Last updated: 31 May 2021
Phone calls can be used maliciously to facilitate theft and fraud. This type of fraud is known as ‘vishing’. Be vigilant. Thieves now have various clever ways to steal information for fraudulent purposes.
How does vishing work?
Vishing (or voice phishing) happens when a fraudster calls to 'fish' for personal information over the phone. Fraudsters will often create a sense of panic to get a quick response over the phone. For example, they may pretend to be a senior colleague or a customer in a rush or requiring urgent assistance.
They may try to direct you to perform actions which would result in payments being sent to the criminal. This could include asking for security codes.
HSBC will never request you to provide the one-time security code from your Security Device or mobile device over the phone. We’ll also never ask you to undertake actions using your Security Device (except during the initial setup of your profile). This is not information that HSBC requires to verify any activity.
Vishing in the real world We’ve investigated cases where fraudsters have called our customers pretending to be from the HSBC fraud team. The caller ID even displayed a spoofed HSBC phone number, making the call seem legitimate. How money gets stolen The fraudster says they’re calling because they’ve seen possible fraudulent account activity and they want to verify recent payments. They’ll raise alarm by listing one or more fake transactions and asking if they’re valid or not. They’ll claim that they need to obtain logon credentials and Security Device codes in order to stop these payments. This is the critical point in the call - once provided, they’ll use these security details to log on to HSBCnet and send fraudulent payments. Never provide one-time security codes from your Security Device or mobile device over the phone. Sometimes, to make the call appear legitimate, the fraudster may provide a fake reference number to close out the call. Be cautious and protect yourself If you ever receive an unsolicited call claiming to be from HSBC, do not provide any information. You should end the call immediately and call your HSBCnet Support Centre or HSBC representative to verify if the call is genuine. |
|---|
Using your Security Device’s yellow button
The yellow button on your Security Device should only be used to authenticate transactions. We will never ask you to use the yellow button when you log on to HSBCnet (unless you are activating your Security Device for the first time).
Find out more
Additional information about vishing and other types of fraud is available in our Protecting your business page.
If you suspect you have been the victim of fraud, contact your HSBC representative immediately.