Gallery
Fake HSBC Verified by Visa page, with Wikipedia text hi-resFirst published: 05th June 2014
The Hong Kong Monetary Authority (HKMA) has warned about e-mail purporting to be sent from The Hongkong and Shanghai Banking Corporation Limited (HSBC). The e-mail requests customers to use an embedded hyperlink to visit a webpage that mimics HSBC's Verified by Visa page.
Anyone that has followed the fraudulent instructions should contact HSBC at 2233 3000, and any local police station or the Commercial Crime Bureau of the Hong Kong Police Force at 2860 5012.
HKMA listed two example webpages linked from the fake emails: “http://www.elka.sklep.pl/tmp/” and “http://www.distribeauxarts.com/img/”. At the time of writing, the text on one of the pages included a description of the 3-D Secure protocol that was lifted almost word-for-word from Wikipedia. The links for policies went to HSBC's own policy pages. The server addresses, 213.186.33.19 and 213.186.33.48, are in the same block in France, suggesting that the criminals scanned the block for vulnerable webservers, uploaded their fake pages to each one and sent out batches of fraudulent messages with each address.
An HKMA Spokesperson advised, "Members of the public are reminded not to access their Internet banking accounts through hyperlinks embedded in e-mails, Internet search engines or suspicious pop-up windows. Instead, they should access their Internet banking accounts by typing the website addresses at the address bar of the browser, or by bookmarking the genuine website and using that for access. In addition, banks are not expected to send e-mails asking their customers to provide their account information (e.g. Internet banking logon passwords) or verify their account information online. If in doubt, they should contact their banks".
