Security

Anyone who uses the Internet should be aware of the potential risks – and how to avoid them.

How we protect you

Global security network

To protect your account, we have a global network of security experts who work to identify threats and investigate suspicious activity. If we see something unusual that doesn't fit your banking profile, we'll try to stop the transaction being completed – and contact you to check if it's valid.

If we discover someone has used your account to make unauthorized payments or transfers, we'll take immediate action minimizing the impact on you. This action may include blocking transactions, suspending your account temporarily or closing your account and opening a new one.

Security technology

We use advanced security systems and software to protect your account from unauthorized use.

Log on security

You choose your own log on details when you register for Internet Banking – which makes them unique, secure and easy to remember. Each time you log on, you'll be asked for your Personal Access Number, the answer to a verification question and a unique code your personal HSBC Security Device will generate.

If you forget your HSBC Security Device, don't worry, you can use your verification answer and password to log on. We also use an automatic time-out feature that ends your Internet Banking session if you forget to log out – so your details aren't left on your computer.

Data masking

HSBC takes information security seriously and we want to ensure the handling of our customers’ data is protected using high security standards.

As part of our continuous drive to improve information security online and protect sensitive customer information from unintended users, HSBC will introduce new security measures to its Personal Internet Banking (PIB) service. Sensitive data, such as account number will be partially masked on your PIB screens. All other information will not be affected.

Secure web browsing

Trusteer Rapport software from the security experts Trusteer safeguards your HSBC Personal Internet Banking service by:

  • Locking down the connection between your internet browser and HSBC
  • Checking that you've accessed a genuine HSBC web site. If you haven't, then it stops your data going to a counterfeit web site

HSBC Security Device

As the name suggests, this device is like a front door key for your HSBC Personal Internet Banking. It is roughly half the size of a credit card and looks a bit like a calculator. It uses advanced technology to give you a unique passcode every time you log on and make a transfer or payment.

Throughout history, people have always looked for ingenious ways to protect their treasure. It's the same online. We take online security very seriously. HSBC Security Device is another way to protect your personal treasure.

Learn more about HSBC Security Device

Card fraud protection

We take a number of preventive measures to protect you against card fraud.

  • If your card is lost or stolen, at home or overseas, contact us immediately and we'll cancel it immediately and issue a replacement.
  • Our advanced fraud detection system monitors your account for any unusual activity.
  • Chip & PIN technology (where available), stops your card details from being copied and prevents anyone using your card without your PIN.

Top 5 security tips

  • Keep your passwords and security details safe, so no one else can access your online accounts
  • Download security updates and patches for the computer programs you use
  • Update your anti-virus software regularly to protect your computer against attacks from new viruses
  • Secure your Internet browser. Download Trusteer Rapport – free online fraud protection
  • Install a personal firewall to block hackers and to stop spyware recording the personal information you enter online

How to protect yourself

Protect your computer

How secure is your computer? Keeping your operating system, browser and security software up to date will protect you against threats from hackers, viruses and spyware.

Basic maintenance tips

  • Update your operating system. Newer systems like Windows 7 and Mac OSX are more secure.
  • Download security patches and updates. By choosing to receive automatic updates, you'll have the latest software as soon as it's available.
  • Disable File and Printer Sharing on your computer to prevent unauthorized access.
  • Use a current web browser – and keep it updated.
  • Set your browser to block pop-ups.
  • Turn your computer off when you're not using it. If you're not connected to the Internet, you're not exposed to hackers and viruses.

Using security software

  • Use the latest anti-virus software to protect your computer against viruses and spam.
  • Use an anti-spyware program.
  • If your operating system has a built-in firewall, make sure it's enabled. Or install a separate firewall to block hackers.
  • Use a secure password to stop anyone accessing the files on your computer.
  • Use encryption software to protect wireless devices like your laptop, PDA and mobile phone.

Stay safe online

As well as protecting your computer, you should take steps to keep your personal information safe when you're banking, browsing and shopping online – and when you're using email and Instant Messenger.

Banking online

  • Use Rapport software from the security experts at Trusteer to safeguard your HSBC Personal Internet Banking by locking down the connection between your Internet browser and HSBC. Rapport checks that you've accessed a genuine web site, and if you haven't, then it stops your information from going to a counterfeit web site.
  • Log on to Internet Banking every month to check you recognize all the transactions. By monitoring your accounts regularly you'll spot anything unusual fast.
  • Use Internet Banking to regularly check your personal contact details are correct and kept up to date.
  • Never access your online accounts on public computers in libraries, Internet cafes and schools. You can't guarantee these computers are secure – and you never know who might be looking over your shoulder.
  • Always remember to log off from Internet Banking and close your browser when you have finished your online banking session. This helps to prevent others from viewing your information at a later time.
  • Turn off any features that offer to save your password for you.
  • Clear your browser’s history and cache on a regular basis.
  • Look for https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page. These tell you the page is secure.

