Octopus Online Service Safety Guide

Transcription

1 Octopus Online Service Safety Guide This Octopus Online Service Safety Guide is to provide you with security tips and reminders that you should be aware of when using online and mobile services provided by Octopus Cards Limited ( us, we, our, our company, OCL ) 1. When using online services provided by OCL 1.1. Do not use untrusted mobile device or public computer to access our services Access OCL s website only by entering in your web browser Only download Octopus mobile applications through the links from OCL website or authorized apps stores Google Play Store or Apple App Store When carrying out online transactions provided by us via the Internet browser, a pad lock will appear. When you click on the lock, a digital certificate issued to our company will be shown When carrying out services with Octopus cards and products ( Octopus ), you are required to provide the Octopus number and the bracketed digit for validation and authentication. You can use your registered Octopus ( Registered Octopus ) for making online payment after successful registration Remember to close the services and log-out (if applicable) after you have finished using it We will not display your personal information in any s or short messages (SMS) sent by OCL or ask you to confirm any personal data or credentials such as password by replying to the or SMS sent by OCL When using Octopus Online Payment During the purchase process, the online merchant may request information such as your name, address, phone number and shipping address for the fulfilment of your purchase. Unless otherwise specified, such data will not be shared with or kept by OCL OCL will not collect your personal information when you use the online payment service. 1 / 8

2 1.9. When using Octopus O! epay ( O! epay ) Only apply your O! epay account through designated channels When applying for O! epay account ( O! epay Account ), OCL may request you to provide information such as your name, address, phone number, and the image of identification document. These information are securely stored in our servers for the purposes of O! epay application and customer service. Details of the purpose(s) and use of your personal data can be found in the Conditions of Issues of Octopus To use the O! epay Fund Transfer with Bank Service, OCL will request you to provide information such as your bank and bank account number, and use your full name and O! epay account number for setup and operation of the service. These information are securely stored in our servers for operating the service. Details of the purpose(s) and use of your personal data can be found in the Terms and Conditions Relating to Fund Transfer with Banks under Octopus O! epay Service Keep the account password to yourself. Do not write it down and please change it regularly. Choose a strong password with alphanumeric combinations and difficult to guess Do not disclose your password to anyone. OCL will never ask for your password when communicating with you If you are using an ios device that supports Touch ID, you may choose to login to your O! epay Account with your ios Touch ID. Please be ensured that we only rely on ios to store and authenticate your fingerprint and do not capture or store any of your fingerprint data Before using the Touch ID option, please ensure the Touch ID includes no other persons than the O! epay Account Holder, e.g. yourself, to prevent any unauthorised access to your O! epay Account Review the requests from others carefully. When other users invite you as a friend, the mobile number will be shown for your review prior to approval. Please make sure the other user is someone you know and trustworthy You will receive payment request and payment reminder notifications only in the O! epay App. Such notifications will not be sent to you through or SMS. You can review payment request after logging-in to your O! epay Account Before accepting a payment request or sending a P2P payment 2 / 8

3 ( P2PPayment ), review the payment details carefully, including the recipient and the payment amount. All payment transactions of O! epay are final and irreversible upon confirmation of the payment instruction If you have changed your mobile phone number or other personal information, please call Octopus Customer Service Hotline at at your earliest convenience to update your record with us If you have changed your address, you should update your address through your O! epay App as soon as possible to prevent missing any important notifications Please input your mobile number carefully in order to receive SMS notification alerts for your O! epay transactions Check your O! epay Account and Registered Octopus transactions regularly. If you have any questions or found any activity suspicious, please report to us immediately by calling Octopus Customer Service Hotline at You can keep your O! epay Account monthly statement by downloading it through the O! epay App. 2. What has OCL done to protect you? 2.1. Our servers and infrastructure are protected by firewall and intrusion prevention/detection systems to prevent unauthorised access All communications between our servers, your device and Octopus are transmitted with industry recognized encryption standard If the transaction is not completed within a set period of time, it will be cancelled automatically Our system logs the usage of each Octopus for online services. If there are 5 attempts for inputting the non-matching Octopus number, the online functions of the Octopus will be suspended for 24 hours To ensure transactions are carried out securely, the mobile application provided by OCL may block your access if your mobile device has been detected as rooted or jailbroken. We will not access other information in your mobile device when detecting your device s status For Octopus Online Payment The merchant information and transaction amount are shown on the Octopus App, O! epay App or website, allowing you to check the 3 / 8

4 merchant name and amount prior to making a payment When using online payment service with Octopus PC Reader (i) The service is provided to you on a website with https connection. Make sure there is a pad lock displayed on your browser when using the Octopus Online Payment service. When viewing the certificate, it will show OCL as the owner. (ii) Transport Layer Security is used when you use Octopus Online Payment. Your information input in Octopus Online Payment is encrypted before transmission through Internet, no one except us or authorized party with the key will be able to read it. Octopus Online Payment uses 128bit encryption which conforms with industry encryption standard for secure information transmission through Internet. (iii) When using Octopus Online Payment, only this domain will be used for payment transactions For O! epay You can access your O! epay Account from two registered devices at any time.when using O! epay, we will display the last login attempt and status. If you find any suspicious activities, please call Octopus Customer Service Hotline at immediately for investigation When using the service, your login session will expire after a set period of idle time When you contact us to make enquiry about the operation of your O! epay Account, we will ask for your authentication code or personal information to authenticate your identity for the protection of your account information A verification code will be sent to your registered mobile number through SMS when you login from a new mobile device or increase your daily transaction limit. Such SMS will include the verification code and the purpose of that transaction. Please review the SMS content before entering the verification code to the O! epay App. If you receive any suspicious SMS relating to the service, please report to us immediately for investigation by calling Octopus Customer Service Hotline at If you have subscribed to SMS forwarding service from your mobile network operator, the SMS will not be forwarded regardless of the service setting. You are also reminded not to forward the SMS verification code to other mobile devices. 4 / 8

