Hong Kong Securities and Futures Commission warns public on phishing text messages impersonating licensed corporations and restricts firms’ use of embedded hyperlinks

The Hong Kong Securities and Futures Commission (SFC) has issued an alert warning the public about phishing mobile text messages with embedded hyperlinks that purport to be sent by SFC-licensed corporations (LCs), following reports of clients suffering financial losses after leaking personal data. The SFC also highlighted its requirement that LCs must not send electronic messages containing embedded hyperlinks that direct clients to their websites or mobile applications to undertake transactions, and must not use hyperlinks to request sensitive personal information. The SFC said the phishing links redirected clients to webpages closely resembling LCs’ genuine sites, where victims were lured into entering account login details before unauthorised transactions were conducted. It urged the public not to click on hyperlinks in such messages, to verify authenticity directly with the relevant LC if in doubt, and never to provide login information to unverified websites, even if they appear genuine. Anyone who has disclosed credentials or detected unauthorised account activity should contact their LC promptly and report the case to the Police; the SFC noted that sensitive information targeted can include login names, biometric identifiers, passwords and SMS one-time passwords, and referenced paragraph 22(b) of its February 2025 thematic cybersecurity review of licensed corporations.