OCBC Hong Kong flags fake Carousell 'bank-confirm' pages on service-shop.sbs, .top and shop-service.icu

What happened

OCBC Bank (Hong Kong) issued a media statement on 26 October 2026 alerting the public to three fraudulent websites: shop-service.icu, carousell.service-shop.sbs and carousell.service-shop.top. Each address contains a path of the form '/merchant/bank-confirm/ocbc/' followed by a number. OCBC says it has no connection with the websites, that its official site is www.ocbc.com.hk, and that it has reported the matter to the Hong Kong Monetary Authority and the Hong Kong Police Force. Anyone concerned that they may have disclosed personal information or received requests for information on these sites is asked to call OCBC's customer service hotline and report to police.

How the scam works

OCBC's statement is short and doesn't describe what the pages show or how victims are reached, so the details here are limited to what its addresses suggest. Two of the three use 'carousell' subdomains, which reads like the name of the online marketplace, and all three use a 'bank-confirm' path that mentions OCBC. That combination suggests the pages are meant to look like a bank-confirmation step in a marketplace transaction, but OCBC doesn't say so and doesn't say what data they collect.

Marketplace-themed bank phishing generally relies on a seller or buyer sending a link and claiming a payment must be confirmed or received through the bank. A page that borrows a bank's name and asks for login or card details can then capture them. Treat the explanation above as how this type of fraud generally works, not as a finding about these sites.

OCBC is the impersonated bank and is not accused, and neither is Carousell. The report does not say how many people were affected.

Source

OCBC Hong Kong, "OCBC Hong Kong statement on fraudulent website" media release (26 October 2026).