Hong Kong’s Securities and Futures Commission Orders Phishing-Resistant Logins for Brokers, Crypto Platforms | LeapRate
The Securities and Futures Commission (SFC) has issued a circular ordering internet brokers and virtual asset trading platform operators (VATPs) in Hong Kong to abandon one-time passwords (OTPs) in favour of phishing-resistant authentication methods, as account takeover attacks targeting client credentials continue to rise.
The regulator’s directive, published on 9 July 2026, requires firms to stop using OTPs for both client login and device binding, citing well-documented vulnerabilities in the technology alongside the emergence of more secure alternatives such as passkeys and bound-device recognition. Firms have up to 12 months to comply, though the SFC expects larger internet brokers to move immediately.
Phishing remains a dominant threat vector, accounting for 57% of security incidents reported to the Hong Kong Computer Emergency Response Team Coordination Centre in 2025. The SFC first flagged concerns over OTP reliance in a February 2025 circular on cybersecurity reviews of licensed corporations.
Beyond authentication upgrades, the SFC is pushing firms to strengthen monitoring for suspicious login, trading and withdrawal activity, notify clients promptly of key account events, and respond swiftly to hacking incidents.
Dr Eric Yip, the SFC’s Executive Director of Intermediaries, said protecting client accounts demands a layered approach. “Licensed firms should strengthen their first line of defence with robust authentication solutions, stay alert to suspicious activities, and respond swiftly before harm is done,” he said.
The SFC stressed that senior management at internet brokers and VATPs bear ultimate responsibility for account security, warning it will hold firms accountable for client losses stemming from control failures.
Investors, meanwhile, are being urged to use strong, unique passwords, keep devices updated, access accounts only via official channels, and report suspicious activity immediately to their firms and relevant authorities.
