New Wave of Phishing SMSs Purportedly from HSBC, Hongkong Post and Douyin, Alleging Deduction of Charges
2025-10-15
New impersonated organisations in phishing SMS scams! The Anti-Deception Coordination Centre (ADCC) discovered that scammers recently, posing as the Hongkong and Shanghai Banking Corporation (HSBC), sent abundant SMS notifications claiming that “You have renewed the membership of Douyin”. They also, posing as Hongkong Post, sent phishing SMSs claiming “Incorrect address information / delivery failure”. The ADCC warned members of the public not to call phone numbers in SMSs or click on suspicious URLs to avoid falling prey to scams. [phishing SMSs / bogus customer service / cancel subscription renewal]
Defrauding Tricks
1. Scammers, posing as HSBC, send phishing SMSs to members of the public and claim that “You have subscribed to an organisation’s services or have become its member. Charges have been automatically deducted from your bank account”, along with a customer service number to lure victims to call for “cancelling subscription”;
or, posing as Hongkong Post, send phishing SMSs claiming “Incorrect address information / delivery failure” and asking the recipients to fill in information on a fraudulent website.
2. If you call back or visit the fraudulent website, a bogus customer service officer will trick you into entering your financial information on the website in an attempt to steal your online banking usernames and passwords.
Flaws in Scams
1. Inflated charges
To pressure victims into responding quickly, scammers deliberately claim in the SMSs that inflated fees, ranging from several thousands to tens of thousands of dollars, has already been deducted;
2. Some of the impersonated organisations do not even offer paid membership services;
3. Some SMSs contain spelling errors.
Scammers may pose as the following organisations (not exhaustive) when sending phishing SMSs:
HK01
HOY TV
NOW TV
YouTube Premium
Binance
IBKR
uSMART
Futubull
China Mobile
SF Express
Cainiao
Keeta
Foodpanda
Our Advice
Do not rashly call phone numbers in SMSs;
Do not log on to any websites or download any attachments by hastily clicking on hyperlinks embedded in emails, SMSs or web pages;
You may enter suspicious information on “Scameter” of CyberDefender or “Scameter+”, the mobile application of “Scameter”, for security check in addition to seeking verification from relevant organisations;
If in doubt, please call the “Anti-Scam Helpline 18222” for assistance.
