Hong Kong Bans OTP Logins for Brokers, Crypto Platforms

Hong Kong's Securities and Futures Commission has told internet brokers and licensed crypto platforms to kill the one-time password. The regulator wants them on phishing-resistant authentication such as passkeys within 12 months, and warned firms they will be on the hook for client losses from preventable hacks.

The SFC set out the requirement in a circular published 9 July, addressed to internet brokers and SFC-licensed virtual asset service providers. It gives firms until 8 July 2027 to implement the new authentication for account logins and device binding. Large internet brokers need to make the change immediately.

The language is direct about what most trading apps still use. “The SFC does not consider OTP to be a phishing-resistant authentication solution”, the regulator said in the circular. Firms “should not use it” for logins or for registering the devices tied to an account.

The directive follows a wave of account takeovers. In 2025, the SFC said in the circular, fraudsters ran large-scale SMS phishing campaigns that impersonated brokers and referred to purported requests from regulators. Attackers lured clients into entering credentials, including OTPs, on fake websites. The attackers are suspected to have used a man-in-the-middle attack to intercept the codes, reach the accounts and place unauthorised trades, the SFC said in the circular. Phishing made up 57% of the cybersecurity incidents reported to Hong Kong's computer emergency response centre in 2025.