New Anti-Digital Fraud Measures: E-Banking Security ABC

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B1/15C B9/29C 14 April 2025 The Chief Executive All Authorized Institutions Dear Sir/Madam, New Anti-Digital Fraud Measures: “E-Banking Security ABC” I am writing to set out the enhancements expected to be implemented by Authorized Institutions (AIs) to further strengthen the security of E-banking, for better protecting the public from evolving digital fraud trends. In tandem, the Hong Kong Monetary Authority (HKMA) will continue to work closely with the banking industry in raising public awareness of the latest modus operandi of frauds and scams, and empowering bank customers to embrace “E-Banking Security ABC”, that is, “Authenticate in-App, Bye to unused functions, Cancel suspicious payments”. The HKMA has been closely monitoring the digital fraud landscape and actively guiding AIs to implement effective measures to address emerging threats, as well as promoting customer awareness. For instance, noting a growing propensity for fraudsters to target online payment card transactions globally, the HKMA has required AIs since late 2024 to allow customers to authenticate these transactions via a bound device by default, rather than using SMS One-Time-Passwords (OTPs). Card-issuing banks in Hong Kong that implemented the measure saw a nearly 80% reduction in fraud rates since then. In addition, the HKMA, working with the banking industry and the Hong Kong Police Force (HKPF), expanded the Suspicious Account Alert mechanism 1 to cover the majority of the public’s day-to￾day payment transfers. In the second half of 2024, over 50,000 alerts were issued, providing a tangible basis for customers to think twice about high risk transactions. /…Page 2 For more details, please see the HKMA’s press release “Expansion of Suspicious Account Alert for Automated Teller Machine transactions” of December 2024.

While these measures have remained largely relevant to-date, the HKMA notes that the modus operandi of fraudsters continue to evolve rapidly. In particular, there are early signs that some bad actors may have tried to leverage advanced technologies, including artificial intelligence and deepfake in particular, to enhance the sophistication of their deception techniques. Adopting a forward-looking approach, the HKMA is introducing three enhancements to E-banking security measures, which are designed in consultation with the HKPF and the Hong Kong Association of Banks (HKAB) to address the evolving risks. In practical terms, AIs should provide convenient means for customers to:

• “Authenticate in-App” – Facilitate customers to adopt bound devices by
  default, instead of SMS OTPs, for authenticating specified Internet banking activities, including logins to Internet banking and high risk transactions (e.g. fund transfers to unregistered third parties);
• “Bye to unused functions” – Empower customers to make own choice of
  deactivating higher risk functions in Internet banking, using a phased approach as appropriate, and starting with two functions, namely online increase of transfer limits and online registration of third-party payees; and
• “Cancel suspicious payments” – Further enhance the effectiveness of alerts
  displayed under the Suspicious Account Alert mechanism, including by adjusting their duration and content. The HKMA’s supervisory expectations for each of these enhancements, which are intended to be implemented by AIs for all retail bank customers 2 , are set out in details in the Annex. AIs should endeavour to meet the implementation timelines, while we stand ready to discuss with individual AIs on alternative proposals and mitigation measures should any AI encounters genuine difficulties. /…Page 3 Although these measures target individual customers of retail banks, AIs are encouraged to consider extending them to other types of customers (e.g. business customers and private bank customers) as appropriate, especially where the nature of transactions conducted by these customers may bear similarities with retail banking.

In parallel, the HKMA will also continue to uplift AIs’ ability to manage risks stemming from emerging technologies, including deepfakes. Building on the success of our earlier anti-digital fraud workshop 3 , as well as insights drawn from our GenA.I. Sandbox, we will issue further guidance to elevate the ecosystem’s readiness to combat deepfake-enabled modus operandi. To ensure that customers are able to effectively leverage the new measures to defend against digital frauds and scams, AIs should clearly communicate the implementation specifics (e.g. the details of “cooling-off” periods or other enhanced risk management controls that may be applied) to customers in easy-to￾understand language. In tandem, the HKMA will continue to strengthen consumer education around “E-Banking Security ABC” and will look to AIs to actively contribute to, and join hands with us to empower better customer protection. Should you have any questions regarding this circular, please address them to ebanking@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Banking Supervision) 3 The HKMA jointly held with the HKPF, Digital Policy Office and HKAB an anti-digital fraud workshop on 13 November 2024 to raise industry awareness of fraudsters’ use of deepfakes and to share good practices for managing the associated risks. More than 140 participants from 70 AIs joined the workshop.

