Hong Kong Strengthens Safeguards Against Identity Fraud in Remote Bank Account Opening

Hong Kong authorities are strengthening safeguards for remote bank account opening as concerns grow over criminals using stolen personal information, manipulated identity documents and facial-recognition technology to create bank accounts without victims’ knowledge and use them to launder criminal proceeds.

In a response to the Legislative Council on 21 October 2026, the Hong Kong Government outlined existing regulatory requirements and new measures being developed with the Hong Kong Monetary Authority (HKMA), banks and other public authorities to address the risks associated with digital identity fraud.

The issue has arisen in cases where individuals, including elderly people and foreign domestic workers, have reportedly discovered that bank accounts were opened in their names without their authorisation. According to concerns raised in the Legislative Council, criminals obtain victims’ identity card details and other personal information, submit account applications through banking mobile applications and link the accounts to telephone numbers controlled by the fraudsters.

In some cases, victims are reportedly deceived into completing facial-recognition procedures without understanding that they are participating in a bank account opening process. Once an account has been created, criminals can use telephone numbers under their control to receive one-time passwords and facilitate unauthorised transactions.

The Government confirmed that the HKMA already requires banks to implement appropriate identity verification and risk-management measures for remote account opening. These include technological checks to establish the authenticity of identity documents and facial-recognition systems intended to confirm that the applicant is the legitimate holder of the identity card.

Banks must also conduct ongoing customer due diligence and transaction monitoring after accounts are opened. Suspicious transactions must be reported to law enforcement authorities where required, helping prevent accounts established through fraudulent means from being used to receive, transfer or launder criminal proceeds.

The HKMA issued additional guidance in 2023 specifically addressing risks associated with remote account opening. Banks were reminded to display clear on-screen messages explaining that selfies and liveness tests are being collected or conducted for the purpose of opening a bank account. The intention is to ensure that applicants understand the nature of the procedure and are less likely to be manipulated into completing identity verification on behalf of criminals.

The authorities are also working to reduce the risks associated with reliance on SMS-based one-time passwords. Under existing arrangements, banks have introduced in-app authentication for customers using their mobile banking applications. This provides an additional verification layer when customers access internet banking or carry out higher-risk activities, including adding new payees, increasing transfer limits or changing the telephone number used to receive banking messages.

Customers linking internet banking accounts to mobile devices are also required to complete facial-recognition checks. These measures are intended to make it more difficult for criminals to exploit stolen login credentials and intercepted or fraudulently obtained SMS authentication codes.

A further initiative involves integrating the Step-up Authentication function of Hong Kong’s iAM Smart digital identity platform into important banking processes. The function can support facial recognition and the reading of identity card chip data, enabling additional checks against official identity records.

The HKMA is working with the Digital Policy Office and the banking sector on this integration. Testing for remote account opening has already commenced, according to the Government’s response. The authorities will assess the security, stability and customer experience of the process before considering a broader, risk-based expansion to other banking activities.

The measures build on the HKMA’s August 2025 e-Banking Security ABCD initiative, which included guidance on detecting and defending against deepfake attacks. The guidance applies to facial-recognition procedures used during remote account opening as well as high-risk online transactions.

The Legislative Council discussion also addressed whether banks should be required to verify that telephone numbers linked to newly opened accounts are registered in the applicant’s name or that of a specified relative. Lawmakers further asked whether banks should be permitted to access the Government’s real-name SIM card registration data for that purpose.

The Government said it currently has no plans to authorise banks to access those records. Under Hong Kong’s existing Telecommunications (Registration of SIM Cards) Regulation, telecommunications operators may provide registration information to designated law enforcement officers for the purposes of investigating or preventing crime. The regulation does not currently permit other organisations, including banks, to access the registration data.

The authorities indicated that existing anti-money laundering and counter-terrorist financing requirements already oblige regulated financial institutions to maintain effective customer due diligence, transaction monitoring and suspicious transaction reporting controls. The Government will continue to review the risks associated with remote account opening and assess whether additional measures are needed.

The response follows other recent cases in Hong Kong involving the use of artificial intelligence and manipulated identity documents to bypass digital verification procedures. In September 2026, police announced the arrest of 15 people in connection with a suspected criminal group that allegedly used altered identity card photographs to open bank and stored-value payment accounts. Investigators reported 210 suspicious applications between November 2025 and July 2026, of which 42 resulted in accounts being opened. Fourteen of those accounts were reportedly used for money laundering involving approximately HK$1.13 million in criminal proceeds.

The Government has stated that it will continue working with financial institutions and relevant departments to monitor emerging methods of identity theft and improve safeguards for digital financial services. The measures under development are intended to make remote account opening more secure while reducing the risk that accounts created through impersonation can be exploited for fraud and money laundering.

By fLEXI tEAM