The Securities and Futures Commission (SFC) today warns the public of phishing mobile text messages with embedded hyperlinks purportedly sent by SFC-licensed corporations (LCs). Several LCs have reported to the SFC that their clients received such phishing text messages and suffered financial losses as a result of leaking personal data.
These LCs’ clients were directed to webpages in close resemblance to the LCs’ real websites after clicking the embedded hyperlinks. The clients were then lured into entering their account login details (Note 1). Unauthorised transactions later conducted over the accounts led to financial losses for the clients.
The SFC has required LCs not to send electronic messages (such as email or short message service (SMS)) with embedded hyperlinks that direct clients to their websites or mobile applications to undertake transactions, and not to ask clients to provide via hyperlinks sensitive personal information, including login credentials and one-time passwords (Note 2).
The SFC reminds members of the public to stay alert to any mobile text messages purportedly sent by LCs, and not to click on the hyperlinks embedded in these messages. If in doubt, they should confirm with the LCs directly. Under no circumstances should they disclose their account login information to any unverified websites, even if they look genuine.
If members of the public have disclosed their account login details to unverified websites or have found unauthorised transactions conducted over their accounts, they should contact their LCs as soon as possible and report the case to the Police.
Notes:
- These included login names, biometric IDs, passwords and/or SMS one-time passwords.
- For details, please refer to paragraph 22(b) on p.9 of Report on the 2023/24 thematic cybersecurity review of licensed corporations (February 2025).
