Chong Hing Bank - Security Tips (2024)

Security Tips for using Internet Banking and Mobile Banking

The Bank is serious about online transaction security and strongly recommends you to learn more about the protection and the securitymeasures we have put in place for you and read our security tips regularly. Unless otherwise specified in the following tips, Internet Banking includes Personal Internet Banking and Corporate Internet Banking of the Bank, and Mobile Banking includes Personal Mobile Banking and Corporate Mobile Banking of the Bank.

Beware of phishing emails, SMS and fraudulent websites. Please do not download or open suspicious or unknown files and hyperlinks through SMS, emails, web pages or social media. The Bank will never send you any email or SMS with hyperlinks that request you to login Chong Hing Internet Banking or Mobile Banking Services. The Bank will not ask you to provide any sensitive personal information, such as (a) Bank account number, (b) Internet Banking logon ID and password, (c) One-time passwordor verification code and (d) credit card number, through emails, SMS, phone calls or instant messaging Apps. Customers are reminded NOT to access Chong Hing Internet Banking Services through hyperlinks embedded in any emails or Internet search engines.

Scameter – The one-stop scam and pitfall search engine
If you encounter suspicious calls , online sellers, friend requests, job ads, investment websites, etc., you can make use of the “Scameter”, a search engine launched by the Hong Kong Police Force, to assess the risks of fraud and cyber security by entering the relevant platform account name/number, payment account, phone number, email address, URL, etc.
Please access the “Scameter” and learn about the relevant information via the following URL: www.CyberDefender.hk

1. Be Vigilant of Fraudulent Websites and Emails and Mobile App
2. What We Have Done to Protect You in Using Internet Banking Services and Mobile Banking Services Safely
3. How to Use Internet Banking Services and / or Mobile Banking Services Safely
4. Common Online Fraud
5. Frequently Asked Questions

I. Be Vigilant of Fraudulent Websites, Emails and Mobile Application

• Please access our Internet Banking or Mobile Banking by visiting our official website (www.chbank.com) or through our mobile application. You may also bookmark the Bank's website address for subsequent access. Please be vigilant of any fraudulent websites. You should ensure that you are connected to the Bank’s website before you provide any information related to Internet Banking Services.
• Please do not disclose your online banking credentials to third parties or log on to Internet Banking / Mobile Banking through any hyperlinks, QR codes or attachments provided in emails, SMS, Internet search engines, social networking platforms or any other third-party websites.
• Beware of any unusual logon screen and process (e.g. a suspicious pop-up window which requests for providing additional personal information and / or unusually slowcomputer response), do not follow the instructions of the suspicious web page or input any personal data, and log out of Internet Banking immediately. Please contact us immediately in case of any suspicious logon, unusual transaction or situation.
• The Bank will never request customers to install or update Chong Hing Mobile Banking App through SMS or emails.
• SMS and email notification will be sent to you if your information (e.g. login passwords, contact information, birthdates or full names) has been changed or reset. Please contact us immediately if you did not perform such action.
• If you receive a "One-time SMS Password" sent by the Bank, you must check carefully the contents of the SMS including the payee details, merchant name, transaction amount or transaction nature, and avoid using the auto-fill function of mobile devices or computers, which may result in passwords being sent directly to fraudulent websites for illegal transactions.

II. What We Have Done to Protect You in Using Internet Banking Services and Mobile Banking Safely

• We use the encryption technology of Transport Layer Security (TLS1.2 or above) to assure the confidentiality of your personal information and transaction data during transmission on the Internet.
• Our web servers are protected by firewalls to prevent unauthorised access.
• If you forgot to log out of Internet Banking Services or Mobile Banking Services, your online access will be disconnected automatically after a short period of inactivity to prevent unauthorised transaction.
• If five consecutive incorrect logon attempts were detected, your Internet Banking Services and Mobile Banking Services would be suspended immediately.
• If any of your accounts has been frozen after a period of inactivity, you will not be able to operate the related accounts through Internet Banking or Mobile Banking.
• The bank's Internet Banking Services related SMS(including One-Time Password) will only be sent to your registered mobile phone number. The message will not be forwarded even you have enabled "SMS Forwarding Service” provided by the telecommunication company.

