HSBC Digital Secure Key FAQs

The Digital Secure Key (DSK) is an in-app security feature. It helps verify your identity when you use online banking. It’s activated in the HSBC Philippines app and helps you generate or approve security codes for important actions. These include logging on, setting up new payees and updating your personal details.

DSK supports strong customer authentication. It links your approval to your registered device and an additional security method, such as a PIN or biometrics. This helps protect you from fraud.

Here are the key benefits:

Stronger security

Adds an extra layer of authentication through a registered device and PIN or biometrics. This helps reduce unauthorised access and fraud.

Convenient for customers

Built into the mobile app, so there’s no need to carry a separate physical Secure Key.

Faster approvals

Allows customers to quickly approve high-risk actions, helping reduce the time taken to complete the overall journey.

Better user experience

Supports smooth authentication using familiar methods like biometrics (Face ID/fingerprint) or an mobile app PIN.

More reliable than “something you know” alone

Goes beyond password-only security by linking authentication to a registered device, making it harder for fraudsters to compromise remotely.

If you're a new user, follow these steps to activate your Digital Secure Key:

1. Download the latest version of the HSBC Philippines app.
2. Register and create your digital credentials.
3. Set up your mobile device to complete the activation.
    

If you’ve registered to HSBC Online Banking but don't have a physical Secure Key, follow these steps to activate your Digital Secure Key:

1. Download the latest version of the HSBC Philippines app.
2. Log on with your online banking credentials.
3. Set up your mobile device to complete the activation.
    

If you already have a physical Secure Key, follow these steps to activate your Digital Secure Key:

1. Download the latest version of the HSBC Philippines app.
2. Log on to the app with your physical Secure Key.
3. Set up your mobile device to complete the activation.
    

Your physical Secure Key will be deactivated once your Digital Secure Key is activated.

The Digital Secure Key generates temporary codes you can use to log on to online banking and verify specific transactions and account updates. Follow these steps to generate a code:

1. Open the HSBC Philippines app without logging on.
2. Select ‘Generate Security Code’ at the bottom of the screen.
3. Choose 'Log on code', 'Transaction verification code' or 'Re-authentication code' to generate the code you need.

You can access the Digital Secure Key through the HSBC Philippines app. Download the latest version of the app from the App Store or the Google Play Store.

While your physical Secure Key will continue to work, for your safety and convenience we recommend switching to the Digital Secure Key by downloading the HSBC Philippines app.

If your physical Secure Key stops working or runs out of battery, please note that it won't be replaced.

Both versions of our Secure Key are used for authentication when you log on to digital banking or make certain transactions.

The main difference is that our physical Secure Key is a physical object, whereas our Digital Secure Key is built into the HSBC Philippines app. This means our Digital Secure Key is more convenient, as you'll always have it with you as long as you have your phone.

• Convenience: You’ll always have your Digital Secure Key with you as long as you have your phone. There’s no need to carry a separate device when you travel
• Security: Both versions are secure, but the digital version has an option to use biometrics, making getting codes faster for you.
• Ease of use: You’ll need to key in certain buttons on the physical device to complete specific transactions, which can sometimes be tricky. The Digital Secure Key, on other hand, is quicker, simpler and more intuitive to use

Please note that once you've activated your Digital Secure Key, your Physical Secure Key will be deactivated.​