Security

To protect your account, we have a global network of security experts who work to identify threats and investigate suspicious activity. If we see something unusual that doesn't fit your banking profile, we'll try to stop the transaction from being completed – and contact you to check if it's valid.

If we discover that someone has used your account to make unauthorized payments or transfers, we'll take immediate action to minimize the impact on you. This action may include blocking transactions, suspending your account temporarily or closing your account and opening a new one.

We use advanced security systems and software to protect your account from unauthorized use.

You choose your own log on details when you register for Online Banking – which makes them unique, secure and easy to remember. Each time you log on, you'll be asked for your username and a unique code your personal HSBC Security Device will generate.

If you forget your HSBC Security Device, don't worry, you can use your password to log on. We also use an automatic time-out feature that ends your Online Banking session if you forget to log out – so your details aren't left on your computer.

HSBC takes information security seriously and we want to ensure the handling of our customers’ data is protected using high security standards.

As part of our continuous drive to improve information security online and protect sensitive customer information from unintended users, HSBC will introduce new security measures to its Online banking service. Sensitive data such as Mastercard account numbers will be partially masked on your account summary screens. All other information will not be affected.

As the name suggests, this device is like a front door key for your HSBC Online Banking. It uses advanced technology to give you a unique passcode every time you log on and make a transfer or payment.

Throughout history, people have always looked for ingenious ways to protect their treasure. It's the same online. We take online security very seriously. HSBC Security Device is another way to protect your personal treasure.

Learn more about HSBC Security Device

When you manage your HSBC Bank Canada accounts online, advanced encryption software stops anyone from accessing your information when it passes between your computer and our secure systems. You know you're in a secure, encrypted area when you see https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page.

There are two types of firewall. A personal firewall protects your computer from hackers and viruses. Network firewalls protect private networks – and let you control who can access them.

At HSBC Bank Canada we use network firewalls to protect your personal information and account details. To protect your computer, you should activate the firewall in your operating system – or install a separate firewall if your system doesn't have one.

Digital certificates are ID cards for web pages. They contain a company's name, a unique serial number and a digital signature – so you can check that the page you're viewing is legitimate.

HSBC Bank Canada’s Extended Validation digital certificate turns the address bar in your browser green. To see the digital certificate, click on the locked padlock symbol in your browser status bar at the bottom of the page – or on the green address bar at the top.

We take a number of preventive measures to protect you against card fraud.

• If your card is lost or stolen, at home or overseas, contact us immediately and we'll cancel it immediately and issue a replacement.
• Our advanced fraud detection system monitors your account for any unusual activity.
• Chip & PIN technology (where available) stops your card details from being copied and prevents anyone using your card without your PIN.

• Keep your passwords and security details safe, so no one else can access your online accounts.
• Download security updates and patches for the computer programs you use.
• Update your anti-virus software regularly to protect your computer against attacks from new viruses.
• Install a personal firewall to block hackers and to stop spyware from recording the personal information you enter online.
  

How secure is your computer? Keeping your operating system, browser and security software up-to-date will protect you against threats from hackers, viruses and spyware.

• Update your operating systems. Always use current operating system versions which include the latest security features.
• Download security patches and updates. By choosing to receive automatic updates, you'll have the latest software as soon as it's available.
• Disable File and Printer Sharing on your computer to prevent unauthorized access.
• Use a current web browser – and keep it updated.
• Set your browser to block pop-ups.
• Turn your computer off when you're not using it. If you're not connected to the Internet, you're not exposed to hackers and viruses.

• Use the latest anti-virus software to protect your computer against viruses and spam.
• Use an anti-spyware program.
• If your operating system has a built-in firewall, make sure it's enabled. Or install a separate firewall to block hackers.
• Use a secure password to stop anyone accessing the files on your computer.
• Use encryption software to protect wireless devices like your laptop and mobile phone.
  

As well as protecting your computer, you should take steps to keep your personal information safe when you're banking, browsing and shopping online – and when you're using email and Instant Messenger.

• Log on to Online or mobile banking every month to check that you recognize all the transactions. By monitoring your accounts regularly you'll spot anything unusual fast.
  
• Use Online or mobile banking to regularly check that your personal contact details are correct and kept up-to-date.
  
• Never access your online accounts on public computers in libraries, Internet cafes and schools. You can't guarantee these computers are secure – and you never know who might be looking over your shoulder.
  
