OCBC Hong Kong warns of fake 'bank-confirm' pages on carousell.shop-pay.bond and carousell.shop-service.cyou
OCBC Bank (Hong Kong) said in a statement dated 20 October 2026 that it has no connection with fraudulent web pages at carousell.shop-pay.bond/merchant/bank-confirm/ocbc/581561506 and carousell.shop-service.cyou/merch…
- First reported
- Reports
- 1
Source: ocbc.com.hk · published
What happened
OCBC Bank (Hong Kong) said in a statement dated 20 October 2026 that it has no connection with fraudulent web pages at carousell.shop-pay.bond/merchant/bank-confirm/ocbc/581561506 and carousell.shop-service.cyou/merchant/bank-confirm/ocbc/261782987 and /959410964. The pages are presented as OCBC 'bank-confirm' pages; OCBC Hong Kong is not involved and says it has reported the matter to the Hong Kong Monetary Authority and the police. The addresses use the Carousell marketplace name as a subdomain, but the bank's statement does not link Carousell to the pages.
What the warning means
The addresses in OCBC Hong Kong's statement follow a pattern: a marketplace name at the start, a domain such as shop-pay.bond or shop-service.cyou that sounds like a payment service, and a path ending in 'bank-confirm/ocbc' followed by a long number. That structure suggests pages built to look like a bank confirmation step during an online purchase or sale, with the number possibly varying for each target. The bank's statement does not describe how people reach the pages or what information they ask for, so those details are not confirmed.
The important part of any address is the domain just before the first single slash, here shop-pay.bond and shop-service.cyou. Neither belongs to OCBC Hong Kong, whose official website is ocbc.com.hk. Placing a bank or marketplace name at the start of an address does not make that company the operator. Fake 'bank confirmation' pages commonly try to collect online banking logins, card details or one-time passwords, which a genuine bank page reached through a marketplace link should not need.
OCBC Hong Kong says customers who are worried that they may have disclosed personal information, or who received requests for information on the fraudulent websites, should call its customer service hotline on (852) 3199 9188 and report to the Hong Kong Police Force immediately.
Source
OCBC Bank (Hong Kong) Limited, "OCBC Hong Kong statement on fraudulent website" (media release, 20 October 2026).
Red flags
- A 'bank-confirm' page reached through a marketplace or payment link.
- A web address whose real domain isn't ocbc.com.hk.
- Requests for online banking logins, card details or one-time passwords to confirm a sale or purchase.
- Domains with unusual endings such as .bond or .cyou.
If you were targeted
- 1Don't enter any details on the pages listed in OCBC's statement.
- 2Reach OCBC Hong Kong only through ocbc.com.hk or its app.
- 3If you entered information, call OCBC's hotline on (852) 3199 9188 at once.
- 4Report it to the Hong Kong Police; the Anti-Deception Coordination Centre hotline is 18222.
- 5Keep screenshots and the links you received.