Hong Kong Interbank Clearing Limited (HKICL), the operator of Hong Kong's interbank clearing and settlement systems, has warned the public about two fraudulent websites impersonating its service to steal personal and banking data. In a press release dated 24 August 2026, published through the Hong Kong Monetary Authority, HKICL said the sites are not affiliated with HKICL or any of its businesses and urged the public to remain vigilant.
The two sites pose as a "Buyer Online Protection" service tied to the Faster Payment System (FPS), the round-the-clock retail payment platform that HKICL operates and that most people in Hong Kong now use to move money between banks and e-wallets. By dressing the scam in the FPS name, the operators borrow the credibility of the national payments infrastructure that consumers already trust.
How the lure works
HKICL describes three believable sounding FPS features dangled by the sites: refunding a buyer, letting someone flag an unauthorised online transaction, and offering general help with online transactions. Each is really a hook tuned to pull out a different category of sensitive data.
- Identity harvesting under the guise of "real-name verification."
Here, the site coaxes a victim into sharing an identity document number, a photograph of the document itself and a contact number, all dangled behind the promise of a cash reward once verification is done. - Bank-account capture via a fake "virtual wallet."
Victims are asked for their bank's name, their account number and the name on the account, supposedly to load and cash out funds from a virtual wallet over FPS, which instead pipes real money and live credentials straight to the fraudsters. - Hand-off to a fake agent.
The target is then passed to a scammer posing as a customer-service officer, the social-engineering stage where whatever details remain are talked out of them.
The pattern is a textbook combination of phishing and brand impersonation: a trusted payments brand, a believable pretext (refunds and fraud reporting), a reward to lower the target's guard, and a live "agent" to close the deal.
How to identify a HKICL website
HKICL was specific about how to tell the real service from the fake. It emphasised that it neither delivers FPS services straight to individual members of the public nor reaches out to them on its own initiative in the ordinary course, which makes any unsolicited approach in its name a warning sign in itself. The organisation named its genuine official websites as hkicl.com.hk and fps.hkicl.com.hk, and asked anyone who receives a suspicious communication purportedly from HKICL to verify it by calling its general line on 2533 1111. Anyone who suspects they have fallen victim should report to the Police promptly.
Why it matters for compliance and fraud teams
For banks, e-wallet operators and their financial-crime teams, the episode is a reminder that FPS-branded impersonation is now part of the scam toolkit, and that the attack targets the customer's identity and credentials rather than any weakness in the payment rails themselves. That places the burden on customer-facing controls: scam-awareness messaging that mirrors HKICL's own "we will not contact you directly" line, transaction-monitoring tuned to the mule and top-up patterns these virtual-wallet lures generate, and fast takedown and alerting when a spoofed domain surfaces.
It also fits Hong Kong's broader push to harden the financial system against fraud, from the HKMA's work backing wider use of AI by banks to fight financial crime to the regional scramble to give authorities faster tools against scam infrastructure, such as Singapore's new Scams Bill. The primary advisory, including the exact fraudulent addresses HKICL identified, is available in the HKICL press release.
