In this section you can find out what we do to protect you, how to protect yourself and who to contact if you spot online fraud.
Fraud Prevention
It's important to arm yourself with awareness and the right information to help protect yourself and others from digital fraud. Register for Autodeposit to safely and securely receive INTERAC e-Transfer® transactions. Learn how.
How we protect you
When you bank online with HSBC, you're protected by our global security network and by advanced security technology.
How to protect yourself
Find out what steps you can take to protect your computer from hackers, viruses and spyware. And learn how to stay safe online when you bank, browse and shop. You can also read tips on how to prevent card and identity theft and how to recognize online fraud.
Report fraud
You should contact us immediately if you suspect someone has used your account or credit card fraudulently. We have 24-hour international helplines for HSBC account fraud, HSBC credit card fraud and for non-HSBC customers to report suspicious activities linked to our name.
Learn more about cyber security and how to stay safe online at the Government of Canada’s website.

Security Guarantee
We work with you to protect your account information. Under our Security Guarantee, we will fully reimburse you for unauthorized transactions conducted in your personal accounts through HSBC Online Banking or HSBC Canada Mobile Banking if you have met your security responsibilities.
- How we protect you
- How to protect yourself
- Know your responsibilities
- Report fraud
- Verify your browser
We do everything we can to prevent online fraud and to keep your personal information and your money safe.
From account monitoring to encryption and password protection:
- Instant access to statements online - eStatements contain the same information as paper statements
- No risk of identity theft - By switching to paperless banking you avoid the risk of identity theft
Global security network
To protect your account, we have a global network of security experts who work to identify threats and investigate suspicious activity. If we see something unusual that doesn't fit your banking profile, we'll try to stop the transaction from being completed – and contact you to check if it's valid.
If we discover that someone has used your account to make unauthorized payments or transfers, we'll take immediate action to minimize the impact on you. This action may include blocking transactions, suspending your account temporarily or closing your account and opening a new one.
Security technology
We use advanced security systems and software to protect your account from unauthorized use.
Log on security
You choose your own log on details when you register for Online Banking – which makes them unique, secure and easy to remember. Each time you log on, you'll be asked for your username and a unique code your personal HSBC Security Device will generate.
If you forget your HSBC Security Device, don't worry, you can use your password to log on. We also use an automatic time-out feature that ends your Online Banking session if you forget to log out – so your details aren't left on your computer.
Data masking
HSBC takes information security seriously and we want to ensure the handling of our customers’ data is protected using high security standards.
As part of our continuous drive to improve information security online and protect sensitive customer information from unintended users, HSBC will introduce new security measures to its Online banking service. Sensitive data such as Mastercard account numbers will be partially masked on your account summary screens. All other information will not be affected.
HSBC Security Device
As the name suggests, this device is like a front door key for your HSBC Online Banking. It uses advanced technology to give you a unique passcode every time you log on and make a transfer or payment.
Throughout history, people have always looked for ingenious ways to protect their treasure. It's the same online. We take online security very seriously. HSBC Security Device is another way to protect your personal treasure.
Learn more about HSBC Security Device
Encryption
When you manage your HSBC Bank Canada accounts online, advanced encryption software stops anyone from accessing your information when it passes between your computer and our secure systems. You know you're in a secure, encrypted area when you see https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page.
Firewalls
There are two types of firewall. A personal firewall protects your computer from hackers and viruses. Network firewalls protect private networks – and let you control who can access them.
At HSBC Bank Canada we use network firewalls to protect your personal information and account details. To protect your computer, you should activate the firewall in your operating system – or install a separate firewall if your system doesn't have one.
Digital certificates
Digital certificates are ID cards for web pages. They contain a company's name, a unique serial number and a digital signature – so you can check that the page you're viewing is legitimate.
HSBC Bank Canada’s Extended Validation digital certificate turns the address bar in your browser green. To see the digital certificate, click on the locked padlock symbol in your browser status bar at the bottom of the page – or on the green address bar at the top.
Card fraud protection
We take a number of preventive measures to protect you against card fraud.
- If your card is lost or stolen, at home or overseas, contact us immediately and we'll cancel it immediately and issue a replacement.
- Our advanced fraud detection system monitors your account for any unusual activity.
- Chip & PIN technology (where available) stops your card details from being copied and prevents anyone using your card without your PIN.
Top 4 security tips
- Keep your passwords and security details safe, so no one else can access your online accounts.
- Download security updates and patches for the computer programs you use.
- Update your anti-virus software regularly to protect your computer against attacks from new viruses.
- Install a personal firewall to block hackers and to stop spyware from recording the personal information you enter online.
Learn how criminals operate online – and how you can protect your computer, your cards and your personal information.
Protect your computer
How secure is your computer? Keeping your operating system, browser and security software up-to-date will protect you against threats from hackers, viruses and spyware.
Basic maintenance tips
- Update your operating systems. Always use current operating system versions which include the latest security features.
- Download security patches and updates. By choosing to receive automatic updates, you'll have the latest software as soon as it's available.
- Disable File and Printer Sharing on your computer to prevent unauthorized access.
- Use a current web browser – and keep it updated.
- Set your browser to block pop-ups.
- Turn your computer off when you're not using it. If you're not connected to the Internet, you're not exposed to hackers and viruses.
Using security software
- Use the latest anti-virus software to protect your computer against viruses and spam.
- Use an anti-spyware program.
- If your operating system has a built-in firewall, make sure it's enabled. Or install a separate firewall to block hackers.
- Use a secure password to stop anyone accessing the files on your computer.
- Use encryption software to protect wireless devices like your laptop and mobile phone.
Stay safe online
As well as protecting your computer, you should take steps to keep your personal information safe when you're banking, browsing and shopping online – and when you're using email and Instant Messenger.
Banking online
- Log on to Online or mobile banking every month to check that you recognize all the transactions. By monitoring your accounts regularly you'll spot anything unusual fast.
- Use Online or mobile banking to regularly check that your personal contact details are correct and kept up-to-date.
- Never access your online accounts on public computers in libraries, Internet cafes and schools. You can't guarantee these computers are secure – and you never know who might be looking over your shoulder.
