Hong Kong Interbank Clearing Limited (HKICL) has uncovered multiple counterfeit websites that use cash rewards and virtual wallet transactions to steal personal and banking information from users. According to a July 10 notice from HKICL, the fraudulent websites impersonate the clearing company and advertise fake 'Buyer Online Security Protection' services to convince users to complete so-called real-name verification. The websites ask victims to submit Hong Kong ID numbers, ID card photos, phone numbers, bank account details, and account holder names in exchange for promised cash rewards before directing them to deposit or withdraw funds through virtual wallets using the Faster Payment System (FPS).
HKICL stated that the fraudulent websites have no connection to its operations or businesses. The clearing company also reminded the public that it does not provide FPS services directly to individual members of the public and does not proactively contact users regarding such services. HKICL identified its official websites as hkicl.com.hk and fps.hkicl.com.hk, urging anyone who receives suspicious communications claiming to represent the organization to verify them through its official hotline before sharing personal information. The company advised anyone who believes they have fallen victim to the scam to report the incident to Hong Kong police as soon as possible.
The warning comes as financial authorities in Hong Kong continue to tighten protections against online fraud targeting digital asset users and payment services. Earlier this week, the Hong Kong Securities and Futures Commission (SFC) issued a circular ordering internet brokerage firms and virtual asset trading platforms to overhaul their security infrastructure by eliminating one-time passwords for user logins and device registration. According to the SFC, this enforcement action comes as part of the regulator's ongoing campaign against account takeovers, fraud, and spoofing operations targeting online financial intermediaries. The regulator identified spoofing attacks accounted for 57% of all reported security incidents in 2025, as reported by the Hong Kong Cyber Security Incident Coordination Centre.
The latest warning follows recent enforcement activity against suspicious crypto businesses. In June, the SFC added Aurum/Aurum Foundation to its Alert List after alleging the platform may have been offering virtual asset, futures, and derivatives trading services without the required authorization. According to the regulator, Aurum/Aurum Foundation claimed to be registered in Hong Kong under the Companies Ordinance, but the SFC said the entity does not hold a license to conduct regulated virtual asset activities. The SFC added the platform to its Alert List, which identifies entities that may pose risks to investors.
