HSBC: generating security code

HSBC has a broken two factor authentication system that I finally figured out how to make work. I’m not the only one having trouble; searches like “hsbc generate security code” are very popular.

The Android app generates the code. The key thing is you cannot be logged in to HSBC on the mobile app while generating the code. If you are logged in you are taken to an “Accounts” page that shows current balances. Nowhere from here can you generate a code. You have to log off first.

Once you are logged off the screen asking you to login asks for a fingerprint or a “Digital Security Device passcode”. (The latter is a second password that you set up as part of their 2FA system.) Do not log in. Instead, press the “Generate security code” button at the bottom of the screen, then choose “Log on security code” from the popup menu. You’ll have to verify your fingerprint and then it will give you a 6 digit code. That is your temporary security code you can type into the web application to log in.

To complicate matters more; if you are logged in to HSBC both from a desktop browser and from the Android app then HSBC gets confused and complains about how you have two active sessions at once. I think I had to log in on the desktop website like 4 times before I finally managed to finish my business.

I tried taking screenshots to illustrate this but hilariously the app seems to be blocking screenshots, no doubt “for my security”. None of the online help docs have pictures that match the only screen in the app that actually lets you generate codes.