III. How to Use Internet Banking Services and / or Mobile Banking Services Safely

1. Take Precautionary Measures while You Are Using:

Internet Banking Services

• Please make sure you access our Internet Banking Services through the Bank's official website(https://www.chbank.com)before logging in.
• Do not logon to Internet Banking Services by using public computers in public areas such as cyber cafes or bars.
• When using Wi-Fi connection, use trusted Wi-Fi networks or service providers instead of public Wi-Fi. Enable security protection such as Wi-Fi Protected Access (WPA, a security protocol to secure wireless computer networks) while logging on to Internet Banking.
• Please pay attention to your wireless network security:
  • Set a personal and unique password for your wireless network
  • Hide your network name (SSID-Service Set Identifier).
  • Use encryption to protect your wireless network.
  • Use only registered computers to connect to your wireless network.
• Do not disclose the security setting of your wireless network to any third party.
• Do not logon to Internet Banking Services through hyperlinks embedded in emails, SMS, applications, social networking sites, suspicious pop-up window or internet search engines' results.
• Ensure other browser windows are closed before logging on to Internet Banking Services. Please logout Internet Banking Services before visiting other webpages.
• Make sure no one can see your Customer Reference Number, Logon Name and Password when logging on to the Internet Banking Services.
• Always check the date and time of your last Internet Banking Services logon. Contact us immediately if you are in doubt of the accuracy of theinformation displayed.
• Always use the "logout" button to exit and close the browser after using Internet Banking Services.
• Do not leave your computer unattended before logout.
• Review your online transaction limits regularly and make necessary adjustments to manage risk.
• Check youraccount balance and transactions regularly and notify us immediately if you detect any errors or unauthorised transactions.
• Check the Bank's SMS messages and other messages in a timely manner and verify your transaction records. Inform the Bank immediately in case of any suspicious situations, regardless of the amount. If any of your contact information has changed, please complete and return theformto any branch of the Bank or contact our branch staff.
• Company user is recommended to set up a dual authorisation (Joint Authorities) for financial transactions on Corporate Internet Banking to enhance security and the accuracy of transaction details.
• Verify carefully the transferee’s account number and transfer amount before confirming a fund transfer instruction. In case of any transfer to a wrong account by mistake, contact the Bank for assistance as soon as possible. However, the Bank can only transfer back the fund upon getting the transferee’s consent. If the transferee is not cooperative or refuses to return the fund, the transferor should consider reporting to the Police. Besides, anyone who discovers a deposit to his/her account with Chong Hing Bank from an unknown source should report the matter to the Bank immediately, otherwise, he/she can be held criminally liable.
• When receiving a scam alert on the payee during fund transfer, you must verify the payment details and confirm the payee is trustworthy before processing the fund transfer.

