Hong Kong FPS (Faster Payment System) Security Guide
How to use the Faster Payment System safely — understanding FPS fraud risks, verification best practices, and what to do when an FPS transfer goes wrong.
How to use the Faster Payment System safely — understanding FPS fraud risks, verification best practices, and what to do when an FPS transfer goes wrong.
The Faster Payment System (FPS) was launched by the Hong Kong Monetary Authority in September 2018 as a real-time, 24/7 payment infrastructure connecting all HKMA-supervised banks and stored-value facilities. FPS enables fund transfers using simple identifiers — a mobile phone number, email address, or HKID number — eliminating the need to know the recipient's bank account number. Transfers settle instantaneously, 365 days a year, across all participating institutions. This represents a significant advancement in payment convenience but introduces specific fraud risks that differ from traditional inter-bank transfers.
FPS operates at the HKICL (Hong Kong Interbank Clearing Limited) level, connecting participating banks, SVFs (PayMe, Alipay HK, WeChat Pay HK), and participating credit card operators. When you initiate an FPS transfer in your banking app, you enter an FPS identifier (phone number, email, or ID), the HKICL network performs an alias-to-account lookup, and your bank displays the registered account holder name before you confirm the transfer. This name confirmation step is the critical verification point that users must take seriously. The transfer settles immediately upon confirmation — there is no cooling-off period or transaction-in-progress that can be intercepted.
The instantaneity that makes FPS valuable also makes fraud recovery harder. Unlike international SWIFT wire transfers, which may take 1-3 days to settle and can sometimes be recalled during transit, FPS transfers complete in seconds and credit the recipient's account immediately. Once the funds are in the recipient's account, recovery requires either: the recipient voluntarily returning them, the recipient bank cooperating with a freeze order under police direction, or a court order. None of these is guaranteed, and the process takes days to weeks even in cooperative scenarios.
FPS fraud in Hong Kong primarily takes the form of authorised push payment (APP) fraud — transactions where the victim is socially engineered into voluntarily initiating the transfer. This distinguishes FPS fraud from traditional card fraud where the victim's card details are stolen and used without consent. In APP fraud, the payment is technically authorised by the genuine account holder — making liability assignment more complex and recovery harder than for unauthorised transactions.
The most prevalent FPS fraud scenarios include: fake landlords requesting deposit payments before tenancy agreements are signed (victims pay FPS to a fraudster claiming to be the landlord of a property they viewed); fake online marketplace sellers who receive FPS payment but never deliver goods; impersonation of a known payee (a fraudster who controls a compromised or cloned social media account requests FPS payment from your contact list); and fraudulent charity appeals during disaster events or sensitive periods. The common thread is social engineering that creates a convincing pretext for transferring money to an unfamiliar FPS identifier.
PayMe-specific fraud includes unsolicited payment requests sent by fraudsters hoping recipients will approve without scrutiny, "overpayment scams" where a fraudster sends you more than agreed and asks for the excess to be returned via FPS (the original payment is then reversed, leaving you out of pocket), and fake QR code substitution at merchant points where legitimate QR codes are covered with fraudulent ones redirecting FPS payments to criminal accounts. The QR code substitution fraud is particularly insidious at small merchants who use printed QR codes for payment — checking the name displayed before confirming is the only defence.
The name verification step is the most important protection available to FPS users. When you enter a phone number, email address, or HKID as the FPS identifier, your banking app should display the registered account holder's name before you confirm the transfer. Read this name carefully before confirming. If the name shown does not match the person or business you intend to pay — or if the lookup returns an error or blank — do not proceed. Contact the intended payee through a completely separate channel (phone call, in person) to verify their correct FPS identifier before retrying.
Verification through a separate channel before any first-time transfer to a new payee is the procedure that prevents most FPS fraud. "Separate channel" means contacting the payee through means completely independent of the communication that prompted the transfer request. If someone on WhatsApp sends you their phone number for FPS payment, do not simply trust that number — call them on the phone number you already have stored for them to confirm. This one step prevents impersonation, account compromise, and many other fraud scenarios because the fraudster cannot intercept a call to the victim's existing contact number.
Setting appropriate FPS transfer limits in your banking app is a technical safeguard that limits the maximum possible loss in a fraud or mistake scenario. Most HK banks allow users to set daily and per-transaction FPS limits below the system maximum. Setting these to the highest amount you realistically need for legitimate transfers — rather than leaving them at the maximum — means any fraudulently induced transfer is capped at your limit rather than your full account balance. This is especially important for accounts with large balances where the default limits may be set very high.
When an FPS transfer is sent fraudulently — either because you were deceived into authorising it or because your account was accessed without your consent — the response process differs from card fraud disputes. FPS transfers are not subject to Visa/Mastercard chargeback rules, which provide relatively standardised dispute resolution for card transactions. FPS recovery depends on the cooperation of the receiving bank, the balance remaining in the receiving account, and police action speed. This makes the immediate response window particularly critical.
Report to your bank immediately. Call your bank's fraud hotline, explain that an FPS transfer was fraudulently induced or unauthorised, and request that they contact the receiving institution to attempt a recall or account freeze. Banks have protocols for inter-bank fraud communication, and prompt action can sometimes result in a hold being placed on the receiving account before funds are withdrawn. Simultaneously, file a police report with the CSTCB at 2527 7177 — police can apply for court-ordered account freezing at the receiving bank, which is often the decisive factor in recovery outcomes for domestic FPS fraud.
If the sending bank's fraud investigation concludes that you were victim of fraud but refuses to reimburse, escalate to the HKMA's banking complaint process. The HKMA has supervisory authority over banks and can compel compliance with fair treatment standards. The Hong Kong Association of Banks (HKAB) has also issued guidance on responsible treatment of APP fraud victims. For disputes involving FPS payments through PayMe, the HSBC fraud team handles PayMe-specific investigations alongside the standard HSBC fraud process. Keep records of all communications — bank reference numbers, police case numbers, and correspondence — as these are essential for ongoing investigations and any escalation.