- Always remember to log off from Online Banking and close your browser when you have finished your online banking session. This helps to prevent others from viewing your information at a later time.
- Turn off any features that offer to save your password for you.
- Clear your browser’s history and cache on a regular basis.
- Look for https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page. These tell you the page is secure.
For more information about Internet security, identity theft and fraud, visit one of the sites below:
- Canadian Anti-Fraud Centre
Website: www.antifraudcentre.ca
Toll-free (Canada and U.S.A.): 1-888-495-8501
Email: info@antifraudcentre.ca - Royal Canadian Mounted Police's identity theft and identity fraud program
Website: www.rcmp-grc.gc.ca/scams-fraudes/id-theft-vol-eng.htm - Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca - Interac
Website: www.interac.ca - Canadian Bankers Association
Website: www.cba.ca/how-to-bank-safely-online
- Major Credit Bureaus
Equifax: 1-800-465-7166
Trans Union: 1-866-525-0262 / Quebec: 1-877-713-3393
Passwords
- Never tell anyone your password. We will never ask you for your full password.
- Memorize your password. Don't write it down or store it on your computer or mobile phone.
- Change your passwords and verification question regularly – at least every 90 days.
- Use a combination of upper and lower case letters, numbers and symbols.
- Turn off features that automatically save passwords.
Browsing and shopping online
Browsing the Internet
- Don't respond to unsolicited requests for personal or account information.
- Don't give out personal information to blogs, online forums and other social networking sites.
- If you see a strange error message, don't click on it or respond to it – and run a virus check on your computer.
- Scan your computer files regularly, at least once a week.
- Don't install software or run programs unless you know they're from a reputable source.
Shopping online
- Choose well-known, reputable sites – and type the web address directly into the address bar.
- Make sure the site is secure – and check that it will encrypt your debit/credit card details. Look for https in the address and the locked padlock symbol in your browser status bar at the bottom of the page.
- Add an extra layer of security by registering for a service like Mastercard® SecureCode.
- Don't reply to any email claiming to be from HSBC if it asks for personal information such as passwords or account numbers – we never ask for this information by email.
- Don't enter your details if an email claiming to be from HSBC links to the Online Banking logon page, or any page that asks you to enter details. Don't open an email from someone you don't know. Read the subject line carefully – and don't be taken in by a friendly tone or urgent request.
- Turn off the preview pane in your email program.
- Don't click on a link or attachment in an unrecognized email, particularly if it's asking you to respond to an urgent request – or if the attached file ends in .exe.
- Use your junk mail filter – and delete emails from unknown sources immediately.
- Don't forward chain emails – they can contain harmful viruses.
Secure your mobile phone or tablet
Using a mobile phone or tablet computer is a very convenient way to bank. But make sure you apply what you know about staying safe online in the same way as the same threats are there.
Keep your device safe
- Avoid sharing your devices with others and use your own one to log on.
- Do not leave your device unattended after logon to Internet or mobile banking. Always log off properly when you are finished with it.
- Set up auto-lock and enable a passcode lock to prevent unauthorized access of your handset.
Use only trusted devices and software
- Set up a password and enable auto screen lock.
- Don't use untrusted custom virtual keyboards.
- Use default browsers originally provided with the handset rather than newly installed browsers downloaded from other sources.
- Don't use "jailbroken" handsets, which may have a security loophole, to log on to Internet or mobile banking.
- Don't install applications on your handset from untrusted sources. Stick to sources such as the App StoreSM or Google Play™.
- Don't allow installation of untrusted APKs (file extension name for Android applications).
- Enable data encryption (available on Android 4+).
General points to note
- Do not store your Online or mobile banking username and/or password on your device.
- When using Wi-Fi connection, use trusted Wi-Fi networks or service providers and enable security protection such as Wi-Fi Protected Access (WPA), if possible.
- Install and update to the latest operating system, anti-virus and anti-spyware software regularly on your handset, whenever they are available.
Prevent card and identity theft
From skimming your card at an ATM to stealing your mail, there are lots of ways a criminal can get hold of your card details and personal information. So it's important you know how to stop them.
Using ATMs
- Memorize your PIN. Don't write it down or keep it in your wallet or purse.
- Cover the ATM keypad when you're entering your PIN.
- Try to use ATMs under video surveillance – or ones located inside a bank.
- Avoid using ATMs at night. This is when most ATM crime takes place.
- Look out for shoulder surfers – people with binoculars or cameras watching you enter your PIN.
- Don't accept offers of "help". If someone approaches you at an ATM, leave immediately.
- Be suspicious of signs telling you to use a specific ATM – it could be fitted with a skimming device that copies your card details.
- Report anything unusual or suspicious to your bank.
Choosing a PIN
It's a good idea to change your PIN to a number you'll remember – but don't choose a PIN that's easy to guess. Here are some tips for choosing a new PIN.
- Make it a memorable date like your wedding anniversary or an historical event.
- Choose something quirky like the time your mailman arrives or when your alarm goes off.
- If you're better with words, use the number of letters in each word of a phrase you'll remember. For example, "I love my Mom" becomes 1423.
Protecting your mail
- If your mail is left in a public place, pick it up promptly – don't leave it out overnight or over the weekend.
- If you're living or working abroad, get your mail redirected to a different address or register for online statements.
- Shred documents like bank statements, bills and application forms for credit cards and loans – anything that includes your name, address and other personal details.
- Check your monthly bills and statements – and report any transactions you don't recognize.
- If you don't receive a bill or statement when you expect it, contact the organization straight away.
- If you move, tell your bank, card providers and all the other organizations you deal with. And redirect mail from your old address for at least a year.
Protecting your cards while you're travelling
We monitor your HSBC Bank Canada account to protect you from fraud and periodically carry out transaction verification on unusual activity. We make every effort to avoid service interruptions with your card, but sometimes it's unavoidable. We apologize if this causes you any inconvenience.
Before you leave the country
- Inform us of your travel plans to enable us to keep our fraud detection systems updated.
- Ensure we have your current contact information before travelling abroad – particularly your mobile phone number and email address.
