A victim in London receives a call from "HSBC Fraud Department." The number on the caller ID matches the bank’s real number (spoofed). The voice says, "Someone in Manchester is using your card. We are sending a Secure Code to your phone. Read it to us so we can cancel the transaction."
In 2023, a new scam emerged:
This is the friction point of modern banking. It is annoying. It is intrusive. And according to the cybercriminals who tried to steal $500 million last year, it is the single most effective wall they face. hsbc secure code
The victim reads the code.
You’re about to buy a new laptop. You’ve clicked “checkout.” Your card details are in. Then, the screen freezes. A small gray box pops up from your browser, or a push notification buzzes your phone. A victim in London receives a call from
It is a masterpiece. The 2024 HSBC annual report noted a 73% drop in online card-not-present fraud among users who have activated the "Push Notification" version of Secure Code versus those still using SMS.
HSBC Secure Code proves you have the phone. It does not prove that you aren't being tricked. The bank has solved cryptography, but it hasn't solved gullibility. The "Silent" Transaction: A Feature You Don't Know About There is a ghost mode to Secure Code that most customers never notice. Read it to us so we can cancel the transaction
Never, ever give your HSBC Secure Code to a human being who called you. The bank will never ask for it. Ever.