HSBC Phishing Email Scam UK: Spot a Fake Message
A genuine HSBC email will never need your full password or security codes to "verify" your account.
What a fake HSBC email looks like
This scam is an email designed to look like it's from HSBC, warning of unusual account activity or a suspension unless you act. An example of the style is: We've detected unusual activity on your HSBC account. Verify your details within 24 hours or your online banking access will be suspended. It usually includes a link to a page built to look like HSBC's genuine login.
Why these emails are convincing
HSBC does genuinely email customers, so a bank-branded message isn't unusual by itself. The urgency — a threat to suspend or close your account — is designed to make you click and act before checking carefully, rather than pause to verify it independently.
Signs an HSBC email is a scam
- It asks you to click a link and then enter your full password, PIN, or a security code.
- It threatens to suspend or close your account unless you act immediately.
- The sender's actual email address doesn't match HSBC's own domain, even if the display name says 'HSBC'.
- There are spelling, grammar, or formatting details that feel slightly off.
- It asks for more information than HSBC would genuinely need to resolve an account issue.
How the scam works step by step
First, an email arrives claiming a problem with your account. Second, a link opens a page built to look like HSBC's genuine login. Third, whatever you enter — your login details, and sometimes a security code — is captured. Fourth, the criminal uses those details to log into your real HSBC account and move money or add a new payee before you notice.
How to check an HSBC email is genuine
Don't click the link. Log into HSBC online banking or the app by typing the address yourself or opening the app directly, rather than following the email.
- If you're unsure, use the number on the back of your card or your statement to ask HSBC — not a number in the email.
- Check the sender's actual email address, not just the display name, since a scam can show 'HSBC' as the name while sending from an unrelated address.
If you've already entered your details
Log into HSBC directly and change your password immediately, using the app or by typing the address yourself. Check for any new payees or transactions you don't recognise. Contact HSBC straight away through the app or official channels, and treat any security code you shared as compromised.
How to report a fake HSBC email (UK)
Forward it to HSBC's own phishing address, phishing@hsbc.com, which also covers suspicious texts. Also forward it to report@phishing.gov.uk. If you've lost money or shared sensitive information, report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 if you are in England, Wales, or Northern Ireland. In Scotland, report to Police Scotland on 101.
Frequently asked questions
How can I tell a genuine HSBC email from a fake one?
A genuine HSBC message won't ask you to click a link and then enter your full password, PIN, or security codes. If you're unsure, don't click anything — log into HSBC directly through the app or by typing the address yourself.
I entered my HSBC login details on a fake website — what should I do right now?
Log into HSBC directly (app or typed address) and change your password immediately, check for unfamiliar payees or transactions, and contact HSBC through the app or official channels straight away.
Does HSBC have an email address for reporting phishing?
Yes — forward suspicious emails (and suspicious texts) to phishing@hsbc.com.
I received an HSBC text, not an email — is the same advice true?
Yes, the same red flags apply. Check by contacting HSBC using the number on your card, not the message, and you can also forward a suspicious text to HSBC at phishing@hsbc.com or to 7726.
How do I report a fake HSBC email in the UK?
Forward it to phishing@hsbc.com and to report@phishing.gov.uk. If you've lost money or shared details, also report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 (Police Scotland on 101 in Scotland).