The Hong Kong Monetary Authority (HKMA) has warned the public to stay alert to phishing scams involving the unauthorised binding of payment cards, including ATM cards, to contactless mobile payment services.
The HKMA said it recently received reports from banks of scams in which fraudsters impersonated merchants or other organisations through phishing messages, fraudulent websites or phone calls.
In the reported cases, fraudsters used various pretexts, such as offering compensation for goods, to deceive victims into disclosing their payment card information and ATM personal identification numbers (PINs).
The fraudsters then coaxed victims into approving payment card-binding requests through different channels, including mobile banking applications or two-way SMS messages.
This allowed the victims’ payment cards to be bound to devices under the fraudsters’ control.
Once the payment cards have been bound, fraudsters can use them to make unauthorised transactions, the HKMA said.
The regulator has shared the relevant modus operandi with the banking industry and reminded banks to stay vigilant and strengthen customer education as scammers increasingly target the process used to link payment cards with contactless mobile payment services.
The HKMA stressed that binding a payment card is a high-risk operation and urged consumers never to click hyperlinks in messages from unknown sources.
Customers should also never disclose payment card information, ATM PINs, login passwords or one-time passwords (OTPs) to anyone, it said.
The regulator also warned the public against following instructions from unknown or unverified persons to respond to or approve requests or transactions, including those received through mobile banking applications or two-way SMS messages.
Consumers should carefully read all messages and notifications received from their banks and reject any card-binding request that they have not initiated themselves, the HKMA said.
The warning underscores how phishing attacks can go beyond stealing card credentials by manipulating customers into authorising actions that give fraudsters the ability to use their cards through mobile payment services.
Members of the public who suspect they have fallen victim to a scam should immediately contact their bank and report the matter to the police. They can also call the Hong Kong Police’s Anti-Scam Helpline at 18222 for assistance.