For more information about Internet security, identity theft and fraud, visit one of the sites below:

Canadian Anti-Fraud Centre

Website: www.antifraudcentre.ca
Toll-free (Canada and U.S.A.): 1-888-495-8501
Email: info@antifraudcentre.ca

Royal Canadian Mounted Police's identity theft and identity fraud program

Website: www.rcmp-grc.gc.ca/scams-fraudes/id-theft-vol-eng.htm

Office of the Privacy Commissioner of Canada

Website: www.priv.gc.ca

Interac

Website: www.interac.ca

Canadian Bankers Association

Website: www.cba.ca/en/component/content/category/42-safeguarding-your-money

Major Credit Bureaus

Equifax: 1-800-465-7166
Trans Union: 1-866-525-0262 / Quebec: 1-877-713-3393


Passwords

  • Never tell anyone your password. We will never ask you for your full password.
  • Memorize your password. Don't write it down or store it on your computer or mobile phone.
  • Change your passwords and verification question regularly – at least every 90 days.
  • Use a combination of upper and lower case letters, numbers and symbols.
  • Turn off features that automatically save passwords.

Browsing and shopping online

Browsing the Internet

  • Don't respond to unsolicited requests for personal or account information.
  • Don't give out personal information to blogs, online forums and other social networking sites.
  • If you see a strange error message, don't click on it or respond to it – and run a virus check on your computer.
  • Scan your computer files regularly, at least once a week.
  • Don't install software or run programs unless you know they're from a reputable source.
Shopping online
  • Choose well-known, reputable sites – and type the web address directly into the address bar.
  • Make sure the site is secure – and check that it will encrypt your debit/credit card details. Look for https in the address and the locked padlock symbol in your browser status bar at the bottom of the page.
  • Add an extra layer of security by registering for a service like MasterCard SecureCode.
  • As well as safeguarding HSBC Bank Canada Personal Internet Banking, use Rapport software from the security experts at Trusteer to lock down the connection between your Internet browser and your sensitive web sites and check that you've accessed the genuine web site.

Email

  • Don't reply to any email claiming to be from HSBC if it asks for personal information such as passwords or account numbers – we never ask for this information by email.
  • Don't enter your details if an email claiming to be from HSBC links to the Internet Banking logon page, or any page that asks you to enter details. Don't open an email from someone you don't know. Read the subject line carefully – and don't be taken in by a friendly tone or urgent request.
  • Turn off the preview pane in your email program.
  • Don't click on a link or attachment in an unrecognized email, particularly if it's asking you to respond to an urgent request – or if the attached file ends in .exe.
  • Use your junk mail filter – and delete email from unknown sources immediately.
  • Don't forward chain emails – they can contain harmful viruses.

Secure your mobile phone or tablet

Using a mobile phone or tablet computer is a very convenient way to bank. But make sure you apply what you know about staying safe online in the same way, as the same threats are there.

Here are a few simple tips:

Keep your device safe

  • Avoid sharing your devices with others and use your own one to log on.
  • Do not leave your device unattended after logon to Internet or mobile banking. Always log off properly when you are finished with it.
  • Set up auto-lock and enable a passcode lock to prevent unauthorized access of your handset.

Use only trusted devices and software

  • Set up a password and enable auto screen lock.
  • Don't use untrusted custom virtual keyboards.
  • Use default browsers originally provided with the handset rather than newly installed browsers downloaded from other sources.
  • Don't use "jailbroken" handsets, which may have a security loophole, to log on to Internet or mobile banking.
  • Don't install applications on your handset from untrusted sources. Stick to sources such as the App StoreSM or Google PlayTM.
  • Don't allow installation of untrusted APKs (file extension name for Android applications).
  • Enable data encryption (available on Android 4+).

General points to note

  • Do not store your Internet or mobile banking username and/or password on your device.
  • When using Wi-Fi connection, use trusted Wi-Fi networks or service providers and enable security protection such as Wi-Fi Protected Access (WPA), if possible.
  • Install and update to the latest operating system, anti-virus and anti-spyware software regularly on your handset, whenever they are available.
  • HSBC Mobile Banking website for Business Internet Banking has adopted EV SSL Certificate (Extended Validation SSL Certificate). For Safari browser, a padlock and the bank name will be shown in green at the top of the browser. (Note: the padlock and the bank name may be hidden on some screens and they will be shown by scrolling down the screen manually.)

