Case File: The HSBC Phishing Kit That Intercepts Your Text Codes
Today's case file is about a phishing kit that has been advertised on dark web forums, built to target HSBC customers. It's worth being clear from the start: this doesn't mean HSBC has been breached. It means criminals have a tool that makes their fake login pages more convincing.
How the scam works
You receive a text message saying there's a problem with your account, a failed payment, a new device, a refund waiting. The message includes a link. The link opens a page that looks exactly like the bank's login screen.
You type in your username and password. Then the page asks for the one-time code sent to your phone. Normally that code is your protection, because the criminal doesn't have your phone. This kit gets around that by passing the code straight through to the real bank in real time. The bank thinks it's you logging in, so it sends a genuine code to your phone. You type it into the fake page, and the criminal now has everything.
That's why the code alone isn't the tell. The tell is the page you're on, and how you got there.
The habit that defeats it
If a text message about your bank asks you to log in, don't. Open your banking app directly, or type the bank's address yourself. If the app shows everything is fine, the text was a scam and you've lost nothing.
Urgency is the criminal's main tool. A payment that's failed, an account about to be locked. Anything that makes you rush. Slowing down is the defence.
If you've already entered your details
Call your bank on the number on the back of your card, not the number in the text. Ask them to freeze the account and explain what happened. Then change your password from a different device.
This particular kit targets HSBC, but the same template gets rewritten for other banks quickly. The lesson applies to all of them: never enter a one-time code on a page you reached from a link.
Related reading