The supposed banking shortcut asks you to do something your bank says it never asks. Click an emailed or texted link to transact. Give someone your password. Hand over a one-time password. Convenient, apparently. Until you read the bank’s own rules.

Banks have reported fraudulent websites, fake internet banking login screens, phishing emails or other scams to HKMA. That prompted its October 15 alert. The useful detail is plain: banks do not send transaction links by SMS or email. They do not ask for passwords or one-time passwords by phone, email or SMS either. Looking like banking is how the request gets through the door.

Already supplied information or made a transaction? The notice says to contact the relevant bank using details in its press release. Report the matter to the police Crime Wing Information Centre on 2860 5012. That instruction applies even if you shared information without sending money.