- Take a note of our lost and stolen numbers in case of an emergency:
HSBC Bank Card: Call 1-888-310-4722
HSBC Mastercard: Call 1-866-406-4722
HSBC Premier Mastercard: Call 1-866-405-4722
We recommend you store them in your mobile phone. - Take several ways to pay – debit card, credit card, and cash.
While you're away
- Protect your card as if it was cash – keep it with you at all times and watch transactions being carried out.
- If your card is lost or stolen, contact us and report it immediately.
- Be vigilant when you're using an ATM – keep your PIN safe.
When you get home
Check your statement carefully. And contact your bank immediately if there are any transactions you don't recognize.
Recognize fraud
Some hints to recognize fraud:
- The padlock symbol is in the wrong place.
- You receive an urgent request to verify your account details.
- You receive a letter saying you've been pre-approved for credit
Phishing
If you receive an email asking for personal information or security details, don't reply or click on any links. It may look genuine, but it is likely to be someone "phishing" for your details by directing you to a fake website.
How to spot a phishing email
- They often contain spelling and grammatical errors.
- They give a fake web or email address like info@hsbc-security.com.
- They feature a logo that looks distorted.
- They're mostly sent in bulk – so the email might not be addressed to you personally.
- They often ask you to click on a link to confirm or validate your security details – and they threaten to close your account if you don't.
- Some ask you to send money to a worthy cause.
- The web address isn't quite right.
- The padlock symbol is in the wrong place. It should be in your browser status bar at the bottom of the page, not within the page itself.
- When you double-click on the padlock, you see a warning that the site address doesn't match the digital security certificate.
- Your browser tells you that the site is unsafe – or the address bar is highlighted red or yellow.
- You get an error message asking you to log on again.
- The phone number on the site doesn't match the number on your account statements.
- You can't link to a home page from the site.
If you receive a suspicious email or letter claiming to be from HSBC, you should report it immediately.
Phone fraud
Fraudsters may contact you by telephone too. If you receive a call claiming to be from HSBC:
- Don't provide any information about your TelePIN – we never ask for this information over the phone.
- If you have any doubts, end the call and contact us immediately on the telephone numbers you're familiar with.
Mail fraud
If it sounds too good to be true, it's probably a scam. Be suspicious of mail that contains any of these offers or requests.
- Letters from your bank highlighting a problem and asking for your account details.
- Letters from your bank advising they have money waiting for you and require you to confirm your account/personal details.
- Pre-approved credit offers that charge a fee to get the card.
- Job descriptions asking you to pay for more information.
- Work at home schemes where you have to buy something before you can start.
- Donation requests for unregistered charities.
- Sweepstakes and lotteries where you have to pay to receive your prize – particularly ones based in a different country.
Skimming
Card fraud can happen in restaurants, shops, gas stations – anywhere you pay with plastic. Here are some tips to keep your card safe.
- Don't let it out of your sight.
- Don't let anyone swipe your card a second time through a skimming device.
- Don't let someone look over your shoulder when you're entering your PIN.
- Don't leave receipts or carbon copies behind. Take them home and destroy them.
Frequently Asked Questions
How do I know if I am connecting to HSBC Bank Canada and not to other parties?
You may check the validity and owner of the encryption certificate in your browser. The Certificate Information should state who it is issued to and when it is valid for.
Why do I need to accept "cookies" to access my financial information online?
A cookie is a text file that resides on your computer. In order to provide a better, stable and secure service, Online banking uses two types of cookies as part of the interaction between your browser and the online banking Service:
Persistent Cookies:
"A Persistent Cookie" is used infrequently throughout the year, to provide usage information on specific functions contained on our Online Banking Application. This cookie tracks usage and your language preference, it does not contain any other customer related information.
Per-Session Cookies:
A "Per-session Cookie" assigns a session id when you log-on and stores it in your PC's temporary memory (RAM). This session ID is used to establish and validate your PC during your online banking session. When you log-off online banking the "Per-session Cookie" is removed. Per-session cookies do not contain any customer related information.
If your browser prompts you when a cookie is "served", you must accept it in order to access Online Banking. Since cookies are site specific, only HSBC can access, decode and make use of the information.
Know your responsibilities
It's important to review the terms and conditions of every product and service you use. They contain information on the steps you need to take to prevent fraud including:
- Review your account statements regularly and advise of any errors, omissions or irregularities including fraud and unauthorized activity within 30 days1.
- Keep your Secret Codes including Electronic Banking Number and Online Banking Logon Information confidential and take all reasonable precautions to maintain the secrecy and prevent unauthorized use2.
- Avoid accessing your online banking information at Internet or Cyber cafes, libraries or other public Internet portals, as there may be unwanted software installed that could record your password and other keyboard activity.
- Never input personal information on a website form or application that does not display the "https://" before a website address or a "padlock" symbol in the lower right-hand corner of the webpage. Commonly, these security symbols indicate that the site is secured by encryption technology and the information you enter is protected.
- Do not use your (or a close relative’s) birth date, telephone number, address or readily identifiable combination of letters or numbers as a Secret Code.
- Change your Online Banking Logon Information regularly and do not use any previously used Online Banking Password.
- Do not record your Online Banking Logon Information anywhere.
- Ensure that any information stored on any computer with which you access Online Banking is protected against unauthorized access by third parties.
- Do not use "save password" features.
- Always log off from your Online Banking when you are finished.
- Use all browser security measures including closing the web browser or clearing the browser's cache.
- For more information about using Online Banking and Security, please view our Electronic Access Agreement.
If you suspect that someone has used your account, card or personal details fraudulently, here are the numbers to call – and the steps you can take to minimize the impact on you and your credit record.
HSBC account fraud and lost or stolen cards
Be sure to notify the bank immediately if you suspect that you may be a victim of fraud or if there may be unauthorized activity on your accounts.
- Personal Online Banking customers, contact 1-877-621-8811
- Business Internet Banking customers, contact 1-866-808-4722
If you become a victim, you should file a report with your local police and obtain a copy that you can reference and share with your creditors.
