Hong Kong Regulator Orders New Anti-Phishing Measures for Crypto Platforms

Hong Kong's regulator has ordered crypto platforms and online brokers to meet newly issued phishing-resistant login requirements within the next 12 months.

Rise in Phishing Attacks

The Hong Kong Securities and Futures Commission (SFC) on Thursday issued new requirements for phishing-resistant authentication methods for virtual asset trading platforms (VATPs) and online brokers.

■The new standards require stronger phishing-resistant authentication methods and device binding while prohibiting the use of one-time passwords through SMS, email or app-based logins.

■Platforms must implement the changes within the next 12 months.

Global Crypto Industry Under Attack

The global crypto industry saw an increase in phishing attacks and social engineering scams in the first quarter of 2026. Those types of incidents accounted for $306 million of the industry's total losses of $482 million in the period.

SFC’s New Measures

The SFC is proposing stronger alternatives such as passkeys, registered devices with cryptographic verification and hardware security keys.

The crypto industry is facing a surge in phishing attacks and social engineering scams. Regulators taking stronger measures is crucial in preventing such attacks.