TL;DR:
- Hong Kong’s SFC ordered virtual asset trading platforms and online brokers to adopt phishing-resistant authentication within 12 months, banning OTPs through SMS, email or app-based logins.
- The standards point to passkeys, cryptographically verified registered devices and hardware security keys as stronger alternatives.
- The move follows rising phishing and social-engineering losses, including $306 million of $482 million in industry losses during Q1 2026 and 57% reported local fraud incidents in 2025.
Hong Kong’s Securities and Futures Commission has ordered virtual asset trading platforms and online brokers to adopt phishing-resistant login standards within 12 months, raising the compliance bar for account security across the city’s regulated digital finance market. The new requirements prohibit one-time passwords delivered by SMS, email or app-based logins, while pushing platforms toward passkeys, registered devices with cryptographic verification and hardware security keys. The message is blunt: basic authentication is no longer enough, particularly as phishing campaigns become more adaptive and capable of turning routine access into asset loss for retail users and traders across platforms.
Authentication moves from convenience to risk control
The SFC’s new standards are aimed at prevention before customer funds are compromised. Device binding and cryptographic checks should make it harder for attackers to reuse stolen credentials, intercept temporary codes or trick users into approving fraudulent access. The regulator said comprehensive measures must combine prevention, detection, response and education to protect customer accounts against increasingly complex fraud. In practical terms, anti-phishing controls are becoming core platform infrastructure, not a peripheral security feature that exchanges or brokers can delay until after an incident or treat as a customer-only responsibility under real market conditions and heavy onboarding pressure across the region.
The timing is hard to separate from the industry’s latest loss data. Phishing attacks and social engineering scams accounted for $306 million of the crypto industry’s $482 million in losses during the first quarter of 2026. In Hong Kong, counterfeiting and fraud represented 57% of incidents reported to the local cybersecurity coordination center in 2025. Those figures make the 12-month implementation window look less generous than urgent. The regulator is responding to a measurable threat pattern, rather than issuing a theoretical cybersecurity upgrade for a sector with increasingly sophisticated social-engineering exposure.
Recent cases show why the standard matters. A crypto investor lost nearly $1 million after signing a malicious Ethereum token approval, while another wallet holder reportedly lost $1.65 million after connecting to a fake exchange and signing a malicious contract. Earlier, scammers used Google ads impersonating Uniswap and reportedly stole more than $400,000 from victims. Industry leaders have also called for stronger wallet security after major address-poisoning incidents. Hong Kong’s next test is execution discipline, because rules only protect users if platforms deploy them clearly, consistently and before attackers adapt again.