To help us act fast, please have your 10-digit Personal Banking Number (PBN) and TelePIN on hand – along with details of the transactions you don't recognize.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
HSBC credit card fraud
If your HSBC credit card has been lost or stolen – or you suspect that it has been used fraudulently – contact our 24-hour helpline immediately at 1-866-406-4722.
If you're an HSBC Premier customer, call 1-866-405-4722. We'll cancel your card, issue a replacement and investigate the suspected transactions.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
Non-HSBC customers
Do you suspect that an HSBC account has been opened in your name? Is HSBC listed on your credit report when you haven't applied to us for credit? Have you received an email or phone call claiming to be from HSBC? If you see anything suspicious linked to our name, please call us at 1-877-621-8811.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
What to do if you're a victim of fraud
It's important to report fraud as soon as possible to limit the unauthorized transactions on your card or account – and to minimize the time it takes to correct your credit rating.
If you find out you've been a victim of fraud, you should take these steps immediately.
- If you suspect any suspicious behaviour, please contact one of the credit bureaus below:
Equifax: 1-800-465-7166
Trans Union: 1-866-525-0262 / Quebec -1-877-713-3393 - Close any accounts associated with the fraudulent activity.
- Report the crime to the police.
Suspicious emails and letters
If you receive a suspicious email or letter, that claims to have been sent from HSBC, please forward it to phishing@hsbc.com.
Alternatively, please call 1-866-233-3838 if you are a Premier customer.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
GENERAL
Why am I being asked to verify the browser I’m using?
- We’ve introduced an extra layer of security which will reduce the risk of unauthorized access from browsers that have not been used or verified before.
- If you’re on a personal computer or device and plan on using it to access your HSBC account in the future, select ”personal” to confirm this is a browser you trust.
- If you are on a public computer or device, select ”public”. We’ll ask you to verify this browser again the next time you use it to log on.
I’ve already verified before, why am I being asked again?
- You may be asked again in these situations:
- you’ve recently cleared cookies on your browser,
- your browser has been set to clear all cookies or cache after your browsing session has ended,
- you've installed a software that clears your cookies or cache periodically,
- you’ve re-installed your browser,
- you’ve updated your browser, or it is set to be automatically updated (which could be as often as monthly),
- you are in incognito / private browsing mode,
- you’ve updated your operating system (e.g. iOS, Android OS, Windows, macOS, etc.,)
- you’ve verified 10 browsers between your desktop and mobile devices, or
- it’s been 180 days since we last verified your browser.
What if I don’t want to use a code to verify my browser?
- If you have a security device, log on with it and you can skip the code by text/email. We’ll just ask you to verify if you’re using a public or personal browser.
- If you don’t have a security device, you can set up a Digital Security Device using your mobile/tablet; call us or chat with us online for help.
- For details, refer to our guides on the HSBC Security Device page.
- Alternatively, you can do your banking on the app.
GETTING YOUR CODE
Which code delivery method is better – text message or email?
- In general, codes are delivered sooner by text message than email. If you’re traveling and don’t have access to text message, you can request a code by email.
- Make sure you open your email in a separate window/tab so that you stay connected to online banking.
- You can also skip the step to receive a code if you log on with your physical or Digital Security Device.
- Alternatively, you can do your banking on the HSBC Canada app.
Why doesn’t my code work when I just got it from my email?
- Make sure you stay on the log on page and open your email in a new tab or window. If you open your email using the same tab/window on your browser, you’ve left our site. Your log on session will end and you’ll need to start the process again.
- Alternatively, you can choose to receive a code by text; we will send it to your mobile number that you have on file with us.
- You can skip this step if you log on with an HSBC Security Device or using the HSBC Canada app.
What if the text message never arrived and/or the phone number is incorrect?
- You can choose to have the code sent to an email; simply select the ”Didn’t receive a code?” link.
- You can also log on using a security device; then you won’t need a code.
- Once logged on, you can update your mobile number in Online Banking: Go to <Banking> in the top menu, select <Update Personal Details>, and follow the steps to update your mobile number.
Note: you’ll need your security device to update your contact information in Online Banking or on our app. If you don’t have a security device, contact us and we’ll help you set one up.
- Alternatively, you can update your phone number or do your banking on the HSBC Canada app.
Can an international phone number receive a code by text message?
- Yes, as long as the mobile service provider and your phone plan accepts text messages sent from Canada.
Are there any fees for receiving a code through text message?
- HSBC doesn’t charge any fees, but your mobile service provider may charge for message or data.
CODE NOT WORKING
I’m entering the code but it’s not being accepted.
- Only enter the 6-digit code after the bracketed number. Example: (01)123456 – only 123456 should be entered.
- If you’ve received multiple codes, check the numbers in the brackets. They should match the ones on the screen where you enter the code.
For example, if your code is (01)123456 but the screen shows (02) _ _ _ _ _ _ , then your code won’t work. You need to enter the code that starts with (02). - If you enter the code incorrectly 5 times, a new code needs to be requested.
How long does it take to receive the code?
- The text message with the code should arrive within one minute. You can request a new code by selecting the “Didn’t receive a code?” link on-screen.
- If you haven’t received it and you believe your phone number may be incorrect, you can choose to have the code sent by email instead.
- If you haven’t received an email either, you can check your Junk/Spam folders or refresh your mailbox.
- If you haven’t received any text message or email, contact us to check your phone number and/or email address on file. In the meantime, if you have a security device, log on with it and you can skip the code by text/email. Or you can log on using the HSBC Canada app.
Why isn’t the ”Didn’t receive a code?’’ link working?
- This link only works 30 seconds after the code has been sent out.
- This gives enough time for the code to arrive before a new one is requested again.
How many times can I request a code?
- You can request 5 codes before the function is temporarily locked.
- If you’re having trouble receiving your code, you can log on using a security device or do your banking in the HSBC Canada app.
- We also suggest you check your contact information on file – you can do this through the app or by calling us (at the phone number on the back of your debit card or at hsbc.ca/contact-us).
Can I use a previous code?
- You can only use a code once and it will expire after 10 minutes.
- If you’ve received multiple codes, check the numbers in the brackets. They should match the ones on the screen where you enter the code.
