First published: 12th August 2016
BNP Paribas and the Hong Kong Monetary Authority have issued warnings about websites purporting to be official websites of BNP Paribas or of its affiliates. One URL, bnpparibas-abstract-expressionism.com, goes to a different website at the time of writing, the site was probably served by virtual hosting and has been shut down, leaving the original website available. The second fraudulent website, tempus-bnpparibas.com, was still available and is served by SSL "secured" by a self-signed certificate. The certificate was for "Parallels Panel", which probably indicates that it was issued by the Parallels Plesk Panel control panel used on several hosting sites. Recent, normally configured browsers will give a warning that the certificate is untrusted, although users can still choose to ignore the warning to access the fraudulent site.
Victims should contact the Hong Kong Police Force or BNP Paribas at +852 2909 8888.