The Hong Kong Monetary Authority published a scam alert on 8 October (a public notice about a bank that does not say which bank). A bank told the regulator that fake websites, fake internet banking login screens and phishing emails were circulating under its name. The HKMA's release says the bank's own press release is linked on hkma.gov.hk. So the reader goes to a second page to learn whose customers are being targeted.

The rule the notice repeats is short. Banks do not send an SMS or email with a link to their website to do a transaction. They do not ask for a login password or a one-time password by phone, email or SMS. A customer who tapped a link, typed details or sent money is told to contact the bank using the contact details in that bank's release, then report to the Police Crime Wing Information Centre on 2860 5012.

For a compliance head the document to read is not this one. HKMA's public notices are press-office republications of warnings from the HKICL and the police, and they change nothing a bank must do. The obligations sit elsewhere. Supervisory Policy Manual module TM-E-1 covers customer authentication, notifications to customers and automated fraud monitoring across Internet banking and phone banking. The Banking Conduct Department supervises compliance with the Code of Banking Practice, which caps a cardholder's liability for unauthorised transactions at HK$500 where the cardholder has not acted fraudulently or with gross negligence and has reported promptly. The same code gives customers 60 days from the statement date to report an unauthorised transaction.

That 60-day window is where an unnamed phishing campaign turns into a bank's complaints queue. A customer who was tricked by a fake login screen and sees the charge on a later statement has 60 days from the statement date to say so, and the bank's fraud monitoring either caught the transfer or it did not.