The Fake FPS Notice: How a Hong Kong Phishing Alert Exposes Crypto's Wallet Taxonomy Problem

A warning about fake websites landed from Hong Kong Interbank Clearing Limited. The tell was not the fraud. It was the phrase 'virtual wallets.' In Hong Kong's Faster Payment System context, that phrase almost always means a stored-value facility: an SVF wallet such as AlipayHK, WeChat Pay HK, PayMe, or Octopus. It does not mean MetaMask. The crypto press read 'virtual wallet' and filed the story under Web3. That classification error is the real signal. The fraud is payment clearing fraud. The mislabel is crypto's own blind spot. FPS is a real-time clearing rail. HKICL operates it. The rail moves Hong Kong dollars and renminbi between banks and licensed stored-value facilities. HKICL does not open accounts for individuals. It clears. The notice said fake sites were impersonating HKICL. The sites offered refunds, help reporting unauthorized transactions, and transaction assistance. They allegedly pushed users to top up or withdraw through virtual wallets, then asked for bank account information. HKICL said it does not provide FPS services directly to individuals and would not contact individuals proactively. Six claims. No domain. No date. No victim count. No wallet address. A standard institutional warning. The notice is authoritative on one point: HKICL is not calling you. It is silent on everything that would help a reader verify a live scam. That silence is not incidental. It is the shape of a liability shield. The institution discloses impersonation, denies direct retail service, denies proactive contact, and tells users not to share information. Each sentence is true. Each sentence protects the institution. None of them tells a reader what a fake FPS page looks like, which wallet flow is being abused, or where to report a loss. A warning without indicators is a press release with a security header. Start with the taxonomy. An SVF wallet is custodial. The balance sits on the licensed institution's ledger. A non-custodial crypto wallet is a key pair. The balance sits on a public chain. The failure modes do not overlap. SVF fraud is account takeover, social engineering, mule accounts, and authorized push payments. Crypto wallet fraud is seed phrase theft, malicious signatures, address poisoning, and approval abuse. If you call both 'virtual wallets,' you blur the only thing that determines the defense. A user who thinks he is protecting a MetaMask seed phrase will not check whether a fake FPS page is asking him to authorize a bank transfer. A user who thinks he is dealing with a bank will not revoke an ERC-20 approval. The word 'wallet' is not neutral. It is a routing instruction for the threat model. Static analysis reveals what intuition ignores. The missing last mile is the core defect. The notice says the sites induced users to top up and withdraw through virtual wallets. It does not say where the money went. Three possibilities. One: the user tops up a custodial wallet controlled by the fraudster. That is an authorized push payment. The loss is final unless the receiving institution freezes the account. Two: the user is asked for online banking credentials. That is account takeover. The loss depends on bank authentication and reimbursement rules. Three: the user is asked to connect a crypto wallet and sign a transaction. That is a different crime with a different evidence trail. The notice does not distinguish. Without that distinction, the warning cannot tell a reader what to do after contact. It can only say do not share information. That is not a control. It is a slogan. The scam workflow is not sophisticated. It builds on chaos, then locks the door. Fake site. Authority logo. Refund hook. Wallet top-up. Bank details. The user is moved from a public rail to a private wallet, then asked to verify identity. At that point, the fraudster controls the narrative and the destination. The notice does not name the door. No domain. No wallet address. No date. No callback number. A warning without indicators is a lock without a key. The reader cannot search for the fake site. The reader cannot block the destination. The reader cannot tell whether the warning is current. Fraud warnings decay fast. Domains rotate. Scripts change. A notice without a timestamp is an artifact, not an operational alert. A minimal disclosure for this case would not require naming victims. It would require naming the mechanism. Which SVF wallets were impersonated? Which domains were observed? Did the fake site collect credentials, one-time passwords, or selfie verification? Did it instruct users to send funds to a bank account, a stored-value account, or a blockchain address? Did it use a payment request, a QR code, or a manual transfer? Each answer changes the control. Credential phishing needs session revocation. QR code fraud needs payee verification. Blockchain address fraud needs address screening. A generic warning collapses all of these into 'do not share information.' That is like telling a developer 'do not write bugs.' My 2017 audit of a pre-launch multisig wallet taught me that critical bugs hide in initialization. The code looked fine in the happy path. The storage layout was wrong at deployment. Payment fraud is similar. The happy path is the licensed