“HSBC – Account Credited With An Inward Payment” Email Scam: How to Protect Yourself and Remove Threats

Scams in the form of phishing emails have become increasingly sophisticated, and one such threat is the “HSBC – Account Credited With An Inward Payment” email scam. This scam targets unsuspecting recipients by impersonating HSBC, a well-known global bank, and attempting to steal sensitive personal information. In this article, we will explore this scam in detail, provide guidance on how to remove it using SpyHunter, and discuss preventive measures to protect yourself from future infections. We will also provide a helpful table summarizing key details of the threat.

What is the “HSBC – Account Credited With An Inward Payment” Scam?

The “HSBC – Account Credited With An Inward Payment” email scam is a phishing attack designed to trick recipients into believing they have received an inward payment in their bank account. This email masquerades as an official notification from HSBC, claiming that the recipient’s account has been credited with a large sum of money, in this case, USD 28,945.99. The email urges the recipient to open an attachment, which contains a fake SharePoint login page. The victim is prompted to enter their credentials, and once they do, the scammers have full access to their personal information.

Key Details of the Scam

Threat Information	Details
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	Your account has been credited with an inward payment
Attachment Name	Inward Payments Remittance $28,945.99 USD 1-3-2025 5-23-52 a.m..html
Detection Names (Attachment)	Avast (HTML:Phishing-DVU [Phish]), Combo Cleaner (Trojan.Script.GenericKDZ.26531), ESET-NOD32 (HTML/Phishing.Gen), Ikarus (Phishing.HTML.Agent), Microsoft (Phish:HTML/FakeSharepoint.AB!MTB)
Disguise	Notification from HSBC bank
Symptoms	Generic greeting, urgent language, suspicious links, grammatical errors
Distribution Methods	Deceptive emails, rogue online pop-up ads, search engine poisoning, misspelled domains
Damage	Loss of sensitive private information, monetary loss, identity theft

Email Breakdown: How It Works

The phishing email claims to be from HSBC, complete with a subject line such as "Inward Payments Notification ZCK42972296," and it thanks the recipient for registering for the notification service. It provides fabricated details like the transaction date, reference number, and a substantial credited amount of money.

The email instructs the recipient to open an attached HTML file, which contains a fake SharePoint login page designed to steal their login credentials. When the victim enters their details, they are sent directly to the cybercriminals, who can use the information for malicious purposes.

Scammers may exploit this information in several ways, such as:

• Identity Theft: By accessing personal accounts, scammers can steal sensitive data, impersonate the victim, and cause financial harm.
• Monetary Loss: Fraudulent purchases or transfers can be made using the victim’s stolen credentials.
• Account Takeover: The criminals can hijack the victim’s social media, email, and other online accounts.
• Dark Web Sales: Stolen credentials are often sold on the dark web, where they are used for further illicit activities.

How to Remove the "HSBC - Account Credited With An Inward Payment" Scam

Step 1: Detecting the Threat

The first step in dealing with this scam is to identify the phishing attempt. Be on the lookout for the following signs:

• Suspicious Email Content: The email will likely contain urgent language or grammatical errors. The sender's email address may be misspelled or disguised to appear legitimate.
• Attachment or Link: Do not open any attachments or click on links from unknown senders. In this case, the attachment is an HTML file that mimics a legitimate login page.
• Unusual Requests: Legitimate organizations like HSBC will never ask for personal login details through unsolicited emails.

Step 2: Remove the Phishing Email

If you have received this phishing email, do not click on any links or open any attachments. Simply delete the email from your inbox. If you suspect that you have already interacted with the fake login page, follow the steps below:

• Change Your Passwords: Immediately change the passwords of any accounts where you might have entered your details.
• Enable Two-Factor Authentication (2FA): For added security, enable 2FA on your accounts to prevent unauthorized access.

Step 3: Scan for Malware with SpyHunter

SpyHunter is an advanced anti-malware tool that can help detect and remove threats like phishing scams, ransomware, and other malicious software. Here’s how to use SpyHunter to remove any infections from your device:

1. Download and Install SpyHunter: Download the appropriate version of the tool (Mac and Windows versions available). Follow the installation instructions to get started.
2. Run a Full System Scan: After installation, open SpyHunter and initiate a full system scan. This will check your computer for any malware, including phishing threats and malicious files like the fake SharePoint page.
3. Remove Detected Threats: Once the scan is complete, SpyHunter will display a list of threats. Select the threats related to the phishing scam and remove them by following the on-screen prompts.
4. Reboot Your System: After the removal process is complete, restart your computer to ensure all malicious files are fully eliminated.

Step 4: Protect Yourself Going Forward

While removing the scam is crucial, it’s also important to take steps to prevent future infections. Here are some methods to safeguard yourself:

• Be Cautious with Emails: Always verify the sender’s email address before interacting with any email. Avoid clicking on suspicious links or opening attachments, especially if they come from unknown sources.
• Use Strong Passwords: Create unique and strong passwords for all your accounts, combining uppercase, lowercase, numbers, and special characters.
• Enable Two-Factor Authentication (2FA): Use 2FA to add an extra layer of security to your online accounts.
• Update Your Software: Ensure your operating system and antivirus software are up to date to prevent exploits and malware attacks.
• Use Anti-Malware Software: Regularly scan your computer with a trusted anti-malware tool like SpyHunter to catch any potential threats early.

Conclusion

The "HSBC - Account Credited With An Inward Payment" phishing scam is a dangerous attempt by cybercriminals to steal your personal information. By remaining vigilant and following the steps outlined above, you can protect yourself from falling victim to this scam. If you’ve already been affected, use SpyHunter to scan for and remove any malware. Additionally, implement preventive measures to ensure your devices and accounts remain secure in the future.

Text Presented in the "HSBC - Account Credited With An Inward Payment" Email Letter

Subject: Fw: Inward Payments Notification ZCK42972296

HSBC

Thank you for registering for notification service. Your account has been credited with an inward payment. Please see the details below:

Reference Number :  ZCK42972296
Credit Account Nickname: 400-650XXX-XXXUSDSAV
Credit Amount: USD28,945.99
Paying Bank/ Payment Service Provider: BANK OF NEW YORK MELLON
Transaction Date: 1/3/2025 5:23:52 a.m.

For any enquiries, please contact us on (852) 2748 8288.

Yours faithfully,
HSBC Commercial Banking