• Always remember to log off from Online Banking and close your browser when you have finished your online banking session. This helps to prevent others from viewing your information at a later time.
  
• Turn off any features that offer to save your password for you.
  
• Clear your browser’s history and cache on a regular basis.
  
• Look for https in the web address – and the locked padlock symbol in your browser status bar at the bottom of the page. These tell you the page is secure.
  
  

For more information about Internet security, identity theft and fraud, visit one of the sites below:

• Canadian Anti-Fraud Centre
  Website: www.antifraudcentre.ca
  Toll-free (Canada and U.S.A.): 1-888-495-8501
  Email: info@antifraudcentre.ca
• Royal Canadian Mounted Police's identity theft and identity fraud program
  Website: www.rcmp-grc.gc.ca/scams-fraudes/id-theft-vol-eng.htm
• Office of the Privacy Commissioner of Canada
  Website: www.priv.gc.ca
• Interac
  Website: www.interac.ca
• Canadian Bankers Association
  Website: www.cba.ca/how-to-bank-safely-online
  
• Major Credit Bureaus
  Equifax: 1-800-465-7166
  Trans Union: 1-866-525-0262 / Quebec: 1-877-713-3393

• Never tell anyone your password. We will never ask you for your full password.
• Memorize your password. Don't write it down or store it on your computer or mobile phone.
• Change your passwords and verification question regularly – at least every 90 days.
• Use a combination of upper and lower case letters, numbers and symbols.
• Turn off features that automatically save passwords.

• Don't respond to unsolicited requests for personal or account information.
• Don't give out personal information to blogs, online forums and other social networking sites.
• If you see a strange error message, don't click on it or respond to it – and run a virus check on your computer.
• Scan your computer files regularly, at least once a week.
• Don't install software or run programs unless you know they're from a reputable source.
  

• Choose well-known, reputable sites – and type the web address directly into the address bar.
• Make sure the site is secure – and check that it will encrypt your debit/credit card details. Look for https in the address and the locked padlock symbol in your browser status bar at the bottom of the page.
• Add an extra layer of security by registering for a service like Mastercard® SecureCode.

• Don't reply to any email claiming to be from HSBC if it asks for personal information such as passwords or account numbers – we never ask for this information by email.
• Don't enter your details if an email claiming to be from HSBC links to the Online Banking logon page, or any page that asks you to enter details. Don't open an email from someone you don't know. Read the subject line carefully – and don't be taken in by a friendly tone or urgent request.
• Turn off the preview pane in your email program.
• Don't click on a link or attachment in an unrecognized email, particularly if it's asking you to respond to an urgent request – or if the attached file ends in .exe.
• Use your junk mail filter – and delete emails from unknown sources immediately.
• Don't forward chain emails – they can contain harmful viruses.

Using a mobile phone or tablet computer is a very convenient way to bank. But make sure you apply what you know about staying safe online in the same way as the same threats are there.

• Avoid sharing your devices with others and use your own one to log on.
• Do not leave your device unattended after logon to Internet or mobile banking. Always log off properly when you are finished with it.
• Set up auto-lock and enable a passcode lock to prevent unauthorized access of your handset.

• Set up a password and enable auto screen lock.
• Don't use untrusted custom virtual keyboards.
• Use default browsers originally provided with the handset rather than newly installed browsers downloaded from other sources.
• Don't use "jailbroken" handsets, which may have a security loophole, to log on to Internet or mobile banking.
• Don't install applications on your handset from untrusted sources. Stick to sources such as the App Store^SM or Google Play™.
• Don't allow installation of untrusted APKs (file extension name for Android applications).
• Enable data encryption (available on Android 4+).
  

• Do not store your Online or mobile banking username and/or password on your device.
• When using Wi-Fi connection, use trusted Wi-Fi networks or service providers and enable security protection such as Wi-Fi Protected Access (WPA), if possible.
• Install and update to the latest operating system, anti-virus and anti-spyware software regularly on your handset, whenever they are available.

From skimming your card at an ATM to stealing your mail, there are lots of ways a criminal can get hold of your card details and personal information. So it's important you know how to stop them.

