Token activation fraud

With the security of online banking constantly improving, fraudsters may target you directly to try steal your money.

Token activation fraud is where fraudsters try to trick HSBC customers into handing over their Secure Key activation code.

HSBC will never ask you for the token generated from your Secure Key or mobile phone, these are only used to gain access to your online banking and move money out of your account. They are not used to stop or block payments. They are also not needed by our fraud teams. You’ll never need to reveal the token to anyone.

How does token activation fraud typically work?

Over the phone

The fraudster will call and pretend to be from your bank. They may tell you a large amount of money is due to come out of your account, for example. They’ll then ask if you authorised this payment.

When you say you haven’t, the fraudster will be very understanding and offer to stop the payment for you. They’ll ask what type of Secure Key you have – a physical Secure Key (a little calculator device) or a Digital Secure Key (a code generated from a mobile phone).

Once they know this, the fraudster will then emphasise that they’ll never ask you for the PIN or password for that device. 

In order to “stop the payment”, the fraudster will ask you to generate a code from your Secure Key. They may again emphasise that they don’t want the PIN or password for the device and you should never reveal this to anyone.

They’ll ask you for the activation code. If you hand over that code, they’ll be able to authorise transactions from your account or completely take over your online banking. 

Via text

If you’re contacted via SMS, you’ll receive a text from someone claiming to be from your bank. They may ask you to give them a call and take you through the same scenario above, or respond to the text with your activation code.

Explore more: Received a text?

How to prevent token activation fraud

HSBC will never ask for your generated codes, PINs, passwords or any activation codes. If anyone does contact you and ask you for your Secure Key activation code or any other log on details, don’t give it to them. Hang up the phone and never respond to the text.

If you’re ever unsure about a phone call from someone claiming to be your bank, you can hang up the phone and call back on a number you know is genuine.

Explore more: Protect yourself against fraud

What next?

Staying up to date on the latest scam warnings can help keep your money protected.