Social engineering scam & phishing｜Security Centre

Have you ever received the following types of email, SMS, phone call, or spam messages over instant messengers etc.?

Does it ask you to do something unusual, like transfer money to an unknown account, or email your account details to someone?
Warns you of some sudden change in an account which means you have to click hyperlink and confirm you still use the service
Asks for confidential or security information such as your online banking details, passwords, account numbers or PINs

Table of content

Social engineering scam and phishing

What is a social engineering scam?
What is Phishing?
What to do if you encountered phishing?

Understand common types of phishing attack

Social engineering scam and phishing

What is a social engineering scam?

How social engineering works

Social engineering works by gaining someone’s trust and getting them to disclose information that should be kept secure.

Scammers usually contact people by phone (vishing), text (smishing), email (phishing) or Spam over instant messaging (SPIM). They’ll claim to be someone in a position of trust, such as bank staff, representatives of telecoms or utility companies, or even the police. Having gained the person’s trust, they’ll then ask for sensitive information or things which will enable them access to the person’s bank accounts.

There are things your bank would never ask for, such as:

your 4-digit PIN
online banking codes like your secure key or password

Your bank would also never ask:

your credit or debit cards or verification code (OTP) for internet purchase or digital wallet binding
transfer funds to a different account for 'safekeeping'

What is Phishing?

What is Phishing?

Phishing is when a criminal sends you an email that tries to get you to give them your passwords and bank details or clicks the embedded links, QR code or file attachment to implant malware to the victim’s device. The email will say it is from a legitimate organisation or companies like a bank, online payment service or online retailer. It often looks very similar to an actual email sent by those organisation or companies, and it will contain a link or QR code that takes you to a website that also looks very similar to the organisation or companies’ genuine site.

Once you arrive at the fake site, it will usually prompt you to enter personal security information, such as your account number, PIN or security code. The phishing site records everything you enter, and then uses your information to steal your money or conduct credit card or bank account fraud.

Understand common types of phishing attack

What to do if you encountered phishing?

What to do if you receive a suspicious email/SMS

HSBC may send you emails from time to time but will never ask for your security information or encourage you to log on to Internet Banking. HSBC will never attach a link to a web page that would ask for this information. If you receive an unsolicited email from HSBC encouraging you to do this, it will be a "Phishing" email.

To report phishing websites, smishing texts or suspicious emails which have requested personal banking information contact us via phishing@hsbc.com. We’ll send you an automatic response to let you know we’ve received your email but are unable to provide personalised responses to this mailbox.

Please ensure you copy the full email, smishing text or website address (URL) into the body of the email.

Please do not send any personal customer verification details within the email.

Kindly note emails will be processed by a third party on behalf of HSBC Global Services (UK) Limited and by HSBC Group companies.

If you believe you have shared your confidential information either online, by telephone or any other means call us immediately using the telephone number on the back of your card or the customer service hotline recorded on our HSBC Official website.

Understand common types of phishing attack

Be wary of unsolicited emails that appear to be from your bank or another trusted organisation (government tax institution) and contain links to websites urging you to provide confidential, personal, or financial information. For example, emails urging you to log-in to online banking, provide confidential data, or fake offers or promotions with links that direct you to external websites.

Phishing emails typically:

claim to be from a legitimate source and often accompanied by a threatening language
warn you of some sudden change in an account which means you have to confirm you still use the service
sometimes have poor spelling and grammar
ask for confidential or security information such as your online banking details, passwords, account numbers or PINs
include instructions to reply, complete a form or document attached to the email or click through to a website to verify your account
contain promotional offers that prompt you to click the link or provide personal data

If an email looks suspicious, don’t reply to it. Don't click on any links. Don't open any attachments. Conduct thorough research.

View some examples of phishing emails

Always remember:

the official domain of our website is www.hsbc.com.tw
double check the sender ID, beware of messages impersonating the bank
stay alert when you are directed to any website

The following email domain is not the official domain of HSBC Taiwan, HSBC Taiwan’s official domain is www.hsbc.com.tw

Sample phishing email 1 from suspicious sender - not from the official domain of HSBC Taiwan

The following email domain is not the official domain of HSBC Taiwan, HSBC Taiwan’s official domain is www.hsbc.com.tw

If you have any questions or concerns regarding the email you have received, please refer to HSBC Taiwan’s official announcement and link as reference.

Sample phishing email 2 from suspicious sender - not from the official domain of HSBC Taiwan

Criminals call out of the blue and may claim to be your bank, the police or another trusted organisation like your broadband provider. To make the call seem more convincing they may already have some information on you, such as your account number, address and even some account details. They can also make the call seem authentic by making their phone number look like a number you know and trust. This is known as 'number spoofing'. The caller will then try to persuade you to:

transfer money to another account for 'safekeeping' or 'holding'
withdraw cash and hand it over 'for investigation'
give private information, which can then be used to gain access to your finances or conduct card internet transaction or digital wallet binding

If a phone call sounds suspicious, don’t disclose sensitive personal information. Conduct thorough research.

Another thing to watch out for is suspicious text messages that look like they have come from HSBC or another trusted organisation. These may be sent by criminals trying to trick you into giving your personal and financial information (by calling a number or clicking a link).

It's important to remember the following:

Banks and other organisations such as the police or service providers will never ask you for your full PIN, password or banking codes.
Fraudsters can mimic text headers so that their messages can join a conversation beneath ones you know are genuine.

If a SMS looks suspicious, don’t reply to it. Don't click on any links. Don't open any attachments. Conduct thorough research.

See some examples of phishing SMS

Always remember: