Buttons can be hard to press; battery eventually dies (approx. 5 years); physical replacement takes up to 10 working days to arrive. Secure Key FAQs | Ways to Bank - HSBC Expat
HSBC’s app now supports "Secure Customer Authentication" (SCA) via biometrics. You don't type a code; you tap your fingerprint. The actual "code" is a cryptographic nonce generated invisibly, valid for 90 seconds, and cryptographically bound to the specific transaction amount and payee. If a man-in-the-middle tries to change the payee name, the signature verification fails.
Required for verifying high-risk actions, like sending money to a new person. You'll often need to enter specific transaction details (like the last 5 digits of the recipient's account) into the app to generate this unique code. Physical Secure Key (Device)
Understanding how to find and use these codes is essential for keeping your finances safe. 1. Card Security Code (CVV/CVC)
HSBC’s security code is not a single password; it is a that transitions from "untrusted" to "trusted" only when multiple cryptographic proofs align. The physical key secures the high-net-worth user; the biometric push secures the retail user; and the risk engine silently watches every attempt.
When you're making a purchase online or over the phone, you’ll be asked for a 3-digit security code known as the Card Verification Value (CVV).
For online and mobile banking, HSBC uses a "Secure Key" system to generate temporary 6-digit codes. These act as a second layer of protection (Two-Factor Authentication) to ensure only you can access your account.
Used to sign in to online banking on a computer. Launch the app, tap "Generate Security Code" on the splash screen (before logging in), and select "Log on security code" .
View in portrait mode