The Securities and Futures Commission (SFC) has ordered internet brokers and virtual asset trading platforms in Hong Kong to stop using one-time passwords for client login and device binding.

According to a circular issued by the regulator, firms must adopt stronger alternatives to combat the growing threat of phishing attacks involving stolen client credentials.

The mandate requires firms to implement phishing-resistant authentication methods as soon as practicable.

Firms must complete the transition within 12 months from the circular’s issuance. Large internet brokers are expected to adopt the measures immediately.

The regulator said one-time passwords carry associated risks and that stronger authentication alternatives are available. SFC identified passkeys and bound devices as examples of robust, phishing-resistant authentication methods.

Firms must also strengthen monitoring and surveillance measures to detect suspicious login, trading and withdrawal activities.

The SFC expects companies to promptly notify clients of key account events and respond to hacking incidents in a timely manner.

“Protecting client accounts from increasingly sophisticated and elusive phishing attacks requires holistic measures combining prevention, detection, response and education,”

said Dr Eric Yip, Executive Director of Intermediaries at the SFC.

“Licensed firms should strengthen their first line of defence with robust authentication solutions, stay alert to suspicious activities, and respond swiftly before harm is done.”

The regulator stressed that a firm’s senior management holds ultimate responsibility for protecting client accounts and assets. Senior management will face accountability for client losses arising from lapses in their controls.

The SFC advised investors to maintain strong security practices, use official channels, and monitor their accounts regularly for unauthorised transactions.

Featured image credit: Edited by Fintech News Hong Kong, based on image by michnik101 via Magnific