For example, if your code is (01)123456 but the screen shows (02) _ _ _ _ _ _ , then your code won’t work. You need to enter the code that starts with (02).
Will the code expire?
- Yes, the code will expire after 10 minutes.
How we protect you
We do everything we can to prevent online fraud and to keep your personal information and your money safe.
From account monitoring to encryption and password protection:
- Instant access to statements online - eStatements contain the same information as paper statements
- No risk of identity theft - By switching to paperless banking you avoid the risk of identity theft
Global security network
To protect your account, we have a global network of security experts who work to identify threats and investigate suspicious activity. If we see something unusual that doesn't fit your banking profile, we'll try to stop the transaction from being completed – and contact you to check if it's valid.
If we discover that someone has used your account to make unauthorized payments or transfers, we'll take immediate action to minimize the impact on you. This action may include blocking transactions, suspending your account temporarily or closing your account and opening a new one.
Security technology
We use advanced security systems and software to protect your account from unauthorized use.
Log on security
You choose your own log on details when you register for Online Banking – which makes them unique, secure and easy to remember. Each time you log on, you'll be asked for your username and a unique code your personal HSBC Security Device will generate.
If you forget your HSBC Security Device, don't worry, you can use your password to log on. We also use an automatic time-out feature that ends your Online Banking session if you forget to log out – so your details aren't left on your computer.
Data masking
HSBC takes information security seriously and we want to ensure the handling of our customers’ data is protected using high security standards.
As part of our continuous drive to improve information security online and protect sensitive customer information from unintended users, HSBC will introduce new security measures to its Online banking service. Sensitive data such as Mastercard account numbers will be partially masked on your account summary screens. All other information will not be affected.
HSBC Security Device
As the name suggests, this device is like a front door key for your HSBC Online Banking. It uses advanced technology to give you a unique passcode every time you log on and make a transfer or payment.
Throughout history, people have always looked for ingenious ways to protect their treasure. It's the same online. We take online security very seriously. HSBC Security Device is another way to protect your personal treasure.
Learn more about HSBC Security Device
Encryption
When you manage your HSBC Bank Canada accounts online, advanced encryption software stops anyone from accessing your information when it passes between your computer and our secure systems. You know you're in a secure, encrypted area when you see https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page.
Firewalls
There are two types of firewall. A personal firewall protects your computer from hackers and viruses. Network firewalls protect private networks – and let you control who can access them.
At HSBC Bank Canada we use network firewalls to protect your personal information and account details. To protect your computer, you should activate the firewall in your operating system – or install a separate firewall if your system doesn't have one.
Digital certificates
Digital certificates are ID cards for web pages. They contain a company's name, a unique serial number and a digital signature – so you can check that the page you're viewing is legitimate.
HSBC Bank Canada’s Extended Validation digital certificate turns the address bar in your browser green. To see the digital certificate, click on the locked padlock symbol in your browser status bar at the bottom of the page – or on the green address bar at the top.
Card fraud protection
We take a number of preventive measures to protect you against card fraud.
- If your card is lost or stolen, at home or overseas, contact us immediately and we'll cancel it immediately and issue a replacement.
- Our advanced fraud detection system monitors your account for any unusual activity.
- Chip & PIN technology (where available) stops your card details from being copied and prevents anyone using your card without your PIN.
Top 4 security tips
- Keep your passwords and security details safe, so no one else can access your online accounts.
- Download security updates and patches for the computer programs you use.
- Update your anti-virus software regularly to protect your computer against attacks from new viruses.
- Install a personal firewall to block hackers and to stop spyware from recording the personal information you enter online.
How to protect yourself
Learn how criminals operate online – and how you can protect your computer, your cards and your personal information.
Protect your computer
How secure is your computer? Keeping your operating system, browser and security software up-to-date will protect you against threats from hackers, viruses and spyware.
Basic maintenance tips
- Update your operating systems. Always use current operating system versions which include the latest security features.
- Download security patches and updates. By choosing to receive automatic updates, you'll have the latest software as soon as it's available.
- Disable File and Printer Sharing on your computer to prevent unauthorized access.
- Use a current web browser – and keep it updated.
- Set your browser to block pop-ups.
- Turn your computer off when you're not using it. If you're not connected to the Internet, you're not exposed to hackers and viruses.
Using security software
- Use the latest anti-virus software to protect your computer against viruses and spam.
- Use an anti-spyware program.
- If your operating system has a built-in firewall, make sure it's enabled. Or install a separate firewall to block hackers.
- Use a secure password to stop anyone accessing the files on your computer.
- Use encryption software to protect wireless devices like your laptop and mobile phone.
Stay safe online
As well as protecting your computer, you should take steps to keep your personal information safe when you're banking, browsing and shopping online – and when you're using email and Instant Messenger.
Banking online
- Log on to Online or mobile banking every month to check that you recognize all the transactions. By monitoring your accounts regularly you'll spot anything unusual fast.
- Use Online or mobile banking to regularly check that your personal contact details are correct and kept up-to-date.
- Never access your online accounts on public computers in libraries, Internet cafes and schools. You can't guarantee these computers are secure – and you never know who might be looking over your shoulder.
- Always remember to log off from Online Banking and close your browser when you have finished your online banking session. This helps to prevent others from viewing your information at a later time.
- Turn off any features that offer to save your password for you.
- Clear your browser’s history and cache on a regular basis.
- Look for https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page. These tell you the page is secure.
For more information about Internet security, identity theft and fraud, visit one of the sites below:
- Canadian Anti-Fraud Centre
Website: www.antifraudcentre.ca
Toll-free (Canada and U.S.A.): 1-888-495-8501
Email: info@antifraudcentre.ca - Royal Canadian Mounted Police's identity theft and identity fraud program
Website: www.rcmp-grc.gc.ca/scams-fraudes/id-theft-vol-eng.htm - Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca - Interac
Website: www.interac.ca - Canadian Bankers Association
Website: www.cba.ca/how-to-bank-safely-online
- Major Credit Bureaus
Equifax: 1-800-465-7166
Trans Union: 1-866-525-0262 / Quebec: 1-877-713-3393
Passwords
- Never tell anyone your password. We will never ask you for your full password.
