diff --git a/lib/rules/no-sync-mongo-methods-on-server.js b/lib/rules/no-sync-mongo-methods-on-server.js
index 909cfe1..cc0870c 100644
--- a/lib/rules/no-sync-mongo-methods-on-server.js
+++ b/lib/rules/no-sync-mongo-methods-on-server.js
@@ -134,7 +134,8 @@ module.exports = {
                 return;
               }
             }
-            if(node.object.type === 'MemberExpression'){
+            // this means it's a call chain like crypto.createHmac().update()
+            if(['MemberExpression', 'CallExpression'].includes(node.object.type) && node.type === 'MemberExpression'){
               // we can ignore longer than 1 call chain
               debug(
                 `Skipping ${invalidFunction} to be considered error because it was used in a longer than 1 call chain`,
diff --git a/tests/lib/rules/no-sync-mongo-methods-on-server.js b/tests/lib/rules/no-sync-mongo-methods-on-server.js
index a42e811..32ce313 100644
--- a/tests/lib/rules/no-sync-mongo-methods-on-server.js
+++ b/tests/lib/rules/no-sync-mongo-methods-on-server.js
@@ -48,6 +48,13 @@ ruleTester.run('no-sync-mongo-methods-on-server', rule, {
       modules.fetch();
       `,
     },
+    {
+      code: `
+      crypto
+        .createHmac('sha256', secretIntercomKey)
+        .update(userId);
+      `,
+    },
   ],
 
   invalid: [