HSBC transfer limits

I'm documenting this for the benefit of future me, and for anyone else who facing an error -10004 whilst trying to change their transfer limit in their HSBC Singapore account.

The design of HSBC Singapore's transfer limit changing system is not very intuitive. The steps are similar to the systems used by the other banks in Singapore: you visit the bank's website, visit the transfer limit page, key in a new transfer limit, then key your new transfer limit into an app or physical token to get a 2FA PIN, and then key in said 2FA PIN.

I did all that, but received an error -10004. This error indicates that the wrong transaction code was input or generated.

I checked and re-checked the limit total I keyed in when generating a security code on the HSBC Singapore app, and also verified that I had copied the transaction code correctly. At first, I thought it might be a fluke, or that the code had somehow expired before I keyed it in, but I retried 3 times without success.

After much head-scratching, I finally realised that HSBC's 2FA PIN generation system is different from the other banks'. Instead of generating your 2FA PIN from the new transfer limit you have just keyed in ($10,000 in my case), the PIN should be generated from your new aggregate transfer limit that is labelled "Limit total" ($9,000,061,000.00 in my case).

Rather counterintuitive design.