The Hongkong and Shanghai Banking Corporation Page 1 of 10

Business Internet Banking New Security Device – FAQ General Questions on Security Device What is Security Device? Security Device is an electronic device to generate a special, one time Security Code. You must enter the Security Code to log on to Business Internet Banking and to authorize certain services such as making payment to unregistered beneficiaries and maintaining eStatement and eAdvice service.

Existing Security Device New Security Device

What is Security Code? The Security Code is a special, one-time password used to access full range of Business Internet Banking services. The 6-digit password appears on the LCD screen of the Security Device for your input into the verification screen of Business Internet Banking. What is Security Device serial number? Security Device serial number is a unique number printed on the back of the Security Device that is linked to your Business Internet Banking profile. It is a 10-digit number identifying your individual Security Device. As a result, you can only use this individual Security Device, to access your Business Internet Banking services. That means you cannot use others’ device to generate a Security Code for your Business Internet Banking service. How does the Security Device generate the Security Code? The Security Device has been selected by HSBC as the technology that best meets our security standard. The Security Device itself generates the Security Code. As there is no dependency on a third party for security code generation, our customers do not need to rely on another party's service standard to access Business Internet Banking. The generation of the security code is not dependent on capacity issues, signal availability or the geographical location of our customers. It also does not require downloads, set-ups, system adjustments, etc.

The Hongkong and Shanghai Banking Corporation Page 2 of 10

New Security Device – Functionality Why has HSBC introduced the new Security Device? HSBC commits to protecting the security of our Business Internet Banking customers. As a leader in online banking security, we are delighted to introduce a new Security Device with enhanced security and service. New functions are also added in Business Internet Banking to enhance our services. How to use it for log on and when should I need to use the numeric button?

What is the difference in functionality between the new and existing Security Device? The new Security Device not only enhances the security in Business Internet Banking, it also provides new functionalities in Business Internet Banking: Stronger protection on existing functions To provide enhanced security level for transactions which require stronger protection, the new device requires customer to input customer specific information (e.g. beneficiary account number) to generate a Security Code.

These transactions include: - Making payment to unregistered beneficiaries - Making autoPay payments

New functions

To maximize convenience, customers can create designated beneficiaries online using the new Security Device. Customers no longer need to submit paper form request thus reducing the turnaround time.

Press this button once to get the security code for log on or erase the incorrect input.

The numbering buttons are used for keying in the customer specific information.

Press this button once after entering customer specific information to generate the security code for transaction.

The Hongkong and Shanghai Banking Corporation Page 3 of 10

For the new Security Device, I noticed that there are different formats of Security Code. What is the reason? The new Security Device generates two types of Security Code with different format, which support different functions in Business Internet Banking. Please refer to details below: Security Code Format

How to generate? Example of Function

123456 Customers press on the device to generate the Security Code

Log on to Business Internet Banking

123 456 Customers input specific information into the device and

press to generate the Security Code

Verification for payment to unregistered beneficiaries

After I have submitted instructions using the new Security Device, when will the instructions be effective? The effective time of various transaction is as follows Instruction type Effective Time Make payment to unregistered beneficiary Effective immediately Make autoPay payment Submission before 5:30pm from Mon to Fri will be

effective on next working day Submission afterwards will be effective on the next 2 working days

Create designated beneficiary Submission before 9pm from Mon to Fri or 6pm on Sat will be effective on next working day Submission afterwards will be effective on the next 2 working days

The instructions for creating designated beneficiaries cannot be effective immediately since processing time is needed for us to verify the information associated with the instructions submitted. When will the battery of the new Security Device expire? The battery in the Security Device can last for three to five years, depending on the frequency of the usage. The BATT message will be prompted when the battery of your Security Device is running low. Please request for a new Security Device by logging on to Business Internet Banking > My HSBC > Request for New Security Device.

The Hongkong and Shanghai Banking Corporation Page 4 of 10

Why is there a square on the ‘1’ and ‘3’ on the new Security Device? Do they indicate any special meaning or function? The squares are unique design of the device which may be used by Business Internet Banking in other countries. For Hong Kong, there is no particular meaning or function associated with this design.