- Memorize your password. Don't write it down or store it on your computer or mobile phone.
- Change your passwords and verification question regularly – at least every 90 days.
- Use a combination of upper and lower case letters, numbers and symbols.
- Turn off features that automatically save passwords.
Browsing and shopping online
Browsing the Internet
- Don't respond to unsolicited requests for personal or account information.
- Don't give out personal information to blogs, online forums and other social networking sites.
- If you see a strange error message, don't click on it or respond to it – and run a virus check on your computer.
- Scan your computer files regularly, at least once a week.
- Don't install software or run programs unless you know they're from a reputable source.
Shopping online
- Choose well-known, reputable sites – and type the web address directly into the address bar.
- Make sure the site is secure – and check that it will encrypt your debit/credit card details. Look for https in the address and the locked padlock symbol in your browser status bar at the bottom of the page.
- Add an extra layer of security by registering for a service like Mastercard® SecureCode.
- Don't reply to any email claiming to be from HSBC if it asks for personal information such as passwords or account numbers – we never ask for this information by email.
- Don't enter your details if an email claiming to be from HSBC links to the Online Banking logon page, or any page that asks you to enter details. Don't open an email from someone you don't know. Read the subject line carefully – and don't be taken in by a friendly tone or urgent request.
- Turn off the preview pane in your email program.
- Don't click on a link or attachment in an unrecognized email, particularly if it's asking you to respond to an urgent request – or if the attached file ends in .exe.
- Use your junk mail filter – and delete emails from unknown sources immediately.
- Don't forward chain emails – they can contain harmful viruses.
Secure your mobile phone or tablet
Using a mobile phone or tablet computer is a very convenient way to bank. But make sure you apply what you know about staying safe online in the same way as the same threats are there.
Keep your device safe
- Avoid sharing your devices with others and use your own one to log on.
- Do not leave your device unattended after logon to Internet or mobile banking. Always log off properly when you are finished with it.
- Set up auto-lock and enable a passcode lock to prevent unauthorized access of your handset.
Use only trusted devices and software
- Set up a password and enable auto screen lock.
- Don't use untrusted custom virtual keyboards.
- Use default browsers originally provided with the handset rather than newly installed browsers downloaded from other sources.
- Don't use "jailbroken" handsets, which may have a security loophole, to log on to Internet or mobile banking.
- Don't install applications on your handset from untrusted sources. Stick to sources such as the App StoreSM or Google Play™.
- Don't allow installation of untrusted APKs (file extension name for Android applications).
- Enable data encryption (available on Android 4+).
General points to note
- Do not store your Online or mobile banking username and/or password on your device.
- When using Wi-Fi connection, use trusted Wi-Fi networks or service providers and enable security protection such as Wi-Fi Protected Access (WPA), if possible.
- Install and update to the latest operating system, anti-virus and anti-spyware software regularly on your handset, whenever they are available.
Prevent card and identity theft
From skimming your card at an ATM to stealing your mail, there are lots of ways a criminal can get hold of your card details and personal information. So it's important you know how to stop them.
Using ATMs
- Memorize your PIN. Don't write it down or keep it in your wallet or purse.
- Cover the ATM keypad when you're entering your PIN.
- Try to use ATMs under video surveillance – or ones located inside a bank.
- Avoid using ATMs at night. This is when most ATM crime takes place.
- Look out for shoulder surfers – people with binoculars or cameras watching you enter your PIN.
- Don't accept offers of "help". If someone approaches you at an ATM, leave immediately.
- Be suspicious of signs telling you to use a specific ATM – it could be fitted with a skimming device that copies your card details.
- Report anything unusual or suspicious to your bank.
Choosing a PIN
It's a good idea to change your PIN to a number you'll remember – but don't choose a PIN that's easy to guess. Here are some tips for choosing a new PIN.
- Make it a memorable date like your wedding anniversary or an historical event.
- Choose something quirky like the time your mailman arrives or when your alarm goes off.
- If you're better with words, use the number of letters in each word of a phrase you'll remember. For example, "I love my Mom" becomes 1423.
Protecting your mail
- If your mail is left in a public place, pick it up promptly – don't leave it out overnight or over the weekend.
- If you're living or working abroad, get your mail redirected to a different address or register for online statements.
- Shred documents like bank statements, bills and application forms for credit cards and loans – anything that includes your name, address and other personal details.
- Check your monthly bills and statements – and report any transactions you don't recognize.
- If you don't receive a bill or statement when you expect it, contact the organization straight away.
- If you move, tell your bank, card providers and all the other organizations you deal with. And redirect mail from your old address for at least a year.
Protecting your cards while you're travelling
We monitor your HSBC Bank Canada account to protect you from fraud and periodically carry out transaction verification on unusual activity. We make every effort to avoid service interruptions with your card, but sometimes it's unavoidable. We apologize if this causes you any inconvenience.
Before you leave the country
- Inform us of your travel plans to enable us to keep our fraud detection systems updated.
- Ensure we have your current contact information before travelling abroad – particularly your mobile phone number and email address.
- Take a note of our lost and stolen numbers in case of an emergency:
HSBC Bank Card: Call 1-888-310-4722
HSBC Mastercard: Call 1-866-406-4722
HSBC Premier Mastercard: Call 1-866-405-4722
We recommend you store them in your mobile phone. - Take several ways to pay – debit card, credit card, and cash.
While you're away
- Protect your card as if it was cash – keep it with you at all times and watch transactions being carried out.
- If your card is lost or stolen, contact us and report it immediately.
- Be vigilant when you're using an ATM – keep your PIN safe.
When you get home
Check your statement carefully. And contact your bank immediately if there are any transactions you don't recognize.
Recognize fraud
Some hints to recognize fraud:
- The padlock symbol is in the wrong place.
- You receive an urgent request to verify your account details.
- You receive a letter saying you've been pre-approved for credit
Phishing
If you receive an email asking for personal information or security details, don't reply or click on any links. It may look genuine, but it is likely to be someone "phishing" for your details by directing you to a fake website.
How to spot a phishing email
- They often contain spelling and grammatical errors.
