HSBC is an investment bank and financial services holding company based in the UK.
About HSBC scam texts, emails and phone calls
Text, email and phone scams purporting to be from a bank are typically designed to panic a recipient into thinking something suspicious or malicious is happening with their bank account.
The scam will then urge the recipent into doing something that the scammer claims will help them investigate or remedy the issue. This can include panicking a recipient into clicking a link and entering sensitive information into a spoof website, handing over details about themselves over the phone, tranferring money into a different bank account or downloading harmful files onto their device.
Such scams claiming to be from a bank can use a variety of different social engineering tricks, including the following -
- The claim that someone has tried to access the recipient's bank account.
- The claim the recipient's bank account access has been locked or suspended due to security concerns or violations and the recipient needs to click a link to verify themselves.
- The claim that a new payee was added or a payment was authorised or a replacement bank card was requested.
- The claim that a bank statement or other financial document is attached to the email or available to download by clicking a link.
- The claim that the recipient's bank is increasing or decreasing an overdraft limit or other feature of the bank account.
Phone scams claiming to be from your bank may even urge a recipient to transfer money into a "safe" bank account to prevent fraud. However this "safe" bank account will belong to scammers.
In other cases texts and emails can claim the recipient has been awarded some type of financial relief or have won a lottery or raffle.
The below example claims a new payee was added to the recipient’s account and the recipient can click a link to investigate.
HSBC: New payee request to MR C JONES through your HSBC mobile banking app. If this was NOT you, please visit: LINK REMOVED
The next example claims a payment was made from the recipient’s account, and again provides a link for the recipient to click on to investigate.
HSBC: Your request to transfer money to J Brookes on 05/05/21 was successful. Cancel immediately if this was not you at: LINK REMOVED
The below example claims a payment was attempted from the recipient’s account.
All the examples attempt to alarm a recipient into clicking a link, which will direct the recipient to a spoof phishing website.
Report an HMRC phone, text and email scam.
How to report an HSBC scam text?
Details about scam text messages can be forwarded to HSBC UK on phishing@hsbc.co.uk.
How to report an HSBC scam email?
Scam emails and phishing emails can be forwarded to HSBC UK on phishing@hsbc.co.uk.
You can also send a screenshot of scam social media messages (e.g. WhatsApp messages) claiming to come from HSBC to this email address.
If you're in the UK, you can ALSO report scams...
- Scam emails can be forwarded to The National Cyber Security Centre (NCSC) at report@phishing.gov.uk
- Scam texts can be forwarded to your phone carrier on 7726
- All types of cybercrime and fraud can be reported to the police via ActionFraud by calling 0300 123 2040 (or 101 in Scotland) or by using ActionFraud's online reporting tool here.
If you're in the USA, you can ALSO report scams...
- Scam texts can be forwarded to your phone carrier on 7726
- All types of cybercrime and fraud can be reported to the Federal Trade Commission (FTC) by using their complaint assistant here or by calling 1-877-382-4357 (9am-8pm ET)
From a different country? Click here.
You can also forward SMS or email scams to us at scam@thatsfake.com
Avoiding HSBC text and email scams
Scam text, phone and email messages that appear to come from your bank can be particularly effective because they are often designed to panic us into thinking something is wrong with our bank account. Here are some tips to avoiding these scams.
- Be vigilant of messages that appear to be trying to alarm a recipient into thinking something unwanted or suspicious is happening to their bank account and that the recipient can click a link or call a phone number to investigate or resolve. This is the most popular social engineering technique these types of scams use because they panic a recipient into acting recklessly by entering sensitive information into spoof websites or giving out sensitive information to scammers over the phone.
- If you receive an email or text claiming to be from your bank, don't click on any links in that message. You can always open your browser and go directly to your bank's website and login. From there you can check your bank account information. Alternatively you can contact your bank directly from their website or by contact information listed on your paperwork.
- If you receive a phone call from someone claiming to be from your bank claiming that to keep your money safe you are advised to transfer your money into a different "safe" account, this will be a scam. Banks will never call customers and request they transfer money into a different account. You should hang up the phone.
- If you do click a link in a message, always check the web address of the page you’re on to see if it belongs to your bank.
- For emails that appears to come from your bank, look for common red flags such as generic greetings (i.e. Hello customer) and poor spelling and grammar.
You can see more examples of genuine HSBC text messages and genuine text messages at their Security Centre here. You can also post a screenshot of any text or email to their Twitter support account here if you’re unsure if it is genuine.