Security and Fraud Centre
Internet Banking

Security Device

• HSBC is committed to protecting the security of our HSBC Internet Banking customers. HSBC will issue a Security Device to HSBC Internet Banking customers who need to access services under "Security Device Logon mode".
• The Security Device has been selected by HSBC as the technology that best meets our customers' need for flexibility and portability, and our business volume requirements. The Security Device meets the Hong Kong Monetary Authority's requirements for Two-Factor Authentication, while providing the following benefits to our customers:
  

SMS notifications

• To meet the Hong Kong Monetary Authority guidelines on internet banking security, you will receive SMS notification on the following transaction you have done in internet banking:

- Change of mobile phone number (both old and new mobile phone numbers will receive SMS)
- Third party non-registered fund transfer
- Self-named fund transfer to joint account or credit card account.
- Bill payment to merchant categories under "Securities and Brokers"
- Bill payment to merchant categories under "Sports & Leisure"
- Bill payment to merchant categories under "Finance Company"
- White IPO applications

• The beneficiary's partial account number, transaction amount and time of transaction will be included in the SMS notification.
• To review and update your registered mobile phone number, you may logon to HSBC Internet Banking, click "Maintain My Details" at My HSBC tab, and under the General Banking column, update the "Mobile Phone / Pager" field under "Change Personal Information & Address".
• You should update personal contact details on a timely basis.
• If you have subscribed to eAlert email on Outward Payment Services, you will receive both an email alert and an SMS notification.

Secure Sessions

• When you log in to Internet Banking you are said to be in a secure session. You know you are in a secure session if the URL address begins with https:// or a padlock symbol appears in the lower right hand corner of your browser.

Encryption

• Secure Sockets Layer (SSL) Encryption technology is used within your Internet Banking session to encrypt your personal information before it leaves your computer in order to ensure no one else can read it. Depending on your browser setting, a pop-up window will appear to notify you that you will be entering a secured page.
• At HSBC, we use 128-bit SSL Encryption, which is accepted as the industry standard level.
• Any email service within Internet Banking is similarly protected with encryption technology (unlike your regular email which is usually not secure).

Session Time-out

• If you forget to log-off after banking online, or your computer remains inactive for a period of time during a session, then our systems automatically log you off. Pages viewed during a secure session are not recorded in your PC's temporary files.

Make sure you have the latest security updates and patches

• From time to time, vulnerabilities are discovered in operating systems and internet browsers. Before the publisher can release a security patch to correct these weaknesses, they can be exploited by virus writers and hackers to gain unauthorised access to those PCs that have not yet been patched.
• To check for patches and updates you should visit the publisher's website, typically in their Download section.
• Microsoft users can visit: http://windowsupdate.microsoft.com which can automatically check what is required, and then suggest to download it

Use and update anti-virus software regularly

• You may already be using anti-virus software but to be effective the software should be updated on a regular basis with the latest "virus definition" files. If you are unsure how to do this, you should refer to the program's own Help function.
• There are many effective programs to choose from, but the most common commercial products are from McAfee, Symantec (Norton) and Sophos.
• It is also possible to obtain free anti-virus protection. A search for "free anti-virus" on Google will provide a list of the most frequently used anti-virus softwares.

Use personal firewalls

• A firewall is another small program that helps to protect your computer and its contents from outsiders on the Internet. When properly installed, it stops unauthorised traffic to and from your PC.
• There are many effective programs to choose from. Common commercial examples are from Zone Labs , Symantec (Norton), McAfee and Computer Associates.
• The widely recognised market leading free firewall is "Zone Alarm" from Zone Labs and there are many others to choose from. Zone Alarm is now used on over 20,000,000 PCs and has been awarded the PC World 2003 "World Class Award" for Best Firewall.

Read our password advice

Keep your password secure

• Passwords are the key to your online account information. Your HSBC Internet Banking password, together with your Internet banking Username, permits access to your bank accounts. For this reason your password should be unique and very well protected.

Keep them to yourself

• Do not be tempted to share your passwords with anyone.

Be unique

• Use passwords that are unique and not easy to guess.

Use letters, numbers and symbols

• Passwords containing upper and lower case letters, numbers, and symbols are far harder to guess.

Be different

• Avoid using the same password for different services.

Don't be personal

• Do not be tempted to use passwords that can easily be guessed e.g. your name, your date of birth, telephone numbers, pet's name.

Never write them down

• If you really need to record your password then use a code system or transpose some of the letters.
• No one at HSBC will ever ask you for your Internet banking password. If someone does ask you for it, they do not represent HSBC.

Change your passwords

• Always change passwords that may have been compromised.

Contact your bank if you think someone else knows your Internet banking password.

Use an anti-spyware program

• Spyware is the term used to describe programs that run on your computer for the purpose of monitoring and recording the way in which you browse the web and the internet sites you visit. For example, spyware can combine information about your online behaviour with that of many other users in order to generate market research data. This information can be bought and sold by companies interested in improving the way websites are designed and how the internet is used.
• You may or may not wish for your internet usage to be monitored in this way. In addition, just as spyware can be used to improve the online experience it can also be used to extract personal information that you have entered, including passwords, telephone numbers, credit card numbers and identity card numbers.
• Spyware is often loaded onto a PC as part of a free download of another service - for example a service that claims to improve the performance of your PC. Sometimes your agreement to the download is requested in the small print, but spyware may also be loaded onto your PC without your agreement or knowledge.
• Spyware is not the same as a virus in that it only records what you do rather than altering how your machine works. Because of this, anti-virus software is not effective in identifying and removing spyware, you will need to download and run a specialised anti-spyware program.
• Anti-spyware security software currently available include McAfee, Spybot Search and Destroy, AdAware, Spyware Eliminator, Spyware Doctor and Microsoft antispyware. We strongly recommend that you install and use a reputable anti-spyware product to protect yourself against spyware on your PC.

Please visit www.banksafeonline.org.uk for further independent information on this topic.

To learn more about online security, please visit the HSBC Group online security page.