What will happen if I pressed the ‘1’ or ‘3’ key before pressing ? As mentioned, the ‘1’ and ‘3’ with a square on the new Security Device are not designed for Business Internet Banking in Hong Kong. You are not able to generate a valid security code

for instruction verification if you do so. Please press to delete wrong entries on the LCD screen of the new Security Device, then, follow the instruction to re-enter your customer specific information to generate a valid security code. New Security Device – Selected Customers for Receiving Security Device My business partner/friend has received an email from your Bank regarding the launch of new Security Device but I have not. Will I receive it? The notification email is sent to selected customers by batches to notify them a new Security Device will be mailed to them shortly, and the notification process has completed by February 2012. If you wish to request for a new Security Device in advance, please log on to Business Internet Banking > My HSBC > Request for New Security Device to apply for a new device. I have received an email from your Bank regarding the launch of new Security Device recently. When will I receive the new device? The new security device will be mailed to you in 4-5 weeks from the date of the email notification. I do not receive any new Security Device after receiving the notification mail 4 weeks ago. What should I do? Please contact us on (852) 2748 8288. How can I update the company address as to ensure I can receive the new Security Device? You can submit the Change of Address form to branch in order to update the company address. Please note that 7 working days are needed for process. The form can be downloaded from HSBC Commercial Banking website (http://www.commercial.hsbc.com.hk) , under Forms and Tools > Forms > Other Forms > Change of Address and/or Customer Information Instructions Form.

The Hongkong and Shanghai Banking Corporation Page 5 of 10

Can I continue to use my existing Security Device? If you have received the new Security Device, you will need to activate it according to the instructions on the letter sent to you. Once it is activated, any previously activated Security Devices will no longer be valid and should be discarded. Please note that with effect from 26 August 2012 you will not be able to perform the following types of transactions with your existing Security Device: Make payment to unregistered beneficiaries Create of designated beneficiaries Make autoPay payments However, you can still logon to Business Internet Banking and perform other banking transactions with the existing Security Device. What should I do with the old Security Device? Once your new Security Device has been activated, your old Security Device will no longer be valid for logon or any transactions on Business Internet Banking, and it should be discarded. If you would like HSBC to dispose your old Security Device, you may return it to any HSBC branch. We will help you to dispose of the Security Device in a safe and environmentally appropriate manner. I also have a Security Device issued by other country (e.g. Singapore), will I receive another new device? The new Security Device which we have introduced is specific for Business Internet Banking in Hong Kong only.

The Hongkong and Shanghai Banking Corporation Page 6 of 10

New Security Device – Application My business partner/friend has received a new Security Device from your Bank recently but I have not. Why is that? HSBC aims to provide the highest standard of security to our customers and enhance customer experience on an on-going basis. To further enhance online security, we have introduced a new Security Device to offer higher security protection and support more services to enhance customer convenience. The new Security Devices are issued to selected customers by batches who need to access specific services on Business Internet Banking which require stronger protection with this new device. The issuing of new Security Device to selected customers has completed in February 2012. If you have not received the device from us and would like to use the additional functions with the new Security Device, simply log on to Business Internet Banking > My HSBC > Request for New Security Device to apply for a new device. The new device will be sent to your local address within the next 3 working days or overseas address within the next 10 working days. Please follow the instruction to activate your new device upon receipt. I have an existing Security Device but I would like to apply for a new Security Device, what should I do? Simply log on to Business Internet Banking > My HSBC > Request for New Security Device.to apply for a new device. The new device will be mailed to your local address within the next 3 working days or overseas address within 10 working days, and please follow the instruction to activate your new device upon receipt. I want to keep one security device at home and another at office. Can I keep more than 1 security device for same BIB account if I am willing to pay for the additional security device(s)? To provide the highest online security in our Internet Banking, only one Security Device is issued for each Internet Banking account The reason for issuing only one Security Device per account is to ensure that the device is for customer’s own personal use and should not be sharing with others. Hence no one is able to request and activate a device without deactivating the existing device, and this will prevent fraudsters from obtaining additional Security Devices to access unauthorised accounts. New Security Device – Input of information into the device How does inputting customer specific information into the Security Device increase the security level in Internet Banking? The new device requires customer to input information specific to the transaction (e.g. account number) into the device to generate a Security Code. With this transaction signing function, the payment will only be made to the account specified by the customer.