5 We will temporarily suspend your account if we detect a series of unsuccessful login attempts. If you find your account locked, please contact our customer service hotline at for assistance We will provide updates on your account activities by push notification messages/ s. For important transactions such as device registration / de-registration, and add payee/friend, notifications will be sent via both push notifications and alternative channel of your registered address. Please check such activities in a timely manner and if suspicious activities found, please call Octopus Customer Service Hotline at immediately After you add a new friend or register a new Octopus to your O! epay Account, a daily summary will be sent to your address. Please check such activities in a timely manner and if suspicious activities found, please call Octopus Customer Service Hotline at immediately We will never ask our customers to validate their personal and/or account related information (e.g. ID number or login password) by s or through any hyperlinks embedded in such s. 3. What to do to protect yourself? 3.1. Do not leave your Octopus unattended. This protects you against unauthorised registration and usage for online payment Enable the screen lock function of your mobile device and do not leave your mobile device unattended. If your mobile device is left unattended, other people may steal it and / or retrieve the information you have stored in it without your notice. Enabling the screen lock function of the mobile device can prevent your personal information, such as messages, browser history and your contact list from being accessed by others Use the remote locate and remote erase features Some devices or operating systems may enable you to locate or erase your mobile device in case of loss. By enabling these features, you can request a remote erase to clear all the data in the mobile device if in case of loss, thereby preventing your information from being accessed by others Do not click on any links attached in s or SMS that request you to start a payment transaction. 5 / 8

6 3.5. When using online service on mobile device, be extra careful to the security arrangement as it may not on the same level for online service provided through personal computers When setting your password: - Avoid using the same password you use to access other services. - Do not use easy to remember personal information, such as your contact numbers, date of birth, HKID card number, license number as part of your password. - Use a combination of upper, and lower case letters and numbers to make the password difficult to guess. - Do not write down your password or store your password on any computer or mobile device. Change your password regularly When using O! epay, beware of any abnormal login process, suspicious pop-ups or request for additional personal information. Logout your O! epay Account after using it Registration of partial Octopus number is required as a safety precaution for online payment and enquiry. For added protection, you may consider using protective shield holder to further protect against potential unauthorised use of your Octopus After using Octopus App or Octopus Mobile SIM, you are advised to disable any wireless network functions (e.g Wi-Fi, Bluetooth, NFC) of your mobile device to protect against potential unauthorised use of your Octopus Check the transaction of your Octopus. If you find any suspicious transactions, report immediately to us for investigation by calling Octopus Customer Service Hotline at Use legitimate software from original sources Using legitimate software will reduce the risk of the software being tampered and the chance of contamination by computer virus or spyware Do not jailbreak, root or modify the operating system These activities reduce the system stability, making it vulnerable to computer virus and spyware attack that can cause harm or leakage of your personal information. We may be unable to provide the service you requested on a jail-broken or rooted mobile device Update your operating system and Internet browser regularly 6 / 8

7 Updating your operating system regularly will protect your mobile device against weaknesses of the software. Use latest versions of operating systems and mobile applications. Download and apply security patches to mobile devices when they are made available for prompt protection against know security vulnerabilities Use anti-virus software and update it regularly Using anti-virus software will protect your mobile device from computer virus attack from numerous sources. Moreover, you also need to update the virus definition file regularly to protect your mobile device effectively. For details, please refer to the Help section of the software Use anti-spyware software and update it regularly Using anti-spyware software will help block malware or spyware from being installed on your mobile device and tracking your usage behaviour. Some anti-spyware software can also detect and block phishing websites and help you differentiate the official genuine sites from the fraudulent ones Use firewall software and update it regularly Firewall software may have already been bundled with your operating system or you may have installed additional firewall software from third party suppliers. It is necessary to keep your firewall software up-to-date regularly to protect your computer or mobile device from network attacks Do not use pirated software or software from unknown sources Pirated software or software from unknown sources may be tampered or modified by spyware, virus or other program changes that are not included in the original software package. This may increase the risk of your mobile device of being infected by virus, spyware or other software that can cause damage to your device or leakage of your personal information Secure your wireless network While using wireless network to connect to the Internet provides a lot of convenience, the technology behind wireless Internet relies on radio signals. As a result, people nearby can also gain access to your network without your prior approval. Many wireless network devices (or known as wireless routers) support password-based secured access or encryption to enhance the security of communication between your computer or mobile device and the Internet, and prevent unauthorised access to your 7 / 8

8 network at the same time. You are advised to disable any wireless network functions (e.g. Wi-Fi, Bluetooth, NFC) of your mobile device when it is not in use Beware of fake / phishing s You may receive s that pretend to be sent from OCL. These s attempt to trick you into providing your personal information. OCL will never ask for your personal information or password through s or links in the s. Do not open / reply / click these s Block spam s Spam mails may include links diverting you to some fraudulent sites. They may be disguised as being sent by companies you have dealt with previously, and attempt to gain your trust and obtain your information. Be extra careful when handling spam s. It is normally recommended to switch on the spam block / filter function of your client or online service provider Beware of look-alike websites Sometimes fraudsters and scammers may set up pages that look like websites you trust, asking for your personal or private information. Be very careful to ensure the pages you visit are actually of your trusted companies by checking their locations / URL information Smart tips on using Stored Value Facilitates For smart tips and educational video provided by the HKMA, please refer to this link. 8 / 8