Hong Kong police recorded 29,670 fraud cases during the first eight months of the year, with reported losses reaching HK$5.21 billion as scammers increasingly use fake customer service operations, malicious applications and deceptive banking procedures to steal money.
The number of fraud cases from January through August rose 4.5 percent from the same period last year, while financial losses increased 3.8 percent, according to police figures. More than 5,000 of the cases involved scammers posing as customer service representatives, with losses in those cases approaching HK$700 million.
Police have warned that the latest schemes go beyond conventional fake websites and telephone calls. In some cases, criminals persuade victims to install malicious applications that can exploit functions built into their smartphones and potentially turn the device into a tool for processing card transactions.
The methods are designed to make the fraud appear legitimate. A scammer may begin by claiming to work for a bank, online platform or other service provider, then guide the victim through a series of apparently routine steps involving account verification, refunds or security checks.
Fake customer service agents build trust first
Impersonation remains a common feature of the latest fraud cases.
Scammers contact potential victims while pretending to represent customer service departments. They may direct users to websites designed to resemble genuine banking or service platforms and ask them to provide personal or account information.
Once the victim accepts the caller’s identity as genuine, the scammer introduces another part of the scheme.
Police said criminals have been using forged approval documents to reinforce their claims. The documents can make a fraudulent refund or account procedure appear to have been formally authorized.
The scammer then tells the victim that an application must be installed to complete the refund or another transaction.
What appears to be a routine customer service request can instead give criminals access to functions on the victim’s phone that can be used to facilitate unauthorized transactions.
Malicious apps can exploit phone NFC functions
One of the newer techniques involves the Near Field Communication function found on many modern smartphones.
NFC allows devices to communicate over very short distances. It is widely used for contactless payments and other functions that require a phone to communicate with a nearby card or device.
According to police, scammers have been instructing victims to download malicious programs and enable NFC on their phones. They then tell the victim to place a credit card close to the back of the phone.
The instructions may be presented as part of a supposed refund or verification process. In reality, the malicious software can use the phone and card interaction to facilitate transactions that benefit the scammer.
The tactic is particularly deceptive because the victim may believe they are simply following technical instructions from a customer service representative.
Police have therefore urged residents to be cautious when anyone claiming to represent a company asks them to install an unfamiliar application, provide sensitive information or change security settings on their phones.
A legitimate customer service representative should not need to persuade a customer to install unknown software simply to receive a refund.
Fake verification turns bank checks into money transfers
Another scheme identified by police uses a fake verification process to persuade victims to authorize transfers themselves.
Scammers pose as customer service representatives and claim that they need to verify the victim’s bank account. They may request a video call, creating the impression that the process is more formal and secure than a normal phone conversation.
During the call, the victim is instructed to register a designated account as a new payee.
The scammer then directs the victim to a fake website and asks them to enter a supposed verification code into a specific field.
The victim may believe the code confirms their identity or completes the security check. Instead, police said the process actually causes money to be transferred to an account controlled by the scammer.
This approach relies heavily on confusion between verification and authorization. The victim thinks they are confirming a security procedure when they are actually taking a step that enables a financial transfer.
The use of video calls can also make the interaction appear more credible. Seeing another person on screen can create a false sense that the caller represents a legitimate organization, even when the website and instructions being provided are fraudulent.
Fraud losses continue to rise
The latest police figures show the scale of the problem across Hong Kong.
From January through August, authorities recorded 29,670 fraud cases. That represented a 4.5 percent increase compared with the corresponding period last year.
Financial losses also increased. Victims reported losing HK$5.21 billion, a rise of 3.8 percent compared with the same period a year earlier.
Customer service impersonation accounted for more than 5,000 cases and almost HK$700 million in losses.
The figures cover a wide range of fraud methods, but the emergence of schemes involving smartphones, fake websites and banking procedures shows how criminals continue to change their approach as technology develops.
For consumers, the technology itself is not necessarily the problem. NFC, mobile banking and online customer service systems are legitimate tools. The risk arises when criminals manipulate users into operating those tools under false instructions.
SMS registration scheme faces new challenge
Authorities are also monitoring fraudulent text messages.
Chan Kin leung, chief regulatory manager of the Office of the Communications Authority, said that more than 880 companies and organizations had registered under the SMS Sender Registration Scheme since it was established in August this year.
Under the scheme, registered SMS messages will begin with a “#” sign, giving recipients a way to distinguish registered senders from other messages.
Chan said authorities had nevertheless identified some sporadic scam messages that also began with the “#” symbol.
According to Chan, the messages were sent through illegal mobile devices using 2G technology.
The discovery shows why a sender identification system alone cannot eliminate fraudulent messages. Criminals can attempt to imitate trusted formats or use older telecommunications technology to bypass safeguards.
Chan said monitoring and notification mechanisms are in place to address such cases.
2G services to be phased out
Chan also said that 2G services would no longer be available in the market starting from June.
The change is expected to affect older mobile devices and telecommunications equipment that still depend on 2G networks.
He said residents using older phones only need to update their applications and disable 2G services where applicable.
According to Chan, the end of 2G services should remove the channel used by the illegal devices responsible for the fraudulent messages identified by authorities.
The telecommunications measures form part of a wider effort to reduce opportunities for scammers to impersonate legitimate organizations through mobile communications.
However, residents still need to assess messages and calls based on their content rather than relying on a single sign of authenticity.
A message that begins with the correct symbol can still require scrutiny if it asks for passwords, banking information, payments or the installation of unfamiliar software.
What residents should watch for
The latest cases share a common pattern. The scammer first creates a believable reason for contacting the victim, then gradually increases the number of actions the victim must take.
The request may begin with something simple, such as confirming an account or checking a refund. It can then progress to opening a link, entering personal information, joining a video call, registering a new payee, downloading an application or entering a code.
Each individual step may appear harmless. Together, they can give criminals access to money or sensitive information.
Residents should stop the process whenever an unexpected caller asks them to install software, provide banking credentials, enter a code from an unfamiliar website or move money to a newly designated account.
Anyone who receives such instructions should contact the bank or service provider through an official telephone number or website rather than using contact details supplied by the caller.
Hong Kong’s latest fraud figures show that criminals are combining social engineering with mobile technology to create increasingly convincing scams. Before installing an app, entering a verification code or placing a bank card against a phone, ask one simple question: who is asking you to do this, and can you verify that request independently?