Mobile Banking Services

• Download Chong Hing Mobile Banking App from our bank web site or from official app stores only. Please visit Apple App Store / Google Play and search 'Chong Hing Bank' to download it for free.
• Configure proper security settings on your mobile device (e.g. disallow any permission to install apps from unknown sources). Do not install or run applications with unknown sources on your mobile device. Do not use untrusted custom virtual keyboards.
• Install from reliable sources and update the latest anti-virus and anti-spyware software regularly on your mobile device, whenever they are available.
• Review app permissions and ensure permissions requested are appropriate for the type of app being downloaded. Do not authorise any unnecessary access permission when installing software / app.
• Check what apps are running in the background mode and stop unnecessary apps from running.
• Do not save your mobile banking account's Logon Name, Password and PIN for Mobile Token in your mobile device.
• If you use face recognition (Face ID) to verify your identity, the following are three recommendations in relation to your use of Face ID:
  • DO NOT disable the “Require Attention for Face ID” function in your device settings;
  • DO NOT register Easy Logon Service and Mobile Token Service if you have an identical twin sibling or relatives who look very alike; and
  • DO NOT register Easy Logon Service and Mobile Token Service if you are an adolescent while your facial features may be undergoing a rapid stage of development.
• The Bank will not collect your fingerprint / Face ID. If you have any concerns about the fingerprint / Face ID stored on your device after termination of Easy Logon Service or / and Mobile Token Service, you may consider removing the fingerprint / Face ID.
• Set a password for your mobile phone that is difficult to guess and activate the auto-lock function to prevent unauthorised access of your mobile device. Utilise the extra security measures provided by your devices, if available.
• Use the latest versions of Operating System, Mobile App and Browser. Do not use any jailbroken or rooted （"Cracked version"）mobile device which may have security loopholes.
• Use default browsers originally provided by the mobile device rather than newly installed browsers downloaded from other sources.
• Get connected via the services provided by your mobile telecommunication operator or a trusted Wi-Fi instead of public Wi-Fi when logging on to mobile banking service.
• Disable any wireless network functions (e.g. Wi-Fi, Bluetooth, NFC) not in use. Choose encrypted networks when using Wi-Fi and remove any unnecessary Wi-Fi connection settings regularly.
• Regularly remove sensitive or confidential SMS messages if they are no longer required, as well as browser'scaches and browsing history stored in your mobile device.
• Make sure no one else is peeking at your logon name, password or sensitive information when you are logging into your mobile banking service.
• Always check the date and time of your last Mobile Banking Services logon. Contact us immediately if you are in doubt of the accuracy of any information displayed.
• After logon to Mobile Banking Services, please logout before visiting other Mobile apps.
• Always remember to log out of your Mobile Banking account after use by clicking the 'logout' button. Do not leave your mobile device unattended before logout.
• Check youraccount balance and transactions regularly and notify us immediately if you detect any errors or unauthorised transactions.
• Please verify the transaction details (including the mobile number, email address and amount) carefully before making payment or payment request via FPS. Embedded in the QR code generated by you is the information you inputted, such as mobile number, email address and amount (if applicable). No other information on your bank account will be embedded. The bank will not store your inputted mobile number or email address. Please safeguard your generated QR code to prevent fraudsters from stealing your personal information for unlawful use.
• Verify carefully the transferee’s account number and transfer amount before confirming a fund transfer instruction. In case of any transfer to a wrong account by mistake, contact the Bank for assistance as soon as possible. However, the Bank can only transfer back the fund upon getting the transferee’s consent. If the transferee is not cooperative or refuses to return the fund, the transferor should consider reporting to the Police. Besides, anyone who discovers a deposit to his/her account with Chong Hing Bank from an unknown source should report the matter to the Bank immediately, otherwise, he/she can be held criminally liable.
• When receiving a scam alert on the payee during fund transfer, you must verify the payment details and confirm the payee is trustworthy before processing the fund transfer.

2. Safeguard Your Password, PIN, Customer Reference Number, Logon Name and Personal Information including Biometric Authentication

• Change yourPassword immediately when using your Internet Banking Services for the first timeand destroy any documents containing the password information.
• Keep your Password, PIN for Mobile Token, Customer Reference Number, Logon Name and personal informationconfidential and in a secure place. Do not write down or record the password or PIN without disguising it.
• Do not disclose your Customer Reference Number, Logon Name and Password, PIN for Mobile Token or SMS-based one-time password to anyone (including bank staff and the police).
• Do not write down or store any login information, PIN for Mobile Token or SMS one-time password issued by the bank on any devices that are used for accessing Internet Banking / Mobile Banking and any accompanying or nearby objects.
• Please seta username that is safe and difficult to guess and a password that is different from the ones for other services and change your password regularly.The password should be changed regularly and should never be stored in computers, mobile phones or placed in plain sight.
• Avoid storing anyone else’s fingerprint or biometric credentials in your device. Do not share your mobile device with others. Remember to use your own mobile device to log on to Mobile Banking Services.
• Change your password regularly, or when there is any suspicion that it has been compromised or impaired.
• Use different passwords for different services.
• Do not allow anyone to operate your Internet Banking Services or Mobile Banking Services account.
• When you are using someone else’s computer or mobile device to perform transactions, ensure that you have cleared the cache after logging out to make sure thatyour Password is not copied or stored in the computer or mobile device.
• Safeguard your mobile device and do not leave your mobile device unattended.
• Never respond to unsolicited communications (including emails, phone calls, and texts). Do not disclose your personal data or bank account details to unsolicited callers or pre-recorded voice message phone calls. If you have received suspicious calls purporting to be from Chong Hing Bank, please contact us immediately by calling our Customer Services Hotline to verify.
• Always be careful when you release details that can identify you, including birthdates, phone numbers, addresses and full names.
• Keepus updatedabout your latest contact information.

