Hong Kong banks warn of fake Carousell "bank-confirm" pages on carousell.shop-hk.click
On 28 October 2026 OCBC Bank (Hong Kong) and Shanghai Commercial Bank each issued a notice about fraudulent websites that use a Carousell marketplace transaction as bait. The address given in the OCBC notice is carous…
- First reported
- Reports
- 1
Source: ocbc.com.hk · published
What happened
On 28 October 2026 OCBC Bank (Hong Kong) and Shanghai Commercial Bank each issued a notice about fraudulent websites that use a Carousell marketplace transaction as bait. The address given in the OCBC notice is carousell.shop-hk.click, with a path ending /merchant/bank-confirm/ocbc/244956702. Shanghai Commercial Bank's notice of the same day names the same domain with a path ending /merchant/bank-confirm/shacom/244956702. Both banks say the pages imitate their internet-banking login screens and that they have no connection with them. Carousell and the two banks are not accused of anything: their names are being copied.
How the scam works
Fake "bank-confirm" pages usually come after a chat about buying or selling something on a classifieds platform. The fraudster says the buyer's payment is held and that the seller must "confirm" it with their bank, then sends a link. The link opens a page styled like the bank's login screen. Anything typed into it, such as the customer number, password or a one-time code, goes to the fraudster, who can then log in to the real account and move money. The long number at the end of each path looks like a per-victim tracking code, which suggests a link is generated for each target. The Hong Kong Monetary Authority published a roundup the same day listing several banks that had issued fraudulent-website notices; only the OCBC and Shanghai Commercial Bank notices carry this address.
Banks in Hong Kong consistently say they do not send SMS messages or emails containing links that take customers to their login pages, and that they never ask for passwords or one-time codes by phone, email or message. A buyer who really has paid does not need the seller to log in to anything.
Source
OCBC Bank (Hong Kong) press release, 28 October 2026; Shanghai Commercial Bank press release "Notification of Fraudulent Websites", 28 October 2026; Hong Kong Monetary Authority alert "Scam alert related to banks", 28 October 2026.
Red flags
- A buyer or seller on a marketplace asks you to "confirm" a payment through a link they send.
- The page address is a Carousell look-alike (carousell.shop-hk.click), not a bank domain.
- A login page you reached from a chat message, not by typing the bank's own address.
- The page asks for your internet-banking password or one-time code to "receive" money.
- Pressure to act quickly because the payment is "held" or the sale will be cancelled.
If you were targeted
- 1Never open bank-login links sent in chats, SMS or email; type your bank's address yourself or use its official app.
- 2Receiving money never requires your banking password or a one-time code. Stop if a buyer says it does.
- 3If you entered details, call your bank at once (OCBC and Shanghai Commercial Bank each list a customer hotline in their notices) and change your credentials.
- 4Report the case to Hong Kong Police, for example through the Anti-Scam Helpline 18222.
- 5Keep the chat and the link as evidence, then report the account to the marketplace.