📝 Show notes
CyberAware Daily — 2026-10-22
- Case File Thursday: a phishing kit targeting HSBC customers that intercepts SMS one-time codes.
- How the scam works: fake login page, real code passed through to the real bank in real time.
- The tell is the link, not the code. Open your banking app instead of tapping a text.
- What to do if you've already entered your details: call the number on your card and freeze the account.
- Why urgency is the criminal's main tool, and how slowing down defeats it.
- Dark web context: kits like this are sold on forums, and our monitoring shows an active leak site in the same ecosystem. No addresses shared.
More at https://cyberawareuk.co.uk
📄 Full transcript
Welcome back to Cyber Aware UK. It's Thursday the 22nd of October and Thursdays are case file days
where we walk through a real scam story so you can spot it before it lands on your doorstep.
And today's case is one that's been doing the rounds on dark web forums,
a phishing kit aimed at HSBC customers that can intercept the text message codes banks use as a
second check. Right and before anyone panics, this kit exists. It's being sold to criminals but it
doesn't mean HSBC has been breached. It means someone has built a tool to make fake HSBC pages
look more convincing. So how does it actually work? I think people hear interception and imagine
something sci-fi. It's simpler than that. You get a text saying there's a problem with your account
with a link. The link opens a page that looks exactly like HSBC's login and you type in your
username and password. And at that point the criminal has your password but not your one-time code
so they'd normally be stuck. Exactly but this kit asks you for the code on the fake page too
and passes it straight through to the real bank in real time. So the bank thinks it's you logging in,
you get a genuine code, you type it into the fake page and the criminal is in. That's the bit that
makes it dangerous because the code itself is real. If you just glance at the text it looks legitimate.
It does and the tell is not the code. The tell is the page you're on. If you arrived there from a
link in a text, don't type anything. Open your banking app or type the bank's address yourself.
What about the messages themselves? What should people be looking out for?
Urgency mostly. A payment that's failed, a new device added, a refund waiting, anything that makes
you want to sort it out in the next two minutes. That pressure is the product. The scam doesn't work
if you slow down. And is this something that only hits HSBC customers?
This particular kit is aimed at HSBC but the same template gets rewritten for other banks within
days. So the lesson is bigger than one bank. Never enter a one-time code on a page you reached from
a link. What about if someone thinks they have already done it? Call the bank on the number on the
back of your card, not the number in the text. Tell them what happened, ask them to freeze the account
and change your password from a different device. Speed matters, but it is fixable.
There's one more thing worth mentioning, isn't there, about where this kit is being sold?
Yes, it's being advertised on dark web forums and our monitoring shows an active dark web leak site
in the same criminal ecosystem. We won't be reading out any addresses and there's nothing for a normal
household to do about that side of it. So the practical takeaway for today.
If a text about your bank asks you to log in, stop. Open your banking app instead and check there.
If the app says everything is fine, the text was a scam and you've lost nothing.
That's a good rule for any bank any day. Thanks for listening and we'll see you tomorrow.
Take care and slow down. That's Cyber Aware UK.