Hong Kong’s privacy watchdog received 558 inquiries involving suspected personal data breaches during the first six months of 2026, a 16 percent increase from the same period last year, as authorities warned residents about increasingly sophisticated scams targeting bank cards, shopping accounts and messaging platforms.
Privacy Commissioner for Personal Data Ada Chung Lai ling gave the figures while speaking at a public seminar on preventing online scams and staying safe on messaging applications and social media. She also detailed several recent cases in which victims lost money after fraudsters obtained personal or financial information through fake websites, impersonation schemes and compromised accounts.
The figures show how quickly fraud tactics are moving beyond traditional phishing messages. Scammers are increasingly combining stolen personal information with social engineering, fake customer service operations and technology such as artificial intelligence voice cloning.
Data breach inquiries rise in first half of year
The Office of the Privacy Commissioner for Personal Data received 558 inquiries concerning suspected personal data harvesting during the first half of 2026.
That compared with 481 inquiries recorded during the same period last year, representing a rise of 16 percent.
The watchdog received 1,163 similar inquiries throughout 2025, according to Chung.
The latest figures were discussed at a seminar organised by the Hong Kong International Data Privacy Academy under the Office of the Privacy Commissioner for Personal Data. The event focused on practical ways for residents to recognise scams and protect information while using messaging services and social media platforms.
Chung used recent fraud cases to demonstrate how personal information can become the starting point for financial losses.
She said residents should not assume that a scam requires access to a bank account or password from the beginning. In some cases, fraudsters can make use of relatively limited card information when businesses fail to put sufficient checks in place.
Credit card fraud exposes weaknesses in online payments
One recent credit card fraud case involved unauthorised purchases of iPhones.
Police received around 1,200 reports connected with the incident, while total losses reached approximately HK$25 million.
One victim discovered that the card had been used fraudulently more than 10 times, with the transactions adding up to HK$110,000.
Chung said weaknesses on merchant websites had contributed to the problem. Some websites did not require additional transaction security measures such as one time passwords or authorisation through mobile banking applications.
Without those additional checks, fraudsters could complete purchases using a credit card number together with the card verification value, commonly known as the CVV security code.
The case demonstrates why consumers cannot rely solely on their banks to prevent every fraudulent transaction. Online merchants also have a role in ensuring that transactions involving payment cards undergo appropriate verification.
Chung urged anyone who notices an unfamiliar transaction to contact their bank immediately and request that the card be frozen or disabled.
A quick response can prevent further transactions while the bank investigates the activity.
Fake visa websites collect sensitive information
The privacy watchdog has also received complaints about fraudulent electronic visa websites.
Between June and August, the office recorded 28 inquiries or complaints linked to fake websites offering electronic visa related services.
Victims entered sensitive information into the fraudulent sites, including identity documents, passport details and information concerning their children.
Some victims also suffered financial losses ranging from several hundred dollars to several thousand dollars.
The incident demonstrates the risks of searching for official government or travel services through unfamiliar websites. A website may appear professional while still being designed to collect personal information or payments.
Residents seeking visa or travel related services were urged to verify the website they are using before entering documents, passport information or payment details.
Fake customer service agents target shoppers
Another scam involved fraudsters pretending to work for home appliance retailers.
Between February and late August, the privacy watchdog received 48 inquiries or complaints concerning this type of impersonation.
The scammers contacted customers and claimed that products they had purchased were defective. They then offered refunds or replacements, creating a seemingly legitimate reason to request additional information or payments.
Victims were asked to provide handling fees, security deposits or credit card details.
Chung advised residents to verify such claims directly with the retailer rather than relying on the contact information provided by the person who contacted them.
That step can help distinguish a genuine customer service request from an attempt to obtain money or financial information.
The scam also shows how fraudsters can exploit genuine transactions. Instead of contacting random victims with an unrelated story, criminals can use knowledge about purchases to make their approach appear credible.
Shopping platform breach affects more than 33,000 customers
Personal data was also exposed after an online shopping platform was hacked last month.
The breach affected more than 33,000 customers and exposed names, addresses, email addresses, telephone numbers and order details.
The Office of the Privacy Commissioner for Personal Data received two inquiries connected with the incident. Police received six reports, with total losses exceeding HK$300,000.
The combination of contact information and order records can give criminals material that can later be used for targeted scams.
For example, someone who knows a customer's name, address and recent purchase may be able to create a far more convincing message than a generic scammer sending thousands of random texts.
That makes data protection important even when the information exposed does not include a bank password or payment card number.
WhatsApp account takeovers remain a major threat
Messaging account hijacking has also become a serious source of financial loss.
More than 2,000 WhatsApp account takeover cases were recorded during the first seven months of the year, with average monthly losses exceeding HK$21.4 million.
A common method involves phishing text messages that ask recipients to provide WhatsApp verification codes.
Police recently arrested a suspected scammer accused of using fake base stations to send 6,000 fraudulent messages over four days. Recipients were tricked into entering eight digit pairing codes, giving criminals access to their WhatsApp accounts.
Once an account has been taken over, scammers can use the victim’s identity and existing conversations to contact friends, relatives or business associates.
That makes the fraud much harder for recipients to recognise. A message coming from a familiar account may appear trustworthy even though someone else is controlling it.
AI voice cloning creates new risks
Chung also described cases showing how technology is making impersonation scams harder to detect.
In one case, a mother transferred HK$10,000 after receiving a request from someone pretending to be her daughter. The scammer claimed that the money was urgently needed to pay tuition fees.
Another victim lost more than HK$10 million after fraudsters used artificial intelligence voice cloning to impersonate his father.
The criminals claimed that emergency business funding was required and persuaded the victim to make repeated transfers.
The case demonstrates why a familiar voice is no longer enough to establish someone's identity. AI tools can reproduce voices with increasing accuracy, allowing criminals to create convincing calls that exploit existing family or business relationships.
Chung advised residents to verify unusual financial requests by contacting the person directly through another channel.
A phone call to a known number can provide a simple check before money is transferred.
Privacy protection requires basic security habits
Chung urged residents to enable WhatsApp two step verification and regularly check which devices are linked to their accounts.
She also warned people never to disclose passwords or verification codes, even when a message appears to come from a friend, relative, company or customer service representative.
Residents should avoid entering personal information into unverified websites and download applications only through official app stores.
When a message requests money, personal information or an account verification code, users should pause before responding.
The same applies to unexpected calls claiming to come from banks, retailers or family members. Rather than continuing the conversation through the original contact channel, residents should independently contact the organisation or person involved.
Hong Kong’s latest figures show that scams are no longer confined to one method or one type of victim. A stolen verification code, an exposed shopping record, a fake website or an AI generated voice can each become the first step in a much larger fraud.
The most effective response can begin with a simple action: stop, verify the request through an independent channel and never provide a password or verification code to an unverified person.
Have you encountered a suspicious message, fake customer service call or account takeover attempt? Sharing the warning signs can help others recognise the same scam before they lose money or personal information.