The Hong Kong Monetary Authority (HKMA) issued a public scam alert on November 9, 2026, following reports of fraudulent websites, internet banking login screens, and a mobile application targeting China Construction Bank (Asia) Corporation Limited.
Fraudulent app and login screens
The HKMA alerted the public after China Construction Bank (Asia) Corporation Limited issued a press release regarding scams mimicking its services. The fraudulent activities involve fake websites, internet banking login screens, and a mobile application designed to trick users.
Hyperlinks directing to the official bank press release have been published on the HKMA website.
Bank security guidance
The monetary authority reminded the public that legitimate banks will not issue SMS messages or emails containing embedded hyperlinks directing users to complete transactions on their websites.
HKMA also noted that banks will never request sensitive customer information, such as login passwords or one-time passwords, by phone, email, or SMS.
What to do
- Contact China Construction Bank (Asia) using the details provided in its official press release if you provided personal information or conducted financial transactions through the scam.
- Report any unauthorized transactions or exposed personal details to the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012.
- Do not click on embedded hyperlinks in SMS messages or emails claiming to direct you to bank websites to carry out transactions.
- Never share sensitive information such as login passwords or one-time passwords via phone calls, emails, or SMS.
Key facts and where they come from
- The Hong Kong Monetary Authority issued an alert concerning fraudulent websites and internet banking login screens impersonating a bank.
The Hong Kong Monetary Authority (HKMA) wishes to alert members of the public to the press release issued by the bank listed below relating to fraudulent websites, internet banking login screens
- The HKMA stated that banks will not send emails or SMS messages with embedded links for completing transactions.
The HKMA wishes to remind the public that banks will not send SMS or emails with embedded hyperlinks which direct them to the banks' websites to carry out transactions.
- Individuals affected by the scams are instructed to report the matter to the Hong Kong Police Force Crime Wing Information Centre at 2860 5012.
report the matter to the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012.
The open question: How did attackers distribute the malicious mobile application pretending to be China Construction Bank (Asia)?
Tell us what you think · Discuss it in the Threat Intel room
Hacking Techniques tracker: how this works, how it is advancing and how to defend — Phishing and session hijacking
