders throughout the handling process. They should ensure that the cardholders have clear understanding of the situations and the actions to be taken. Among all, the following information and advice specific to the reported unauthorised transactions should be provided to the cardholders:
a. information and explanation about the banks’ dispute handling and follow-up/investigation processes, and the expected timeframe within which the specialised handling teams noted under Item 6 will get in contact with the cardholders; b. the cardholders’ right to withhold repayment of the transactions concerned and the circumstances under which repayment, and interest and charges if any, may be required;
c. advice on making reports on the unauthorised transactions to the Police
as soon as possible, and whether the banks may require written statements made to the Police at any stage; and The banks should provide acknowledgements of the unauthorised transaction reports to the cardholders (in paper or electronic forms) within seven business days from the date of the reports.
11. Clarity of transaction notifications – In order to facilitate cardholders to
effectively identify suspicious card transactions and promptly take necessary actions, in the pre- or post-transaction instantaneous communications provided to cardholders in relation to card transactions (for example, one￾time-password (OTP), alert messages, post-transaction notifications, etc.), banks should include the transaction details (i.e. transaction type, partial information of the account, merchant name, transaction amount and transaction currency), as well as the following message:
Chinese: “如懷疑電 <the bank’s designated telephone number>” and English: “Any doubt call <the bank’s designated telephone number>”.

Education
Recognising cardholders’ role to stay vigilant and take precautions against unauthorised transactions, it is important to enhance cardholders’ awareness of the need and their ability to protect themselves against unauthorised transactions.
12. Security advice to cardholders – Banks should from time-to-time remind
cardholders to safeguard their cards, card information and authentication factors and the potential liabilities for not duly doing so, and of the measures that they should take to guard against card frauds and scams.
13. Modus operandi of frauds and scams – Banks should provide cardholders
with information on the latest large-scale modus operandi of card frauds and scams, and advice on precautionary measures and actions to take when fallen victims of unauthorised transactions.
14. Industry education collaboration – The industry should organise
collaborative educational programmes on card security and prevention of unauthorised transactions to increase the public awareness. (For details of the relevant requirements, please refer to the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” issued on 25 April 2023.)
C. Unauthorised Transaction Handling and Security
Unauthorised Transaction Handling
15. Treatment of customers – When cardholders report unauthorised
transactions, banks should adopt a pragmatic and sensitive approach throughout the handling and investigation process.
16. Circumstances of unauthorised transactions – Banks should consider all
relevant circumstances of the reported unauthorised transactions and information available to the banks, with due regard that the circumstances of individual cases may differ.
17. Liability for losses – Banks should, in addition to the relevant provisions set
out in the Code of Banking Practice, give due consideration to the role of the banks and the role of the cardholders in the reported unauthorised transactions.
18. Industry common practices – To facilitate effective handling of
unauthorised transactions, some common practices have been developed for sharing among banks, and will be reviewed and kept up-to-date from time to time.

19. Transparency of investigation and result – Banks should ensure
    transparency of the handling/investigation process and provide customers with the results as soon as practicable. Where banks cannot provide the results within reasonable time in exceptional circumstances, banks should provide progress update to the cardholders. Where any losses arising from the reported unauthorised transactions are to be borne by the cardholders, banks should ensure the transparency of the process and clearly explain the underlying rationale and, where appropriate, relevant evidence to the cardholders.

20. Appeal mechanism – Banks should put in place a mechanism, with
    sufficient checks and balances, for cardholders to appeal against the amount of losses to be borne by the cardholders. (For details of the relevant requirements above, please refer to the HKMA Circular “Principles for Handling of Unauthorised Payment Card Transactions” issued on 25 April 2023.) Security

21. Authentication factors – Currently, if 3D Secure (3DS) is adopted by
    merchants for their online transactions, banks commonly require cardholders to authenticate the transactions via SMS OTP. While SMS OTP is considered a valid authentication factor, banks should offer an alternative authentication factor (e.g. soft token, biometric authentication) that is more robust against phishing or malware. Cardholders can choose the alternative factor if they prefer not to be authenticated via SMS OTP. For the avoidance of doubt, cardholders without mobile banking app should be allowed to continue to use SMS OTP.

22. Utilisation of rich data from 3DS 2.0 for fraud monitoring – If 3DS 2.0 is
    adopted by merchants, banks should utilise the rich data available via 3DS
    2.0 (e.g. IP address, cardholders’ phone number) to enhance their ability to
    monitor fraud trends and identify suspicious transactions.

