IMPORTANT NOTICE

Beware of Impersonation Scams and Enhancement of Account Authentication Security Measures

Dear Valued Clients,

Recent investment fraud and phishing scams have become increasingly prevalent. Fraudsters often impersonate financial institutions through fake websites, forged employee identities, fraudulent text messages or emails in an attempt to obtain clients' login credentials, personal sensitive information or funds. At the same time, the Securities and Futures Commission (SFC) issued a circular on 9 July 2026 requiring licensed corporations to further enhance the login and device binding authentication measures for client accounts to strengthen investor protection. To safeguard your account and assets, we hereby notify you of the following:

I. Beware of Common Scam Tactics

Common tactics employed by fraudsters include, but are not limited to:

• Impersonation: Contacting investors through forged employee name cards, fake websites, mobile applications or social media accounts purporting to represent financial institutions;

• Fraudulent fund transfers: Inducing clients to transfer funds to personal or third-party bank accounts;

• Obtaining personal data: Requesting clients to complete forged documents or electronic forms to collect sensitive personal information such as identity card numbers, bank account details and login passwords;

• Phishing text messages/emails: Sending messages containing malicious links, falsely claiming to be acting upon regulatory or governmental requests for information, luring clients into entering their login credentials and one-time passwords on fake websites, thereby compromising client accounts for unauthorized transactions.

We hereby solemnly declare that our company will never request clients to transfer funds to any personal or third-party accounts via email, text message or instant messaging applications, nor will we ever request clients to disclose their trading passwords, one-time passwords or other authentication credentials. Should you receive any suspicious requests, please remain vigilant and do not respond or click on any links.

II. Upcoming Enhancement of Account Authentication Measures – Important Reminder

To comply with the SFC's latest regulatory requirements and further mitigate the risks of phishing attacks, our company will upgrade the login and device binding authentication measures for internet trading accounts according to the following schedule:

Our company will announce specific implementation arrangements and user guidelines through official channels prior to the rollout of the new measures. Please stay tuned.

III. Your Account Security Guidelines

To protect your account from unauthorized access and transactions, please strictly observe the following security practices:

1. Access only through official channels: Please access your account only through our official website or official mobile application. Do not click on any suspicious links to log in;

2. Never disclose sensitive information: Under no circumstances should you disclose your password, one-time password, authentication credentials or device verification codes to any third party;

3. Use strong passwords: Set a strong and unique password for your account and change it regularly;

4. Monitor account activity notifications: Please review the login, device binding and transaction notifications sent by our company in a timely manner. If you notice any irregularities, please contact us immediately;

5. Verify incoming calls and messages: If you receive a call or message from someone claiming to be our staff requesting personal information or fund transfers, verify through official channels immediately;

6. Exercise caution with device binding: Do not bind your account on any device belonging to others or on public devices. If a device is no longer in use, please unbind it as soon as possible.

IV. Our Official Contact Channels

Should you have any enquiries or need to verify any information, please only contact us through the following official channels:

• Official Website: www.cjsc.com.hk

• Client Services Hotline: 40085 95579 / (852) 2823 0388

• Client Services Email: brokeragecs@cjsc.com.hk

• Official Applications: 長證國際交易寶（手機APP）/長江證券港股快車（電腦程式）

V. Recommended Anti-Fraud Resources

Clients are encouraged to make use of the following anti-fraud platforms in Hong Kong to verify suspicious information and obtain the latest scam alerts:

• Scameter: https://cyberdefender.hk/scameter/   (to check whether a website, phone number, email, etc. may be involved in fraud)

• Scameter+ App: Provides real-time alerts when users attempt to visit websites that may be involved in fraud

• SFC Alert List: https://www.sfc.hk/EN/alert_list

VI. What to Do If You Suspect Suspicious Activity

If you suspect that your account has been subject to unauthorised transactions, that your login credentials have been compromised, or if you have received any suspicious messages, please immediately:

• Change your password and strengthen your account security settings;

• Call our Customer Services Hotline to verify with us;

• Where appropriate, report to the Hong Kong Police or through the Anti-Scam Coordination Centre.

We will continue to optimize our security measures in strict compliance with regulatory requirements to protect your account and assets. Should you have any enquiries, please feel free to contact our Client Services & Operations Department at (852) 2823 0388 (Hong Kong hotline) or 40085 95579 (Mainland China toll-free hotline).

Thank you for your trust and support!

Yours Sincerely,

Changjiang Securities Brokerage (HK) Limited