3. Secure Your Computer or Mobile device

• Ensure you are using supported versions of Operating System, Browsers and Software by suppliers, and enable the auto-update feature to obtain and apply security patches regularly from trusted sources.
• Please use the default browsers on your device.
• Install a personal firewall, anti-spyware and anti-virus software from reputable software company to detect any intrusions, spyware and viruses on your computer, and enable the auto-update feature to obtain the latest spyware and virus definition files.
• Avoid visiting suspicious websites, downloading or installing programs or files from unreliable sources for preventing infection from computer virus or Trojan programmes. You should also perform virus scanning before opening any attachments in emails, instant messaging, SMS messages or QR codes.
• Turn off remote access control features to prevent unauthorised access to your computer.
• Do not use the computer / mobile device if a virus is found until the virus is completely cleared.
• Disable the "Auto Complete" function of your browser. This function can record the information you entered includes the password of your Online Banking Service.
• Ensure the file sharing feature is disabled in your operating system while online, particularly if you are linked to the Internet through a cable, DSL modem, or network router.
• Do not share computers. If you must share, set your own password to block access to your accounts. Think before sharing mobile devices. If you have an e-wallet application (App), it’s not the best idea to let a stranger use your phone (e.g. to make a telephone call).
• Disconnect from the Internet or Mobile Application when you are not using it.
• Do not download or install programs received from SMS in your mobile device.
• You should set a password for your computer or mobile device to prevent unauthorised access when your computer or mobile device is left unattended.
• If your mobile device used for receiving one-time password or as Mobile Token is lost or stolen, please notify the Bank immediately to suspend the two-factor authentication service.

If you suspect:

(1) You have provided personal information or conducted transaction through a suspicious bank website or a purported bank email;
(2) Your password or devices for operating Internet Banking and Mobile Banking services have been compromised, lost, or stolen;
(3) Account irregularities or unauthorised account transactions have been conducted.

Please inform the Bank immediately.

IV. Common Online Fraud

Phishing SMS Messages

This kind of fraud involves phishing SMS messages with embedded hyperlinks purported to be sent by banks. After clicking the embedded hyperlinks, customers are lured into entering their internet banking login IDs, passwords and SMS One-Time Password (OTP) provided by the banks. Fraudster(s) may then re-register the binding / soft token with the banks’ mobile banking Apps onto the fraudsters' own mobile devices by using the stolen login information. Unauthorised transactions are then initiated and cause financial losses to the customers.

Please note that Chong Hing Bank never sends messages (e.g. emails or SMS messages) to customers with embedded hyperlinks (including QR codes) to transactional websites or Internet banking/mobile banking Apps of the Bank, or redirect customers to transactional websites or Internet banking/mobile banking Apps of the Bank after customers keep clicking the hyperlink(s) / icon(s) on one or more web page(s).

Advanced Fee Scam

This scam involves sending fraudulent letters and email messages scammers, which offer the recipient a generous reward if the recipient helps to handle a large lump sum of funds. These funds often claimed to be anything from corporate profits, bribes, unspent government funds or unclaimed funds belonging to a deceased person. Sometimes, scammers may even create a bogus bank website that shows a huge credit balance of a specified account, todeceive the recipient that the dubious letters/ email messages are real.

This kind of scammed transactions typically require the recipient(s) to prepay a fee to complete the deal. However, it will turn out that such fee will be permanently untraceable. Moreover, the recipients' personal or banking information may be exposed to unauthorised parties, and be used in other types of frauds.

Lottery Fraud

This kind of fraud involves the sending of dubious letters and email messages to victims, which congratulate the recipient(s) of winning a prize in a lottery. To obtain the prize, the recipient has to provide his / her personal particulars and bank account details. The recipient may also be requested to pay a handling fee to complete the transaction. However, such fee will be permanently untraceable. Also, the recipients' personal particulars and banking information provided may be stolen by scammers and be used in other types of frauds.