---

Annex
New Anti-Digital Fraud Measures: “E-Banking Security ABC” Enhancement measure Supervisory expectation Implementation timeline

1. “Authenticate in-App”
   a. Account logins and high risk transactions  AIs should implement arrangements which allow customers with mobile banking Apps to authenticate their logins to Internet banking and high risk transactions through a bound device by default, instead of using SMS OTPs.  Any requests from customers to change this default authentication method should be regarded as a high risk transaction, and SMS OTPs should not be used to authenticate the change. Instead, other authentication methods such as biometric authentication, bound devices, call-back, verification at a physical branch, etc. should be adopted.  AIs may still allow SMS OTPs to be used for authentication under certain scenarios 1 . However, in such cases, AIs should implement appropriate risk management measures, including:
   i. Applying a “cooling-off” period for high risk transactions 2
   , so that in the event of fraud, customers have time to review and report any unauthorised activity. Q4 2025

1 For instance, (i) where customers have a legitimate need to rely on SMS OTPs (e.g. do not have a mobile banking App); (ii) where customers explicitly opt to use SMS OTPs; and/or (iii) other resilience/contingency considerations. 2 This “cooling-off” period may be implemented following a risk-based approach. For instance, if an AI assesses a transaction authenticated via SMS OTP to be of higher risk (e.g. it is a large-value fund transfer), it should impose an appropriate “cooling-off” period on that transaction.

ii. Tightened fraud monitoring of activities and transactions authenticated via
SMS OTPs, which should take into account factors such as past transaction history, device information, and relevant fraud intelligence.  AIs can decide whether to implement this measure if their Internet banking platforms do not support high risk transactions, but are highly encouraged to critically consider the merits of doing so. b. Device binding and re￾binding  AIs are expected to strengthen the security of device binding and re-binding for individual customers. Specifically, AIs should implement facial recognition 3 or similarly stringent authentication methods rather than relying on SMS OTPs. For the avoidance of doubt, this requirement only applies to new binding and re￾binding requests.  AIs may offer appropriate arrangements for customers who encounter difficulties following these device binding requirements (e.g. non-HKID holders). These alternate arrangements should be designed with regard for the latest fraud landscape, their operations and relevant prevailing supervisory requirements 4 . Q3 2025

3 For the purpose of this circular, “facial recognition” refers to verifying a customer’s facial image against the AI’s records or the customer’s identity document, rather than relying on the facial recognition feature of the customer’s own device. 4 For instance, the HKMA’s Supervisory Policy Manual module TM-E-1 “Risk Management of E-banking” and its associated FAQs set out various risk management controls that AIs should implement when using SMS OTPs for device binding and re-binding.

2. “Bye to unused functions”
    AIs should provide existing customers with the option to deactivate the online registration of third-party payees and online increase of transfer limits. Once a customer has opted to deactivate a function, AIs should perform a stringent identity verification process (e.g. conducting verification at a physical branch or through facial recognition) before processing any reactivation requests from customers.  For new customers, AIs should also consider providing them with the option to opt out of these high risk functions at the outset when first opening an Internet banking account.  To better protect customers who may choose to keep these functions active for convenience, AIs should review the default fund transfer limits set for both registered and non-registered third-party payees 5 , and allow customers to lower these limits at their discretion. Q2 2025

5 Since non-registered payees may present higher fraud risk (owing to the absence of registration-related controls), AIs are expected to set a lower default transfer limit for these payees, and at a level which is commensurate with the assessed risk.

3. “Cancel suspicious payments”
    AIs participating in the Suspicious Account Alert mechanism should ensure that “High Risk” alerts are displayed for a reasonable duration (i.e. at least 10 seconds), such that customers have adequate time to process and review the stated risks of a transaction before it is executed.  To achieve maximum impact during the alert duration, AIs are encouraged to consider displaying relevant anti-fraud and anti-scam messages. Q2 2025