• Memorize your PIN. Don't write it down or keep it in your wallet or purse.
• Cover the ATM keypad when you're entering your PIN.
• Try to use ATMs under video surveillance – or ones located inside a bank.
• Avoid using ATMs at night. This is when most ATM crime takes place.
• Look out for shoulder surfers – people with binoculars or cameras watching you enter your PIN.
• Don't accept offers of "help". If someone approaches you at an ATM, leave immediately.
• Be suspicious of signs telling you to use a specific ATM – it could be fitted with a skimming device that copies your card details.
• Report anything unusual or suspicious to your bank.

It's a good idea to change your PIN to a number you'll remember – but don't choose a PIN that's easy to guess. Here are some tips for choosing a new PIN.

• Make it a memorable date like your wedding anniversary or an historical event.
• Choose something quirky like the time your mailman arrives or when your alarm goes off.
• If you're better with words, use the number of letters in each word of a phrase you'll remember. For example, "I love my Mom" becomes 1423.

• If your mail is left in a public place, pick it up promptly – don't leave it out overnight or over the weekend.
• If you're living or working abroad, get your mail redirected to a different address or register for online statements.
• Shred documents like bank statements, bills and application forms for credit cards and loans – anything that includes your name, address and other personal details.
• Check your monthly bills and statements – and report any transactions you don't recognize.
• If you don't receive a bill or statement when you expect it, contact the organization straight away.
• If you move, tell your bank, card providers and all the other organizations you deal with. And redirect mail from your old address for at least a year.

We monitor your HSBC Bank Canada account to protect you from fraud and periodically carry out transaction verification on unusual activity. We make every effort to avoid service interruptions with your card, but sometimes it's unavoidable. We apologize if this causes you any inconvenience.

• Inform us of your travel plans to enable us to keep our fraud detection systems updated.
• Ensure we have your current contact information before travelling abroad – particularly your mobile phone number and email address.
• Take a note of our lost and stolen numbers in case of an emergency:
  
  HSBC Bank Card: Call 1-888-310-4722
  HSBC Mastercard: Call 1-866-406-4722
  HSBC Premier Mastercard: Call 1-866-405-4722
  
  We recommend you store them in your mobile phone.
• Take several ways to pay – debit card, credit card, and cash.

• Protect your card as if it was cash – keep it with you at all times and watch transactions being carried out.
• If your card is lost or stolen, contact us and report it immediately.
• Be vigilant when you're using an ATM – keep your PIN safe.

Check your statement carefully. And contact your bank immediately if there are any transactions you don't recognize.

Some hints to recognize fraud:

• The padlock symbol is in the wrong place.
• You receive an urgent request to verify your account details.
• You receive a letter saying you've been pre-approved for credit

If you receive an email asking for personal information or security details, don't reply or click on any links. It may look genuine, but it is likely to be someone "phishing" for your details by directing you to a fake website.

• They often contain spelling and grammatical errors.
• They give a fake web or email address like info@hsbc-security.com.
• They feature a logo that looks distorted.
• They're mostly sent in bulk – so the email might not be addressed to you personally.
• They often ask you to click on a link to confirm or validate your security details – and they threaten to close your account if you don't.
• Some ask you to send money to a worthy cause.
• The web address isn't quite right.
• The padlock symbol is in the wrong place. It should be in your browser status bar at the bottom of the page, not within the page itself.
• When you double-click on the padlock, you see a warning that the site address doesn't match the digital security certificate.
• Your browser tells you that the site is unsafe – or the address bar is highlighted red or yellow.
• You get an error message asking you to log on again.
• The phone number on the site doesn't match the number on your account statements.
• You can't link to a home page from the site.

If you receive a suspicious email or letter claiming to be from HSBC, you should report it immediately.

Fraudsters may contact you by telephone too. If you receive a call claiming to be from HSBC:

• Don't provide any information about your TelePIN – we never ask for this information over the phone.
• If you have any doubts, end the call and contact us immediately on the telephone numbers you're familiar with.

If it sounds too good to be true, it's probably a scam. Be suspicious of mail that contains any of these offers or requests.

• Letters from your bank highlighting a problem and asking for your account details.
• Letters from your bank advising they have money waiting for you and require you to confirm your account/personal details.
• Pre-approved credit offers that charge a fee to get the card.
• Job descriptions asking you to pay for more information.
• Work at home schemes where you have to buy something before you can start.
• Donation requests for unregistered charities.
• Sweepstakes and lotteries where you have to pay to receive your prize – particularly ones based in a different country.