Bogus Voice Message Phone Calls

Bogus voice message phone calls that claimed to be from banks claim that there are irregularities detectedin the customer's bank account or credit card, and request the customer to input sensitive personal information (including login Passwords or SMS-based one-time passwords) or contact theoperator for account authentication. If the customer's details or banking information is disclosed, it may be used in other types of frauds.

Please note that the Bank will never call the public and its customers via pre-recorded voice messages or use phone numbers starting with a “+” sign nor request the public and its customers to press the phone button for the next operation when answering the call. This kind of pre-recorded voice message is a common tool used in telephone deception and is used to identify vulnerable individuals. Please do not reply to these pre-recorded voice messages.

If you have any doubts or enquiries on these kinds of deception cases, please call the “Anti-Scam Helpline 18222” Hotline at (852) 18222 to contact the Anti-Deception Coordination Centre’s officers of the Hong Kong Police Force immediately.

Virus hoax e-mail

Many e-mail warnings about viruses are hoaxes, designed purely to cause concern and disrupt businesses.

Such warnings may be genuine, so don't take them lightly, but always check the story out by visiting an antivirus site such as McAfee, Sophos or Symantec before taking any action or forwarding them to friends and colleagues.

Beware of Email Scam "Verify Suspicious E-mails Uncover Online Swindlers"

In cases of email scam, the fraudsters hacked into the victim's email account and checked the victim’s business correspondence with business partners. They sent an email to the victim using the same or similar email account of such partner and claimed that the payment bank account had been changed and further requested the victim to deposit the payment for goods into the fraudster’s designated bank account. Police appeal that if you receive any suspicious emails, you should confirm the identity of the senders by means of telephone before remittance so as to prevent from being deceived.

Social Engineering Scam

Social engineering scam is a fraudulent technique conducted by counterfeiting the identity of others. Fraudsters use social interactions such as lie, play acting or verbal messages to trick legitimate users. Fraudsters may also impersonate known connections (e.g. friends, legitimate organisations) on social media platforms to deliver phishing attacks so as to extract users’ sensitive data and credentials.

To avoid falling victim to social engineering scam, you should stay vigilant, and try not to share so much personal information on social media. Do not disclose and send personal and account information easily (especially username and password). Bank staff and law enforcement officers never request for such information. Avoid disclosing and sending such information to persons even if you know their identities, as their mobile phone may be stolen by fraudsters and they may then access your sensitive information.

Man-In-The-Browser Attack

Please be highly aware of a recent online threat known as a Man-In-The-Browser (MITB) attack, where an attacker takes control over a customer's connection and transmits counterfeit screens to the customer in attempt to capture and manipulate customer data.

• A frequent MITB attack scenario involves the attacker taking control over a customer's login session. The attacker transmits screens similar to the online banking screens requesting the customer to wait while their details are being verified. During this, the attacker would initiate a request for adding payee or updating personal information while the customer's account is being compromised. An SMS containing a One-Time Password (OTP) is sent to the customer's mobile phone as part of the process. More counterfeit screens are transmitted to the customer to prompt the customer to key in the OTP in order for the attacker to proceed with payee addition and/or personal information update.
• Please do not proceed if you notice an unusual screen or message during your online banking login session.
• Do not act on an SMS containing an OTP that you have not requested for, review your existing payee list for any unauthorized additions.

Online frauds are emerging to an endless stream, customers are advised to safeguard their personal and banking information at all time.

If you suspect that you havefallen victim to any online frauds, please report to the police immediately!

Online Employment Fraud

Fraudsters post job advertisem*nts on various social media platforms, forums or instant messengers, using various pretexts to lure job seekers into paying fees, guarantee fees or other fees. After snatching the money, fraudsters will be out of contact.

Through telemarketing or social media platforms, frausters would offer the benefit of making quick money and lure you into selling or lending your accounts, or use your personal credentials to open accounts. The syndicate will then use these “stooge accounts” to receive/launder fraudulent payments or other crime proceeds.

Don't be tempted by quick money, don't lend your account to anyone launder money!

V. Frequently Asked Questions

1. How to choose a safe password?