The Hongkong and Shanghai Banking Corporation Page 7 of 10

When do I need to input customer specific information into the Security Device? Customer specific information is needed to be input into the Security Device to verify your instruction. You need to input customer specific information into the Security Device when you are doing the following transactions: Make payment to unregistered beneficiaries Make autoPay payments Create designated beneficiaries online When do I need to input the Security Code only without inputting customer specific information? Customer can perform single signing by inputting the Security code only when you are doing the following actions: Logon Business Internet Banking Register Business Internet Banking Create / Modify User Request new security device Activate new security device Apply Cash’s order / Demand Draft Maintain eStatement and eAdvice Do I need to verify the transaction/customer specific information displayed on the “Verification” screen? You should verify the transaction/customer specific information displayed on the Business Internet Banking “Verification” screen for every transaction. How do I know what customer specific information I need to input into the Security Device? Simply follow the steps shown on the ‘Verification’ screen in Business Internet Banking to input information into the Security Device and generate the Security Code. Verification screen sample

The Hongkong and Shanghai Banking Corporation Page 8 of 10

You may also refer to the following table for the input at different scenarios. Make payment to designated beneficiaries / Create designated beneficiaries Input method Example Please input Beneficiary account number with 8 or more digits

Input last 8 digits 123-45678-90 34567890

Beneficiary account number with 4-7 digits

Input all digits 123456 123456

Beneficiary account number with 1-3 digits

Add zero(s) at the beginning to make it a 4-digits number before input

123 0123

Beneficiary account number with non-digits

Input last 8 digits 123A4567BC89D 23456789

Make autopay Payment Input method Example Please Input

autoPay payment with

one entry

Input last 8 digits of

the beneficiary

account number

Total entries: 1

Total amount: $10,000

Beneficiary account

number: 123-45678-90

34567890

Total entries: 153

Total amount: $123,456.90

15312345

Total entries: 8

Total amount:$73,456.40

873456

autoPay payment with

two or more entries

Input first 8 digits of

the combination of

‘Total entries’ and

‘Total amount’

(ignore decimal

places)

Total entries: 03

Total amount:$12.80

0312

Why customers are required to input the last 8 digits but not the first 8 digits of the Beneficiary Account No in order to get the security code? It is not user-friendly. For a number of banks, the first few digits of the account number are the same. For security reasons, we require customers to input the last 8 digits of the beneficiary account number in order to get the security code.

The Hongkong and Shanghai Banking Corporation Page 9 of 10

What can I do if I input a wrong digit into the Security Device during the verification process?

If you input a wrong digit into the Security Device, simply press to delete each digit one by one.

What will happen if I hold for a while (i.e. more than 2 seconds) during the input of information into the Security Device?

If you hold for 2 seconds during the input of customer specific information into your Security Device, all of your input will be deleted.

I have pressed the or button already, but I still cannot see the Security Code. Why is that?

You should press and hold the or button for 1 second for the device to generate the Security Code. Exceptional Cases The Security Code on the LCD display has been disappeared after a while, what happened? As a security measure, there is limited display time for each Security Code to display on the LCD screen. If the Security Code disappears, simply follow the instructions on the screen of Business Internet Banking to generate the Security Code with your Security Device again. I have input the Security Code into Business Internet Banking, but it cannot be verified. What happened? This may happen if you have entered an invalid Security Code into the screen. Please check the Security Code displayed on your Security Device and re-enter a valid Security Code to proceed with the verification. If the code still cannot be verified, please contact us on (852) 27488288. For the new Security Device, if I input incorrect information into the device, will this affect my instruction? A valid Security Code will only be generated if you input correct customer specific information into the Security Device. If you’ve input incorrect information, please follow the instruction (i.e. starting from Step 1 on Verification screen in Business Internet Banking) again and ensure you input correct information to generate a valid Security Code.

The Hongkong and Shanghai Banking Corporation Page 10 of 10

After I have created a designated beneficiary, will I be notified through SMS or letter? A confirmation SMS will be sent to the final approver registered mobile number in our record. And once the designated beneficiary is effective, a notification letter will be sent to your company correspondence address. My registered mobile phone number is an overseas number. Can I make payments or create designated beneficiaries online? Yes, you can. After you have made payments or created designated beneficiaries, we will send a confirmation SMS to the final approver’s mobile phone number in our record, including local or overseas number. You may not be able to receive the SMS due to network issues. However, please be rest assured that it would not affect your instructions. Moreover, after you have successfully created a designated beneficiary, we will send a letter of confirmation to your company. Dual Authorization and Dual Management Control Our company’s Business Internet Banking account has set up ‘Dual Authorization’ for transactions approval. Do both of the Primary users need to input the Security Code when authorizing a transaction? For making payment to unregistered beneficiary or making autoPay payment, only the final authorizer needs to input the security code for authorization. Our company’s Business Internet Banking account has set up ‘Dual Management Control’ for service maintenance. Do both of the Primary Users need to input the Security Code when creating a designated beneficiary? For creating designated beneficiary, both Primary Users are required to input a security code for authorization. If the instruction is prepared by a Secondary User, the Secondary User is also required to input a Security Code.