Prevent card and identity theft

From skimming your card at an ATM to stealing your mail, there are lots of ways a criminal can get hold of your card details and personal information. So it's important you know how to stop them.

Using ATMs
  • Memorize your PIN. Don't write it down or keep it in your wallet or purse.
  • Cover the ATM keypad when you're entering your PIN.
  • Try to use ATMs under video surveillance – or ones located inside a bank.
  • Avoid using ATMs at night. This is when most ATM crime takes place.
  • Look out for shoulder surfers – people with binoculars or cameras watching you enter your PIN.
  • Don't accept offers of "help". If someone approaches you at an ATM, leave immediately.
  • Be suspicious of signs telling you to use a specific ATM – it could be fitted with a skimming device that copies your card details.
  • Report anything unusual or suspicious to your bank.

Choosing a PIN

It's a good idea to change your PIN to a number you'll remember – but don't choose a PIN that's easy to guess. Here are some tips for choosing a new PIN.

  • Make it a memorable date like your wedding anniversary or an historical event.
  • Choose something quirky like the time your mailman arrives or when your alarm goes off.
  • If you're better with words, use the number of letters in each word of a phrase you'll remember. For example, "I love my Mom" becomes 1423.

Protecting your mail

  • If your mail is left in a public place, pick it up promptly – don't leave it out overnight or over the weekend.
  • If you're living or working abroad, get your mail redirected to a different address or register for online statements.
  • Shred documents like bank statements, bills and application forms for credit cards and loans – anything that includes your name, address and other personal details.
  • Check your monthly bills and statements – and report any transactions you don't recognize.
  • If you don't receive a bill or statement when you expect it, contact the organization straight away.
  • If you move, tell your bank, card providers and all the other organizations you deal with. And redirect mail from your old address for at least a year.

Protecting your cards while you're travelling

We monitor your HSBC Bank Canada account to protect you from fraud and periodically carry out transaction verification on unusual activity. We make every effort to avoid service interruptions with your card, but sometimes it's unavoidable. We apologize if this causes you any inconvenience.

Before you leave the country

  • Inform us of your travel plans to enable us to keep our fraud detection systems updated.
  • Ensure we have your current contact information before travelling abroad – particularly your mobile phone number and email address.
  • Take a note of our lost and stolen numbers in case of an emergency:
    HSBC Bank Card: Call 1-888-310-4722
    HSBC MasterCard: Call 1-866-406-4722
    HSBC Premier MasterCard: Call 1-866-405-4722

We recommend you store them in your mobile phone.

  • Take several ways to pay – debit card, credit card, and cash.

While you're away

  • Protect your card as if it was cash – keep it with you at all times and watch transactions being carried out.
  • If your card is lost or stolen, contact us and report it immediately.
  • Be vigilant when you're using an ATM – keep your PIN safe.

When you get home

  • Check your statement carefully. And contact your bank immediately if there are any transactions you don't recognize.

Recognize fraud

Some hints to recognize fraud:

  • The padlock symbol is in the wrong place.
  • You receive an urgent request to verify your account details.
  • You receive a letter saying you've been pre-approved for credit

Here's how to spot the fake websites, phone scams and illicit offers in the post, and how to protect your card from being used fraudulently:

Phishing

If you receive an email asking for personal information or security details, don't reply or click on any links. It may look genuine, but it is likely to be someone "phishing" for your details by directing you to a fake website.

How to spot a phishing email

  • They often contain spelling and grammatical errors.
  • They give a fake web or email address like info@hsbc-security.com.
  • They feature a logo that looks distorted.
  • They're mostly sent in bulk – so the email might not be addressed to you personally.
  • They often ask you to click on a link to confirm or validate your security details – and they threaten to close your account if you don't.
  • Some ask you to send money to a worthy cause.
  • The web address isn't quite right.
  • The padlock symbol is in the wrong place. It should be in your browser status bar at the bottom of the page, not within the page itself.
  • When you double-click on the padlock, you see a warning that the site address doesn't match the digital security certificate.
  • Your browser tells you that the site is unsafe – or the address bar is highlighted red or yellow.
  • You get an error message asking you to log on again.
  • The phone number on the site doesn't match the number on your account statements.
  • You can't link to a home page from the site.

If you receive a suspicious email or letter claiming to be from HSBC, you should report it immediately.

Phone fraud

Fraudsters may contact you by telephone too. If you receive a call claiming to be from HSBC:

  • Don't provide any information about your TelePIN – we never ask for this information over the phone.
  • If you have any doubts, end the call and contact us immediately on the telephone numbers you're familiar with.

Mail fraud

If it sounds too good to be true, it's probably a scam. Be suspicious of mail that contains any of these offers or requests.

