Woofun AI reports that the Hong Kong Securities and Futures Commission has mandated licensed virtual asset trading platforms and internet brokers to discontinue one-time password usage for login and device binding within 12 months. Institutions must transition to robust authentication methods, including passkeys, while large brokers are required to implement these measures immediately. The directive responds to data showing phishing attacks comprised 57% of cybersecurity incidents in 2025. Entities must also deploy monitoring systems for suspicious activities and notify users of anomalies, with regulatory action taken against firms with deficient internal controls.