Hong Kong banks warn of fake bank-confirm pages on carousell.shop-service.top; Chong Hing flags fake Xiaohongshu account
On 21 October 2026, several Hong Kong banks issued statements about fraudulent websites impersonating their internet banking login pages, which the Hong Kong Monetary Authority (HKMA) listed in its scam alert the same…
- First reported
- Reports
- 1
Source: chbank.com · published
What happened
On 21 October 2026, several Hong Kong banks issued statements about fraudulent websites impersonating their internet banking login pages, which the Hong Kong Monetary Authority (HKMA) listed in its scam alert the same day. Chong Hing Bank, OCBC Bank (Hong Kong) and Shanghai Commercial Bank each named fake 'bank-confirm' pages on the domain carousell.shop-service.top (paths /merchant/bank-confirm/<bank>/000886018 and /892350465). Chong Hing Bank also warned of a fake Xiaohongshu social media account named '创兴银行有限公司广州分行' (ID: 18419804225), saying it does not operate any Xiaohongshu account. The banks say they have no connection with the websites and have reported them to the HKMA and Hong Kong Police. The HKMA says banks will not send SMS or emails with embedded links to carry out transactions or ask for passwords or one-time passwords; anyone who gave information or made transactions should contact their bank and the Police Crime Wing Information Centre at 2860 5012. The domain names reference Carousell but the banks do not say the marketplace is involved.
How the scam works
Fake 'bank-confirm' pages like these copy a bank's internet banking login screen so that a victim types in a username, password and one-time password, which criminals can use to log in to the real account and move money. The pages often follow a message about a buyer, payment or delivery on a selling platform, with a link that claims the victim must 'confirm' a bank account to receive money; the path names on these pages, under '/merchant/bank-confirm/', fit that pattern. Because the domain contains a well-known marketplace name, the link can look like part of a normal sale.
Fake social media accounts using a bank's name work in a similar way, offering 'customer service' or loans and then directing people to fake sites or asking for personal details. The HKMA reminds the public that banks will not send SMS or emails with embedded hyperlinks directing customers to their websites to carry out transactions, and will not ask for sensitive personal information such as login passwords or one-time passwords by phone, email or SMS.
Source
Hong Kong Monetary Authority and Chong Hing Bank, OCBC Bank (Hong Kong) and Shanghai Commercial Bank, fraudulent website press releases (published 21 October 2026).
Red flags
- A link asking you to 'confirm' your bank account so a buyer can pay you.
- A bank login page on a domain such as carousell.shop-service.top.
- Requests for your banking password or one-time password through a link.
- A social media account claiming to be a bank branch offering services.
If you were targeted
- 1Don't use links in messages to log in to online banking; type the bank's address or use its official app.
- 2Never share your password or one-time password with anyone.
- 3If you entered details, contact your bank immediately and change your password.
- 4Report the incident to the Hong Kong Police Crime Wing Information Centre at 2860 5012.
- 5Check the HKMA's list of fraudulent bank websites and social media accounts if you're unsure.