- They give a fake web or email address like info@hsbc-security.com.
- They feature a logo that looks distorted.
- They're mostly sent in bulk – so the email might not be addressed to you personally.
- They often ask you to click on a link to confirm or validate your security details – and they threaten to close your account if you don't.
- Some ask you to send money to a worthy cause.
- The web address isn't quite right.
- The padlock symbol is in the wrong place. It should be in your browser status bar at the bottom of the page, not within the page itself.
- When you double-click on the padlock, you see a warning that the site address doesn't match the digital security certificate.
- Your browser tells you that the site is unsafe – or the address bar is highlighted red or yellow.
- You get an error message asking you to log on again.
- The phone number on the site doesn't match the number on your account statements.
- You can't link to a home page from the site.
If you receive a suspicious email or letter claiming to be from HSBC, you should report it immediately.
Phone fraud
Fraudsters may contact you by telephone too. If you receive a call claiming to be from HSBC:
- Don't provide any information about your TelePIN – we never ask for this information over the phone.
- If you have any doubts, end the call and contact us immediately on the telephone numbers you're familiar with.
Mail fraud
If it sounds too good to be true, it's probably a scam. Be suspicious of mail that contains any of these offers or requests.
- Letters from your bank highlighting a problem and asking for your account details.
- Letters from your bank advising they have money waiting for you and require you to confirm your account/personal details.
- Pre-approved credit offers that charge a fee to get the card.
- Job descriptions asking you to pay for more information.
- Work at home schemes where you have to buy something before you can start.
- Donation requests for unregistered charities.
- Sweepstakes and lotteries where you have to pay to receive your prize – particularly ones based in a different country.
Skimming
Card fraud can happen in restaurants, shops, gas stations – anywhere you pay with plastic. Here are some tips to keep your card safe.
- Don't let it out of your sight.
- Don't let anyone swipe your card a second time through a skimming device.
- Don't let someone look over your shoulder when you're entering your PIN.
- Don't leave receipts or carbon copies behind. Take them home and destroy them.
Frequently Asked Questions
How do I know if I am connecting to HSBC Bank Canada and not to other parties?
You may check the validity and owner of the encryption certificate in your browser. The Certificate Information should state who it is issued to and when it is valid for.
Why do I need to accept "cookies" to access my financial information online?
A cookie is a text file that resides on your computer. In order to provide a better, stable and secure service, Online banking uses two types of cookies as part of the interaction between your browser and the online banking Service:
Persistent Cookies:
"A Persistent Cookie" is used infrequently throughout the year, to provide usage information on specific functions contained on our Online Banking Application. This cookie tracks usage and your language preference, it does not contain any other customer related information.
Per-Session Cookies:
A "Per-session Cookie" assigns a session id when you log-on and stores it in your PC's temporary memory (RAM). This session ID is used to establish and validate your PC during your online banking session. When you log-off online banking the "Per-session Cookie" is removed. Per-session cookies do not contain any customer related information.
If your browser prompts you when a cookie is "served", you must accept it in order to access Online Banking. Since cookies are site specific, only HSBC can access, decode and make use of the information.
Know your responsibilities
Know your responsibilities
It's important to review the terms and conditions of every product and service you use. They contain information on the steps you need to take to prevent fraud including:
- Review your account statements regularly and advise of any errors, omissions or irregularities including fraud and unauthorized activity within 30 days1.
- Keep your Secret Codes including Electronic Banking Number and Online Banking Logon Information confidential and take all reasonable precautions to maintain the secrecy and prevent unauthorized use2.
- Avoid accessing your online banking information at Internet or Cyber cafes, libraries or other public Internet portals, as there may be unwanted software installed that could record your password and other keyboard activity.
- Never input personal information on a website form or application that does not display the "https://" before a website address or a "padlock" symbol in the lower right-hand corner of the webpage. Commonly, these security symbols indicate that the site is secured by encryption technology and the information you enter is protected.
- Do not use your (or a close relative’s) birth date, telephone number, address or readily identifiable combination of letters or numbers as a Secret Code.
- Change your Online Banking Logon Information regularly and do not use any previously used Online Banking Password.
- Do not record your Online Banking Logon Information anywhere.
- Ensure that any information stored on any computer with which you access Online Banking is protected against unauthorized access by third parties.
- Do not use "save password" features.
- Always log off from your Online Banking when you are finished.
- Use all browser security measures including closing the web browser or clearing the browser's cache.
- For more information about using Online Banking and Security, please view our Electronic Access Agreement.
Report fraud
If you suspect that someone has used your account, card or personal details fraudulently, here are the numbers to call – and the steps you can take to minimize the impact on you and your credit record.
HSBC account fraud and lost or stolen cards
Be sure to notify the bank immediately if you suspect that you may be a victim of fraud or if there may be unauthorized activity on your accounts.
- Personal Online Banking customers, contact 1-877-621-8811
- Business Internet Banking customers, contact 1-866-808-4722
If you become a victim, you should file a report with your local police and obtain a copy that you can reference and share with your creditors.
To help us act fast, please have your 10-digit Personal Banking Number (PBN) and TelePIN on hand – along with details of the transactions you don't recognize.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
HSBC credit card fraud
If your HSBC credit card has been lost or stolen – or you suspect that it has been used fraudulently – contact our 24-hour helpline immediately at 1-866-406-4722.
If you're an HSBC Premier customer, call 1-866-405-4722. We'll cancel your card, issue a replacement and investigate the suspected transactions.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
Non-HSBC customers
Do you suspect that an HSBC account has been opened in your name? Is HSBC listed on your credit report when you haven't applied to us for credit? Have you received an email or phone call claiming to be from HSBC? If you see anything suspicious linked to our name, please call us at 1-877-621-8811.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
What to do if you're a victim of fraud
It's important to report fraud as soon as possible to limit the unauthorized transactions on your card or account – and to minimize the time it takes to correct your credit rating.
If you find out you've been a victim of fraud, you should take these steps immediately.
- If you suspect any suspicious behaviour, please contact one of the credit bureaus below:
Equifax: 1-800-465-7166
Trans Union: 1-866-525-0262 / Quebec -1-877-713-3393 - Close any accounts associated with the fraudulent activity.
