The Hong Kong Securities and Futures Commission (SFC) has tightened identity verification requirements for virtual asset trading platforms and online brokerages. The new regulation mandates more robust defenses against phishing attacks, banning the use of SMS, email, or app-based one-time passwords as authentication methods. Industry participants have been given a 12-month window to fully comply with the updated security standards.
Which security methods are now prioritized?
Under the new guidelines, passkeys, cryptographically verified registered devices, and hardware security keys take center stage. The SFC has listed these tools as among the most resilient against phishing attempts. The regulator aims to reduce risks that stem from protecting user accounts with only passwords or one-off codes.
Mini glossary: A passkey is a login method that leverages device-based cryptographic authentication instead of a password. A hardware security key is a physical device that confirms identity and provides an extra layer of defense against counterfeit sites and phishing links.
As Hong Kong’s leading financial markets regulator, the SFC’s move raises the bar for cybersecurity—especially as digital asset transactions increasingly face threats from identity fraud and sophisticated scams.
Dr. Ye Zhiheng, Executive Director of the Intermediaries Division at the China Securities Regulatory Commission, emphasized that effective protection of client accounts against increasingly complex scams and frauds requires a combination of prevention, detection, response, and education.
Cyberattacks on the rise worldwide
The first quarter of 2026 saw a global uptick in phishing and social engineering-based attacks within the crypto industry. These incidents accounted for $306 million of the sector’s $482 million in total recorded losses for the period. According to the Hong Kong Cyber Security Incident Coordination Center, scams and fraud accounted for 57% of all security incidents reported in 2025.
Recent incidents in the crypto markets further underscore these trends. On Wednesday, an investor lost approximately $1 million on Ethereum after approving a malicious token operation. In just the first half of 2026, phishing-linked scam losses reached $366 million globally.
High-profile cases add to regulatory pressure
Earlier this month, it was reported that a wallet owner lost $1.65 million after connecting to a fraudulent exchange and signing a malicious contract. Researcher Ryan Coleman explained that this action granted attackers unlimited access to the victim’s funds. At the end of May, on-chain analyst b-block revealed that scammers were using Google ads to distribute phishing links mimicking Uniswap, causing over $400,000 in losses.
Key industry figures have also long stressed the need to strengthen wallet security. In December 2025, Binance co-founder Changpeng Zhao and others called for enhanced protections following an incident in which an investor lost $50 million through an address poisoning scam.
In an extraordinary incident in May 2024, a user lost $71 million to an address poisoning attack, only to have all assets returned by the attacker two weeks later. Investigators believe the quick recovery may have been prompted by tracking the suspect’s probable IP address.
