HKMA and Octopus warn of fraudulent website octopus-auth.com pushing a suspicious app
On 26 October 2026 the Hong Kong Monetary Authority (HKMA) published a website alert about a press release from Octopus Cards Limited, a stored value facility licensee, concerning a fraudulent website, octopus-auth.co…
- First reported
- Reports
- 1
Source: hkma.gov.hk · published
What happened
On 26 October 2026 the Hong Kong Monetary Authority (HKMA) published a website alert about a press release from Octopus Cards Limited, a stored value facility licensee, concerning a fraudulent website, octopus-auth.com. In its press release the same day, Octopus said the website may direct customers to download a suspicious application, that it has no connection with the website, and that it has notified the HKMA; it added that the domain names of fraudulent websites keep changing. Octopus said customers should download or update the Octopus App only from official app stores, that it never asks customers to validate personal or account information by SMS, email, social media or embedded links, and that its registered SMS sender IDs include #Octopus and #OctopusOTP, with 'OCTOPUS' no longer used. The HKMA said anyone who provided personal information or account credentials, or made transactions, through the website should contact the licensee and report to the Police or the Anti-Deception Coordination Centre at 18222.
How the scam works
The press release says only that the site 'may direct customers to download a suspicious application'. It doesn't describe what the app does, so nothing is claimed here about its behaviour. Octopus says the list of addresses isn't exhaustive because the domain names of fraudulent websites keep changing.
The name octopus-auth.com resembles a login or verification page, and Octopus's advice shows what it considers the risk: it says it never asks customers to validate personal or account information through SMS, email, social media posts or embedded links. A link in a message that asks you to 'authenticate' or install an app is therefore a warning sign. Octopus now sends one-way SMS from registered sender IDs, #Octopus and #OctopusOTP.
Octopus Cards Limited is the impersonated organisation and is not accused. The HKMA says anyone who gave personal information or account credentials or made transactions through the site should contact Octopus and report to police or the Anti-Deception Coordination Centre on 18222.
Source
Hong Kong Monetary Authority scam alert, "Website Alert – fraudulent website related to Octopus Cards Limited", and Octopus Cards Limited press release (both 26 October 2026).
Red flags
- A website at octopus-auth.com rather than Octopus's official sites.
- A message asking you to validate personal or account information through a link.
- A prompt to download an app from a website instead of an official app store.
- An SMS that isn't from the registered #Octopus or #OctopusOTP sender IDs.
- The old 'OCTOPUS' sender ID, which Octopus says it no longer uses.
If you were targeted
- 1Don't open octopus-auth.com or download an app from it.
- 2Download or update the Octopus App only from official app stores.
- 3Ignore messages asking you to validate personal or account details through links.
- 4If you gave information or made transactions, contact Octopus on 2266 2222 and report to police or the Anti-Deception Coordination Centre on 18222.
- 5Report the message to Hong Kong Police.