Monday, 28 September, produced three scam notices from two regulators on the same day. The HKMA press office put up "Scam alert related to banks" (release 20260928-3) and "HKICL alerts public of fraudulent website" (20260928-4). The SFC published release 26PR157, sharing updates with the securities industry on scam prevention and cybersecurity, applying to licensed securities firms.

The three look alike in a news feed (they are not the same kind of document).

The two HKMA items are public notices, press-office republications of HKICL and police warnings. They go to the customer and change no obligation for any bank. They are also not the work of the Enforcement and AML Department, which is easy to assume from the word "scam" and wrong.

The SFC item is addressed to the industry it licenses. Licensed corporations are the ones in scope, and that is the only one of the three that lands on a compliance calendar. So the SFC release is the one to read in full, and the HKMA alerts are the ones to forward to the retail-facing staff who will field the calls.

Look, I have the SFC's one-line description of the update and not its body text, so what it asks of firms is in the release itself and not in anything I can summarise honestly here. The SFC's 2026 circular on enhanced cybersecurity measures against AI-enabled cyberattacks (ref 26EC32) is the existing instrument on the same ground, and the 2018 internet trading guidelines already require two-factor login and prompt client notification. Whether 26PR157 adds to either is the question its text answers.

The conclusion for a licensed securities firm: on 28 September the SFC put scam prevention and cybersecurity in front of the industry in release 26PR157, and the two HKMA alerts issued the same day bind no one.