Security Tips

At HSBC, security is a top priority. We are constantly reviewing our efforts and upgrading our systems to ensure that your accounts are secure. However, security is a joint effort, so please view the sections below for handy hints on what measures you can take.

Bogus Communications

The Hongkong and Shanghai Banking Corporation Limited would like to alert its customers on bogus communications that claim to be from HSBC (e.g. fraudulent telephone calls, voice messages, emails, SMS and communications in other formats):

  • Customers are reminded not to provide any company or personal information to unsolicited callers. If customers are concerned they may have disclosed their company or personal details to any suspicious third parties, or want to identify whether the communication is from our bank they should call the Commercial Banking Service Hotline at +852 2748 8288 or report to the Police.
  • Techniques such as voice message phone calls or fraudulent SMS messages are being used to trick bank customers into calling bogus bank hotline numbers. We would like to inform customers that the Bank has no connection with these bogus communications.
  • Suspicious voice message phone calls made from Interactive Voice Response system claiming to be from HSBC, disclosed that there are irregularities detected from the customers banking account or commercial cards, and requested customer to input company or personal information or contact operator for account authentication. Customers can know more on tips from our how to identify a fraudulent call and what you can do.
  • Fraudulent SMS messages purportedly to be sent from a bank claimed that there were commercial cards transactions conducted using a customer’s commercial cards, and request the customer to call a bogus hotline number mentioned in the messages to check the commercial cards transactions. If customers find the service hotline number is suspicious, customer should verify the hotline numbers with the Bank before calling rather than just following the information provided in SMS messages.
  • HSBC has not authorised or appointed any intermediaries to conduct telesales marketing activities for promotion of commercial lending and commercial cards.
  • Click here to watch the TV Announcement in the Public Interest (API) jointly produced by the Hong Kong Monetary Authority and the Hong Kong Association of Banks and relevant materials to understand how to safeguard yourself from bogus calls purported from banks.
  • Everyone should be wary of online phishing scams. Phishing is an attempt by criminals to 'fish' for personal information such as the security credentials you use for online banking/purchase, or to convince you to click an embedded malicious file/link. Someone can send you an e-mail/SMS which appears to come from your bank or an organisation you have registered with. The e-mail/SMS asks you to click on a link and/or to confirm your username or password and in this way they obtain your details.
  • HSBC will not send e-mails to customers requesting or containing security or confidential details, such as ID numbers, account log-on details or memorable word information. We will never ask you to enter or confirm your security details. By contrast, this is typically what a phishing e-mail does when it tries to obtain your security details. We will send you e-mails with important service information such as planned outages and enhancements. Any links within these e-mails will only take you to product and service information pages and not to any page where you will be asked to log in and provide personal information
  • If you are suspicious of an e-mail that claims to come from HSBC, delete the e-mail without opening it. This caution should apply to all unexpected e-mails with links or attachments.

Log on to Business Internet Banking

  • Business Internet Banking users should follow the logon instructions printed on the back of the security device.
  • The green button on the HSBC security device is used to generate security codes for Business Internet Banking logon whilst the yellow button is mainly for transferring funds to non-registered third party accounts.
  • The logon process does not require customers to enter any numbers generated by the web to the security device.
  • If unusual screens pop up and/or the computer's response is unusually slow, log out from Business Internet Banking completely and scan the computer with the most updated version of virus protection software.


  • Do not use personal words or numbers that are easily identified as your password(s).
  • Avoid using names, birthdays, phone numbers, ID numbers, ATM or Phonebanking PINs.
  • Choose a username and password that you can easily remember but difficult for someone else to guess. For example, use a combination of letters and numbers in both upper and lower case.
  • Keep your username and password confidential. Memorise your password and do not write it down or reveal it to anyone.
  • Change your password on a regular basis.
  • Do not disclose your password to anyone claiming to act on behalf of HSBC. Remember that no one at HSBC will ever ask you for your password.

Your Online Banking Session

  • Before you logon to Business Internet Banking, ensure all other Internet sessions are closed. If you have an Internet Banking session open, we recommend that you do not open additional Internet browser sessions.
  • Customers should ensure that they are connected to a valid HSBC domain and not rely solely on the look and feel of the website when they use the HSBC’s Business Internet Banking services. They should not enter their user names and passwords if they find the website suspicious.
  • Customers should always access their Business Internet Banking accounts by keying in the website address at the address bar of the browser, or bookmark the website and use that function to access their Business Internet Banking accounts.
  • No icon will be displayed during an unencrypted session.
  • We strongly recommend you do not conduct your banking transactions in public places such as cyber cafes.
  • Always remember to logoff properly when you have completed your banking activities and then close the browser window immediately.
  • Always disconnect from the Internet once you have finished and avoid leaving your computer online while you are not using the service.

Making Payments Online

  • When making payments to an unregistered third party, always ensure the input to the security device are extract of your intended beneficiary account number before using the 'Yellow' button. Never enter digits that are unfamiliar to you.
  • Check the identity of supplier or beneficiary by phone before effecting payment to a new account.
  • Review the payment details sent via SMS for third party payments done via internet banking.
  • If your mobile phone number has been changed, you should notify the bank to update your record immediately.

Firewall & Anti-virus Protection

  • We strongly recommend that you install firewall and virus protection software on your computer or Local Area Network (LAN).
  • HSBC has teamed up with Webroot - a leading supplier of cloud-based endpoint security solutions - purchased Anti-Virus licenses (valued at $49 USD each) for all our Business Internet Banking customers and you can now download for free. Click here for details.
  • Firewall and virus protection software is available in the market. Reputable firewall and virus protection vendors will provide regular software updates to ensure that you are protected against new hacking attempts.
  • Always download new browser security patches whenever they are available. They are designed to provide you with protection from known security problems.
  • To prevent viruses or other unwanted problems, do not open email attachments unless you know they are from a safe and reputable source.
  • Do not install pirated software or software from unknown providers.

Workplace Controls

  • Do not use shared computers to access Business Internet Banking.
  • Check to see that the computer environment you are using is safe. Make sure nobody can look over your shoulder or see your screen.
  • After you have accessed Business Internet Banking, do not leave your computer unattended.
  • If you cannot restrict physical access to your computer, you can prevent unauthorised access to the information on your computer by using passwords effectively.
  • In addition to the above controls, we strongly recommend that you install firewall and virus protection software on your computer.
  • Only use reputable computer repair and maintenance vendors to ensure you have adequate security.

Call Centre Support

Please call our 24-hour call centre on 2748 8288 immediately, if you encounter any of the following issues:
  • You forget or lose your password.
  • You suspect some unusual account activity or the last logon time-stamp is incorrect.
  • There are unauthorised transactions on your accounts.
  • You suspect your security has been compromised in any way.
  • You lose your Security Device

Contact us

You are leaving the HSBC Commercial Banking website.

Please be aware that other site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.

You are leaving the HSBC Commercial Banking website.

Please be aware that the external site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.