23. Intelligence sharing – The industry should utilise existing platform(s) or
    develop a common platform for sharing card frauds and scams related intelligence and good fraud detection practices.

24. Fraud detection tools – Banks are encouraged to leverage on the fraud
    detection tools of card scheme operators or other relevant tools to enhance their fraud monitoring.

25. Additional confirmation for suspicious transactions – Banks should
    obtain additional confirmation from cardholders (e.g. via 2-way SMS and in￾App confirmation) if suspicious card transactions are detected, even though cardholders may have entered an SMS OTP to proceed with the card transactions.

26. Additional authentication of binding cards to contactless mobile
    payment – Banks are required to conduct additional authentication (on top of the input of correct card data and the one-time password) to confirm that cardholders have indeed given the instructions to bind their cards with new contactless mobile payment services. (For details of the relevant requirements above, please refer to the HKMA Circular “Binding payment cards for contactless mobile payments” issued on 25 April 2023.)

27. Promotion of tokenisation of card data – Tokenisation replaces sensitive
    card data with a unique token, which can minimise the impact of data breaches. A dedicated joint taskforce, comprising representatives from HKMA, Hong Kong Police Force, banks, and card scheme operators, has been formed under the Hong Kong Association of Banks to discuss how to encourage the relevant stakeholders in the payment ecosystem to adopt tokenisation. In support of the taskforce, banks should strive to explore ways to promote the adoption of tokenisation of card data.

28. Retrieval of card information via Internet banking platforms – The
    HKMA encourages banks to consider not showing card data on physical cards, if applicable, and allow cardholders to retrieve card information via Internet platforms instead. D. Responsible Borrowing

29. Implication of card repayment – While banks are already required to
    provide proper disclosure of the interest rates, fees and charges, etc. to the applicants for credit cards and cardholders, in order to allow the customers to more fully appreciate the financial implications of different card repayment practices, banks should:
    a. include an illustrative table2 in the Key Facts Statements of credit cards to provide customised information about the period of time and total cost for different repayment practices. b. ensure the illustrative table is provided in the card statements, and a card repayment calculator is provided in the Internet banking platforms where applicable.

30. Reminder on utilisation of credit limit – Where cardholders have opted for
    over-the-limit facilities for their cards, banks should on a best effort basis provide notifications to cardholders when their card spending approaches the credit limits (for example, at 80 to 95%) so as to remind the cardholders to consider taking any actions with respect to the potential of going over limit and the related fees and charges.

31. Assistance to cardholders with potential persistent card borrowing – To
    assist cardholders to prevent their card borrowings from developing into 2 Banks should adopt the table depicted in Annex III of the Code of Banking Practice.

persistent debts, banks should issue reminders to cardholders whose repayment patterns (for example, making minimum payment for consecutive months) indicate that their card borrowings may potentially develop into longer term debts. a. The reminders should (i) encourage the cardholders to increase the level of repayment to reduce the cost of borrowing and the time needed to repay the balances; and (ii) inform the cardholder that they may contact the banks to discuss their financial circumstances and the banks could assist them to see whether and how they could better manage their repayment without an adverse effect on their financial situations and credit record. b. For cardholders whose repayment patterns show little improvement subsequently, banks should issue similar reminders to them and set out the possible options that can help the cardholders to reduce the cost of borrowing and potential financial burden.
c. Where cardholders with potential persistent card borrowing approach the
banks for assistance, the banks should take reasonable steps to assist the cardholders to more manageably repay their card borrowings and in ways that would not adversely affect the cardholders’ financial situation. d. Banks should exercise caution in offering credit limit increase and cross￾selling other lending products to cardholders with potential persistent card borrowing.
32. Disclosure of cash advance transactions – Commonly, interest imposed on
cash advance transactions is calculated on a daily basis. The interest charge shown in the card statement of which a cash advance transaction is billed only covers the interest accrued up to the statement cut-off date, while the interest accrued after the statement cut-off date will be indicated in the next statement. In order to facilitate cardholders to take actions to minimise the interest charges, banks should provide in the fee schedules and card statements a generic remark to remind the cardholders that the interest charge may be accrued after the statement cut-off date, and the customer may contact the banks on how to fully settle the interest charge before the next statement date. E. Other
33. Engagement of stakeholders – The HKMA and the industry will continue
to engage other relevant stakeholders (e.g. telecommunication companies) to explore the use of technology in enhancing protection of cardholders.