flow. The bug is the handoff to an unlicensed wallet. KYC checks the account opener. It does not check the destination of a top-up. It does not check the domain in a browser. It does not check the social engineering script. Compliance costs are real. They are paid by honest users in the form of identity documents, delays, and fee overhead. The fraudster buys a mule account or a purchased wallet and moves on. Most project KYC is theater. This is not a moral claim. It is an incentive claim. The cost is placed where it is easy to place it, not where it changes the attack surface. In 2021, I scanned 50,000 NFT transfers to test royalty enforcement. The result was predictable: opt-in enforcement leaked. The lesson was not that royalties are impossible. The lesson was that enforcement must live at the point of transfer, not at the point of reputation. The same applies here. A warning at the point of a press release is too early. A warning at the point of a browser redirect is useful. A warning at the point of a wallet top-up is better. A warning at the point of a bank transfer is late. The line 'HKICL will not contact individuals proactively' is true at the institutional level. HKICL serves banks and SVFs. It does not call retail users. But the line also does work for the institution. It defines the boundary of responsibility. If someone claims to be HKICL and calls you, the call is fake. Good. But the same line can be misread as 'HKICL never touches individual payments.' That is false. FPS settles individual payments every day. The institution is in the flow but not in the conversation. That distinction is subtle. Fraudsters exploit it. Readers need it stated plainly: the clearing house is in the plumbing, not in your phone. Why crypto should care is not because this is a Web3 event. It is because the same ambiguity is spreading. Crypto on-ramps now use instant payment rails. A user can buy stablecoins with FPS. A scam site can mix a fake bank page with a real crypto deposit address. The taxonomy collapses at the exact point where money becomes irreversible. If the industry treats every 'wallet' story as a smart contract issue, it will build the wrong monitoring. It will scan for malicious bytecode while the fraud is a phone number and a fake refund form. Logic is the only law that doesn't lie. The logic here says: classify the rail first, then the wallet, then the control. Breaking the block to see what spins. The counterintuitive point is that this notice is more useful as a failure of disclosure than as a fraud warning. The crypto industry loves to claim wallet security as its territory. But the actual attack surface in this case is institutional trust and payment messaging. A crypto-native defense would fail. A user trained to check contract approvals would still top up a fake SVF wallet if the page looked like a bank. A user trained to guard a seed phrase would still hand over a bank password if the caller sounded like a clearing house. Security education is domain-specific. Cross-domain transfer is weak. This is why the Web3 label matters. It sends the reader to the wrong checklist. The blind spot is not that crypto users are careless. It is that the industry defines every wallet-shaped object as its own. Composability is just controlled anarchy. Fraud is uncontrolled composability. The fraudster composes a bank logo, a payment rail, a wallet, and a refund story into one flow. The defender composes a policy, a vendor, and a training slide. The fraudster ships faster. The crypto press error is not trivial. It changes the audience. A Web3 audience expects a protocol exploit. It looks for a vulnerable contract. It asks which chain. A payment security audience expects a social engineering flow. It looks for a fake domain and a mule account. It asks which bank. The first audience will miss the warning because there is no contract. The second audience may never see it because it was filed under Web3. Classification is distribution. Distribution is defense. A good warning proves existence without revealing the source. It gives indicators. This one gives a category. The category is wrong. The source is a secondary repost. The original notice has no date in the copy. The claims are single-source. The useful parts are institutional denials. The useless parts are generic advice not to share bank details. That advice is not wrong. It is just not new. A reader cannot act on 'be careful.' A reader can act on a domain, a phone number, a wallet address, or a step-by-step flow. The difference between a warning and a defense is the difference between a category and an indicator. Expect more of this. Instant payment rails are spreading. Crypto on-ramps are spreading. The next scam will not respect the line between an SVF and a self-custody wallet. It will use whichever interface the victim recognizes. The defensive question is not whether the story is Web3. It is whether the payment operator can publish machine-readable indicators: domains, wallet addresses, callback numbers, timestamps, and the exact step where funds leave the regulated rail. Without that, every user is a parser. Every warning is a press release. The fake FPS notice is a small event. The taxonomy error is the larger one. Silicon ghosts in the machine, verified. The ghost here is a word.