- Report the crime to the police.
Suspicious emails and letters
If you receive a suspicious email or letter, that claims to have been sent from HSBC, please forward it to phishing@hsbc.com.
Alternatively, please call 1-866-233-3838 if you are a Premier customer.
Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.
Verify your browser
GENERAL
Why am I being asked to verify the browser I’m using?
- We’ve introduced an extra layer of security which will reduce the risk of unauthorized access from browsers that have not been used or verified before.
- If you’re on a personal computer or device and plan on using it to access your HSBC account in the future, select ”personal” to confirm this is a browser you trust.
- If you are on a public computer or device, select ”public”. We’ll ask you to verify this browser again the next time you use it to log on.
I’ve already verified before, why am I being asked again?
- You may be asked again in these situations:
- you’ve recently cleared cookies on your browser,
- your browser has been set to clear all cookies or cache after your browsing session has ended,
- you've installed a software that clears your cookies or cache periodically,
- you’ve re-installed your browser,
- you’ve updated your browser, or it is set to be automatically updated (which could be as often as monthly),
- you are in incognito / private browsing mode,
- you’ve updated your operating system (e.g. iOS, Android OS, Windows, macOS, etc.,)
- you’ve verified 10 browsers between your desktop and mobile devices, or
- it’s been 180 days since we last verified your browser.
What if I don’t want to use a code to verify my browser?
- If you have a security device, log on with it and you can skip the code by text/email. We’ll just ask you to verify if you’re using a public or personal browser.
- If you don’t have a security device, you can set up a Digital Security Device using your mobile/tablet; call us or chat with us online for help.
- For details, refer to our guides on the HSBC Security Device page.
- Alternatively, you can do your banking on the app.
GETTING YOUR CODE
Which code delivery method is better – text message or email?
- In general, codes are delivered sooner by text message than email. If you’re traveling and don’t have access to text message, you can request a code by email.
- Make sure you open your email in a separate window/tab so that you stay connected to online banking.
- You can also skip the step to receive a code if you log on with your physical or Digital Security Device.
- Alternatively, you can do your banking on the HSBC Canada app.
Why doesn’t my code work when I just got it from my email?
- Make sure you stay on the log on page and open your email in a new tab or window. If you open your email using the same tab/window on your browser, you’ve left our site. Your log on session will end and you’ll need to start the process again.
- Alternatively, you can choose to receive a code by text; we will send it to your mobile number that you have on file with us.
- You can skip this step if you log on with an HSBC Security Device or using the HSBC Canada app.
What if the text message never arrived and/or the phone number is incorrect?
- You can choose to have the code sent to an email; simply select the ”Didn’t receive a code?” link.
- You can also log on using a security device; then you won’t need a code.
- Once logged on, you can update your mobile number in Online Banking: Go to <Banking> in the top menu, select <Update Personal Details>, and follow the steps to update your mobile number.
Note: you’ll need your security device to update your contact information in Online Banking or on our app. If you don’t have a security device, contact us and we’ll help you set one up.
- Alternatively, you can update your phone number or do your banking on the HSBC Canada app.
Can an international phone number receive a code by text message?
- Yes, as long as the mobile service provider and your phone plan accepts text messages sent from Canada.
Are there any fees for receiving a code through text message?
- HSBC doesn’t charge any fees, but your mobile service provider may charge for message or data.
CODE NOT WORKING
I’m entering the code but it’s not being accepted.
- Only enter the 6-digit code after the bracketed number. Example: (01)123456 – only 123456 should be entered.
- If you’ve received multiple codes, check the numbers in the brackets. They should match the ones on the screen where you enter the code.
For example, if your code is (01)123456 but the screen shows (02) _ _ _ _ _ _ , then your code won’t work. You need to enter the code that starts with (02). - If you enter the code incorrectly 5 times, a new code needs to be requested.
How long does it take to receive the code?
- The text message with the code should arrive within one minute. You can request a new code by selecting the “Didn’t receive a code?” link on-screen.
- If you haven’t received it and you believe your phone number may be incorrect, you can choose to have the code sent by email instead.
- If you haven’t received an email either, you can check your Junk/Spam folders or refresh your mailbox.
- If you haven’t received any text message or email, contact us to check your phone number and/or email address on file. In the meantime, if you have a security device, log on with it and you can skip the code by text/email. Or you can log on using the HSBC Canada app.
Why isn’t the ”Didn’t receive a code?’’ link working?
- This link only works 30 seconds after the code has been sent out.
- This gives enough time for the code to arrive before a new one is requested again.
How many times can I request a code?
- You can request 5 codes before the function is temporarily locked.
- If you’re having trouble receiving your code, you can log on using a security device or do your banking in the HSBC Canada app.
- We also suggest you check your contact information on file – you can do this through the app or by calling us (at the phone number on the back of your debit card or at hsbc.ca/contact-us).
Can I use a previous code?
- You can only use a code once and it will expire after 10 minutes.
- If you’ve received multiple codes, check the numbers in the brackets. They should match the ones on the screen where you enter the code.
For example, if your code is (01)123456 but the screen shows (02) _ _ _ _ _ _ , then your code won’t work. You need to enter the code that starts with (02).
Will the code expire?
- Yes, the code will expire after 10 minutes.
1If you fail to do so, the bank is not responsible for any preventable loss.
2 You agree to be liable for any losses except those that occur after you notify the bank that you suspect the Secret Code might be known or that any unauthorized use or fraud of an account or service may be occurring.
* This link may allow you to access a non-HSBC website. HSBC Bank Canada has no control over the linked website and is not liable for your use of it.
® Mastercard is a registered trademark of Mastercard International Incorporated. Used pursuant to license.
®Trade-mark of Interac Inc. Used under license.
iOS is a trademark or registered trademark of Cisco in the U.S. and other countries and is used under license. iPhone, iPad and iPod touch are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a registered trademark of Apple in Canada.
App Store is a service mark of Apple Inc., registered in the U.S. and other countries.
Android and Google Play are trademarks of Google Inc.