30 Fake Domains Impersonating Hong Kong's Payment Rail

Hong Kong Interbank Clearing Limited runs the Faster Payment System, the rail that moves money between Hong Kong bank accounts in seconds. It is not a consumer brand. Almost nobody has an account with it.

That is exactly what makes it useful to impersonate. Since 22 January, the Hong Kong Monetary Authority has published 22 alerts naming fraudulent websites that claim to be HKICL. Between them they name 30 different domains, and the most recent alert is two days old.

A brand nobody can verify

When a scam site imitates your bank, you have a test available. You know what your bank's app looks like, you have its card in your wallet, and its real address is printed on your statement.

A clearing house is different. You use it constantly and you have never visited its website. You could not name its domain if asked. So when a page says it is the operator of FPS and offers to help with a payment that went wrong, there is nothing familiar to compare it against, and the institutional authority is if anything greater than a bank's.

The domains reflect that. Of the 30, twenty put "hk" in the name, sixteen put "fps" and ten put "hkicl". They are not trying to look like a bank. They are trying to look like the plumbing.

Thirty domains, twenty-three names

Read as a set rather than one alert at a time, the list shows a small operation rotating stock.

Behind the 30 domains there are only 23 distinct names, because three were re-registered on multiple suffixes. The name fpshkicl appears on .asia, .click, .com, .fun and .help. The name hkrefundplatform appears on .cfd, .click and .sbs, in alerts dated 19 August, 1 September and 7 September, which is a takedown-and-replace cycle running about a fortnight.

Twenty-two of the 30 use a suffix other than .com or .cc. The list runs through .cfd, .click, .sbs, .lat, .xyz, .fun, .help, .top and .asia: the cheap end of the domain market, where registration costs a few dollars and takes minutes. That is the economics of the thing. The defender has to get a takedown; the attacker has to fill in a form.

One entry in the set is not impersonating the clearing house at all. monetaryauthorityhk.xyz impersonates the Hong Kong Monetary Authority, the regulator publishing the alerts.

The script changed in June

The alerts are formulaic, which makes the moment they stop being formulaic easy to see.

From 22 January to 18 June, eleven alerts describe the same thing: sites that "intend to trick user into giving away login credentials" and then push the victim into "WhatsApp chats with the fraudster impersonating as customer service personnel." Credential theft with a human closer.

From 22 June the wording changes completely. Ten alerts describe sites imitating something called "Buyer Online Protection," offering three services: refund to buyer, unauthorised online transaction reporting, and online transaction support, all for payments made over FPS. Several ask for an identity document number and a photo of the document, together with a phone number, for "real name verification" in order to release a cash reward.

That is a different crime. The first version steals a login. The second harvests identity documents from people who believe they are claiming a refund, and it works on someone who has already lost money once.

The pace changed with the script. The eleven credential alerts span 147 days, one every 14.7 days. The ten Buyer Online Protection alerts span 77 days, one every 8.6 days.

What the archive does and does not show

HaiPay pulled the 600 most recent HKMA press releases, a window reaching back to 21 August 2025, and read every HKICL alert in it in full.

There are none before 22 January 2026. On this evidence the campaign against the clearing house is a 2026 phenomenon, though a window that starts in August 2025 cannot speak to anything earlier.

For scale within the same archive, the HKMA published 189 releases titled "Scam alert related to banks" over the same period. Impersonating the clearing house is the rarer variant. It is also, on the wording of the alerts, the more organised one, because the bank alerts name individual reported cases while the HKICL alerts describe a single product being redeployed.

What HaiPay could not establish

How many people lost money, or how much. The alerts warn; they do not quantify, and no figure appears in any of the 22.

Whether the domains were taken down, and how quickly. The alerts do not say, and HaiPay did not visit any of the sites.

Whether the same operator is behind both phases. The changeover is clean and the infrastructure style is consistent, but the alerts do not attribute, and neither does this piece.

HaiPay did not contact HKICL or the HKMA.

What to watch

Whether hkrefundplatform appears on a fourth suffix. Three registrations of the same name in three weeks is a pattern, and the next one would confirm the replacement cycle rather than suggest it.

Whether the alert rate holds at roughly one every nine days, which would put the next one around the middle of September.

And whether other instant payment schemes start publishing this. Hong Kong names the domains, which is what makes counting possible at all. Most schemes do not, so nobody can tell whether their rails are being impersonated at this rate or worse.

This piece reads published regulator alerts. The domains listed are reproduced from those alerts as a record of what was reported; nobody should visit them. If you believe you have been targeted, contact your bank.