HK$200,000 drained overnight via instant transfers, with no way to claw it back

Overnight, a local depositor had more than HK$200,000 siphoned in multiple instant transfers to mainland accounts; the bank ultimately told the customer to absorb the loss on the grounds that the operations were 'validly authorised', and the window to trace the funds was extremely short. The affected depositor reported that even though a shop inspection of the phone found no sign of intrusion, and logins had always used face or fingerprint recognition, the bank still ruled the transactions authorised because the device authentication records and IP address matched past login history; the Monetary Authority merely asked the bank to explain.

Instant-transfer systems are designed for speed, but the receiving bank has usually moved the funds to the next stop within a few hours, while a police search-warrant application routinely takes days, by which point the money has long since scattered. The bank simultaneously holds internal data such as email alerts, login devices and limit-adjustment records, yet the burden of proof rests in practice on the customer, who loses any ability to self-examine the trail if they delete the app afterwards.

The local rules on the burden of proof, compensation boundaries and regulatory complaint process for online-banking theft are not yet transparent; victims often have to apply pressure through the media and public sharing before a review becomes possible, and a neutral channel for reviewing online-banking risk and arbitrating compensation is also lacking.