Alt+A to show this section, Tab to navigate forward, Shift+Tab key to navigate backward, Enter to access link, and Esc to reset

Frequently asked questions of Online Security Device

Frequently asked questions (FAQs) about your
Online Security Device

Click on any of the questions below to access the FAQs.

What is an Online Security Device?

Online Security Device

HSBC is committed to providing high standards of online security for our customers. To further protect our customers banking online, we are pleased to provide our latest technology – the Online Security Device. It is a simple and convenient way to ensure greater protection for you and your financial information.

At the touch of a button, your Online Security Device generates a dynamic, time-sensitive security code.


  • The security code constantly changes and is unique to your Online Security Device
  • This security code is required, in addition to your user ID and password, every time you log on to HSBC's internet banking service
  • As only you have the device, only you know the security code, and only you can access your account

For further information on HSBC's Online Security Device, please call our Direct Service Centre at 0800 838 006.

Why do I need an Online Security Device?

HSBC has made the decision to issue an Online Security Device to all our internet banking customers to offer better protection from a variety of potentially damaging attacks, including:

  • Identity theft where a fraudster obtains personal details of a victim, and uses these details to complete fraudulent activities such as applying for loans, ordering chequebooks and more
  • Trojans (keylogging/screen capturing) where a victim discloses their confidential credentials to a fraudster by a Trojan unknowingly downloaded on their PC
  • Phishing where a fraudster 'phishes' for confidential information from a customer by pretending to be from a legitimate source such as a bank or a financial institution. These details are later reused to carry out fraudulent transactions
  • Shoulder surfing where a fraudster observes a victim entering their confidential details, and then reuses these details to carry out fraudulent transactions

What is a security code?

A security code is the six-digit number generated by your Online Security Device. To view the security code, simply push the grey button on your Online Security Device. The security code is a one-off, time-sensitive number that changes every 16 seconds. You will be asked to enter a security code in addition to your user ID and password every time you log on to HSBC's internet banking service, and when completing certain transactions within internet banking.

The correct way up for your Online Security Device is when the grey button is to the left.

What is a serial number?

Each Online Security Device has a unique 10-digit serial number printed on the sticker on the back of the device. This number identifies your Online Security Device and needs to be linked to your internet banking user ID. The serial number has no security value; it is a means of identifying to HSBC which Online Security Device you have. Once activated, a security device becomes unique to the user ID with which it was activated.

How does the Online Security Device compare to other internet banking security measures such as text message security codes or digital certificates?

The generation of the security code is not dependent on mobile phone signal availability or the geographic location of our customers who may need to access internet banking while overseas.

From our customer research, we know that many of our active customers prefer to access internet banking from several different locations. The Online Security Device is a portable, standalone security device that requires no system adjustments, downloads or plug-ins. You can choose to access internet banking at any internet-enabled PC without any additional setups or preparation.

What types of transactions require the input of the security code generated by the Online Security Device?

The security code is required for:

  • Logging on to HSBC internet banking
  • Non-designated third-party transfers
  • Bill payments
  • Changing personal details such as address or telephone number

If I don't conduct transactions like transfers to third-party accounts, can I choose not to use the Online Security Device?

Identity theft can occur across all areas of internet banking; therefore, all HSBC customers need an Online Security Device to log on to internet banking and to conduct the above transactions. The Online Security Device helps to protect against internet fraud, including phishing and keylogging/Trojans, where information disclosed during online transactions is reused for unauthorised account access.

If I lose, break or forget my Online Security Device or don't have it with me can I still access internet banking?

You will need to have your Online Security Device to access internet banking at all times.

  • If you lose or break your Online Security Device, please contact us at 0800 838 006 for a replacement. Once your order is received, we will post a replacement device.
  • If you have an urgent need for a replacement, you can also request one from any New Zealand branch of HSBC.

Overseas travel: If you are travelling overseas or within New Zealand, and need to access internet banking while away, remember to take your Online Security Device with you. Your Online Security Device has been designed to be robust and portable, so you can clip it on a key ring to take with you anywhere, anytime.

How does the Online Security Device security code work?

  • The device generates a time-sensitive, single-use six-digit security code for you to use when logging on to internet banking and for selected online transactions
  • The security code is generated by an algorithm based on time within the Online Security Device
  • Each Online Security Device has a matching file, stored securely in a database at HSBC, with the matching algorithm

When you activate your Online Security Device, HSBC identifies which device you have by asking you to enter the serial number. The serial number has no security value; it is a means of identifying to the Bank which security device you have. Once activated, a security device becomes unique to the user ID with which it was activated.

When you are using internet banking and are required to enter a security code, the system compares the entered code with the expected code within the file. If they match, you are granted access. If they do not match, you will be asked to re-enter the security code.

Will you suspend my internet banking access if I input the wrong security code? How do I resume my internet banking access?

To protect personal information, your internet banking service will be temporarily locked out if you enter three incorrect security codes. The duration of the lock-out period varies depending on whether the incorrect security code has been entered at logon or when completing a high-risk transaction. Unlike if you are locked out due to incorrect password entry, no action is required by you to restore your access to internet banking. Your access will be automatically unlocked after the temporary period has expired.

Has the Online Security Device been used and tested overseas?

Yes, this type of Online Security Device has been in use for several years by other corporations in some overseas countries such as Scandinavia, the Netherlands, Indonesia, Malaysia and most recently in Hong Kong. All the feedback received to date has been satisfactory.

Can I keep more than one Online Security Device for the same internet banking account if I am willing to pay for the additional security devices? I want to keep one device at home and one at the office for the sake of convenience.

To protect our customers, only one Online Security Device can be activated for one user ID at any time. This means that a user can only have one security device to access their account. The reasons for this are:

  • To ensure that only the individual in possession of the device can access the account
  • No one is able to request and activate a new Online Security Device without deactivating the existing device; hence, only one device can be linked to a personal internet banking account
  • The device is unique and cannot be copied, altered or tampered with, meaning that only you have access to it

Does the Online Security Device need a battery to operate? How long does the battery last?

The security device is powered by a battery that can last for around five years under normal usage. A low battery indication of 'BATT' will appear on the LCD when the battery is running low. Should you receive this message, please call us to order a replacement Online Security Device free of charge.

How to activate and use your OSD

Find out more

Some helpful points about the ongoing care of your OSD

Find out more

Some frequently asked questions about your OSD

Find out more