Card fraud can happen in restaurants, shops, gas stations – anywhere you pay with plastic. Here are some tips to keep your card safe.

• Don't let it out of your sight.
• Don't let anyone swipe your card a second time through a skimming device.
• Don't let someone look over your shoulder when you're entering your PIN.
• Don't leave receipts or carbon copies behind. Take them home and destroy them.

You may check the validity and owner of the encryption certificate in your browser. The Certificate Information should state who it is issued to and when it is valid for.

A cookie is a text file that resides on your computer. In order to provide a better, stable and secure service, Online banking uses two types of cookies as part of the interaction between your browser and the online banking Service:

"A Persistent Cookie" is used infrequently throughout the year, to provide usage information on specific functions contained on our Online Banking Application. This cookie tracks usage and your language preference, it does not contain any other customer related information.

A "Per-session Cookie" assigns a session id when you log-on and stores it in your PC's temporary memory (RAM). This session ID is used to establish and validate your PC during your online banking session. When you log-off online banking the "Per-session Cookie" is removed. Per-session cookies do not contain any customer related information.

If your browser prompts you when a cookie is "served", you must accept it in order to access Online Banking. Since cookies are site specific, only HSBC can access, decode and make use of the information.

It's important to review the terms and conditions of every product and service you use. They contain information on the steps you need to take to prevent fraud including:

• Review your account statements regularly and advise of any errors, omissions or irregularities including fraud and unauthorized activity within 30 days¹.
• Keep your Secret Codes including Electronic Banking Number and Online Banking Logon Information confidential and take all reasonable precautions to maintain the secrecy and prevent unauthorized use².
• Avoid accessing your online banking information at Internet or Cyber cafes, libraries or other public Internet portals, as there may be unwanted software installed that could record your password and other keyboard activity.
• Never input personal information on a website form or application that does not display the "https://" before a website address or a "padlock" symbol in the lower right-hand corner of the webpage. Commonly, these security symbols indicate that the site is secured by encryption technology and the information you enter is protected.
• Do not use your (or a close relative’s) birth date, telephone number, address or readily identifiable combination of letters or numbers as a Secret Code.
• Change your Online Banking Logon Information regularly and do not use any previously used Online Banking Password.
• Do not record your Online Banking Logon Information anywhere.
• Ensure that any information stored on any computer with which you access Online Banking is protected against unauthorized access by third parties.
• Do not use "save password" features.
• Always log off from your Online Banking when you are finished.
• Use all browser security measures including closing the web browser or clearing the browser's cache.
• For more information about using Online Banking and Security, please view our Electronic Access Agreement.
  

Be sure to notify the bank immediately if you suspect that you may be a victim of fraud or if there may be unauthorized activity on your accounts.

• Personal Online Banking customers, contact 1-877-621-8811
• Business Internet Banking customers, contact 1-866-808-4722
   

If you become a victim, you should file a report with your local police and obtain a copy that you can reference and share with your creditors.

To help us act fast, please have your 10-digit Personal Banking Number (PBN) and TelePIN on hand – along with details of the transactions you don't recognize.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

If your HSBC credit card has been lost or stolen – or you suspect that it has been used fraudulently – contact our 24-hour helpline immediately at 1-866-406-4722.

If you're an HSBC Premier customer, call 1-866-405-4722. We'll cancel your card, issue a replacement and investigate the suspected transactions.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes. 

Do you suspect that an HSBC account has been opened in your name? Is HSBC listed on your credit report when you haven't applied to us for credit? Have you received an email or phone call claiming to be from HSBC? If you see anything suspicious linked to our name, please call us at 1-877-621-8811.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.

It's important to report fraud as soon as possible to limit the unauthorized transactions on your card or account – and to minimize the time it takes to correct your credit rating.

If you find out you've been a victim of fraud, you should take these steps immediately.

• If you suspect any suspicious behaviour, please contact one of the credit bureaus below:
  Equifax: 1-800-465-7166
  Trans Union: 1-866-525-0262 / Quebec -1-877-713-3393
• Close any accounts associated with the fraudulent activity.
• Report the crime to the police.

If you receive a suspicious email or letter, that claims to have been sent from HSBC, please forward it to phishing@hsbc.com.

Alternatively, please call 1-866-233-3838 if you are a Premier customer.

Lines are open 24 hours a day, 7 days a week, 365 days a year. Calls may be monitored and/or recorded for security and service improvement purposes.