With two-factor authentication, you have to prove your identity in 2 different ways to access your online accounts.
These are commonly:
Using 2FA greatly improves the security of your accounts. Even if a criminal manages to get your password, they won't be able to access your account without the second factor.
A one-time passcode (OTP) is a temporary 6-digit code which is used to confirm a specific transaction or logon session. It will expire after a certain amount of time.
There are different ways you can get one-time passcodes. Common examples include:
HSBC will never ask you to share a code generated from your Secure Key or mobile phone, find out more about the HSBC Secure Key.
Here are the common ways that fraudsters might try to get you to divulge a one-time passcode.
When you buy something online with your debit or credit card, you may be asked to confirm the payment so that we can check it’s really you and not a fraudster.
We do this by sending a 6-digit passcode to your mobile number or email address, so you can prove it’s you.
Fraudsters might aim to trick you into sharing these codes.
They will call and pretend to be from your bank. They may tell you that they’ve detected a suspicious card transaction and ask if you authorised it. When you say you haven’t, the fraudster will offer to stop it for you.
The fraudster will ask you to share the one-time passcode with them.
If you hand over that code, they’ll be able to use it for their fraudulent card transactions.
One-time passcodes should only be used by you and never shared.
If you've received a text message that looks like it may have come from HSBC, you can check that is really did come from us.
Fraudsters might also try to trick you into handing over the activation code for your HSBC Secure Key.
Explore: How to avoid token activation fraud
Never share:
If someone contacts you and asks you to share any of these codes, don’t. Hang up the phone and don’t respond to any emails or texts.
If you unexpectedly receive a one-time passcode, it may mean a fraudster is trying to use your card. Contact us straight away using the number on the back of your card.
Find out more about how to protect yourself against fraud.
We use cookies to help keep our website and services working properly. These cookies are necessary and are set automatically.
We'd also like to use some optional cookies that:
You can either 'Accept' or 'Decline' these cookies or choose what cookies to accept in 'Manage cookies'.
To learn more about how we use cookies, visit our Cookie Notice.