  • Letters from your bank highlighting a problem and asking for your account details.
  • Letters from your bank advising they have money waiting for you and require you to confirm your account/personal details.
  • Pre-approved credit offers that charge a fee to get the card.
  • Job descriptions asking you to pay for more information.
  • Work at home schemes where you have to buy something before you can start.
  • Donation requests for unregistered charities.
  • Sweepstakes and lotteries where you have to pay to receive your prize – particularly ones based in a different country.

Skimming

Card fraud can happen in restaurants, shops, gas stations – anywhere you pay with plastic. Here are some tips to keep your card safe.

  • Don't let it out of your sight.
  • Don't let anyone swipe your card a second time through a skimming device.
  • Don't let someone look over your shoulder when you're entering your PIN.
  • Don't leave receipts or carbon copies behind. Take them home and destroy them.

Know your responsibilities

It's important to review the terms and conditions of every product and service you use. They contain information on the steps you need to take to prevent fraud including:

  • Review your account statements regularly and advise of any errors, omissions or irregularities including fraud and unauthorized activity within 30 days1.
  • Keep your Secret Codes including Personal Access Number and Internet Banking Logon Information confidential and take all reasonable precautions to maintain the secrecy and prevent unauthorized use2.
  • Avoid accessing your online banking information at Internet or Cyber cafes, libraries or other public Internet portals, as there may be unwanted software installed that could record your password and other keyboard activity.
  • Never input personal information on a website form or application that does not display the "https://" before a website address or a "padlock" symbol in the lower right-hand corner of the webpage. Commonly, these security symbols indicate that the site is secured by encryption technology and the information you enter is protected.
  • Do not use your (or a close relative’s) birth date, telephone number, address or readily identifiable combination of letters or numbers as a Secret Code.
  • Change your Internet Banking Logon Information regularly and do not use any previously used Internet Banking Password.
  • Do not record your Internet Banking Logon Information anywhere.
  • Ensure that any information stored on any computer with which you access Internet Banking is protected against unauthorized access by third parties.
  • Do not use "save password" features.
  • Always log off from your Internet Banking when you are finished.
  • Use all browser security measures including closing the web browser or clearing the browser's cache.

Report fraud

HSBC account fraud and lost or stolen cards

Be sure to notify the bank immediately if you suspect that you may be a victim of fraud or if there may be unauthorized activity on your accounts.

  • Personal Internet Banking customers, contact 1-877-621-8811
  • Business Internet Banking customers, contact 1-866-808-4722

If you become a victim, you should file a report with your local police and obtain a copy that you can reference and share with your creditors.

To help us act fast, please have your 10-digit Personal Banking Number (PBN) and TelePIN on hand – along with details of the transactions you don't recognize.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

HSBC credit card fraud

If your HSBC credit card has been lost or stolen – or you suspect that it has been used fraudulently – contact our 24-hour helpline immediately at 1-866-406-4722.

If you're an HSBC Premier customer, call 1-866-405-4722. We'll cancel your card, issue a replacement and investigate the suspected transactions.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

Non-HSBC customers

Do you suspect that an HSBC account has been opened in your name? Is HSBC listed on your credit report when you haven't applied to us for credit? Have you received an email or phone call claiming to be from HSBC? If you see anything suspicious linked to our name, please call us at 1-877-621-8811.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

What to do if you're a victim of fraud

It's important to report fraud as soon as possible to limit the unauthorized transactions on your card or account – and minimize the time it takes to correct your credit rating.

If you find out you've been a victim of fraud, you should take these steps straight away.

  • If you suspect any suspicious behaviour, please contact one of the credit bureaus below:
    • Equifax: 1-800-465-7166
    • Trans Union: 1-866-525-0262 / Quebec -1-877-713-3393
  • Close any accounts associated with the fraudulent activity.
  • Report the crime to the police.

Suspicious emails and letters

If you receive a suspicious email or letter, that claims to have been sent from HSBC, please forward it to info@hsbc.ca.

Alternatively, please call 1-866-233-3838 if you are a Premier customer.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

1If you fail to do so, the bank is not responsible for any preventable loss.

2You agree to be liable for any losses except those that occur after you notify the bank that you suspect the Secret Code might be known or that any unauthorized use or fraud of an account or service may be occurring.

iOS is a trademark or registered trademark of Cisco in the U.S. and other countries and is used under license. iPhone, iPad and iPod touch are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a registered trademark of Apple in Canada.

Android and Google Play are trademarks of Google Inc.

You are leaving the HSBC Commercial Banking website.

Please be aware that the external site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.

You are leaving the HSBC CMB website.

Please be aware that the external site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.