Bank and autoparts maker hit in e-mail scams

A Shanghai-based auto parts maker was lured into depositing US$9.8 million (HK$76.4 million) into the Hong Kong bank accounts of scammers posing as an American supplier in an e-mail.

That loss was the worst suffered by a commercial enterprise in a scam that happened between October and January.

That came with the police saying there were 145 e-mail scams and HK$482 million stolen in the first quarter, though that was a 37 percent drop from 230 cases in the corresponding period last year.

The average loss for the 145 reports was HK$3.3 million.

In the case involving the auto parts maker, the scammers offered low interest rates as part of a finance deal and managed to persuade the company to deposit US$9.8 million in a bank account.

That amount, however, paled in comparison to the HK$314 million that a Japanese bank branch parted with in a scam that occurred between December 2019 and early last year.

Police warned enterprises to be careful of phishing e-mails, after their numbers jumped 35 percent from 2,587 in 2019 to 3,483 last year. Phishing involves scammers posing as trustworthy entities to lure people into giving away sensitive information on digital platforms, which is then used to extort victims.

Cyber security division superintendent Fan Chun-yip said they were a major source of the SAR's cybersecurity worries. "Some overseas studies note that nearly a quarter of data leakage cases have to do with people accidentally clicking on phishing e-mails," he said. "They cost enterprises a total loss of over US$3 million."

Elsa Wong Yuk-kuen, vice-chairwoman of Hong Kong General Chamber of Commerce's digital information and telecommunication committee, advised companies to provide configured laptops to protect employees.

Chief inspector Ip Cheuk-yu said police had launched a drill to enhance defenses against phishing e-mails last month.

That saw 46 firms joining in and involved a total of 1,388 participants.

"Within one month, participants received six phishing e-mails covering themes such as vaccinations, tax returns, cloud storage, faults in software accounts, and cloud documents sharing," he said.

"Once participants clicked on the hyperlinks or attachments, they will be seen as victims."

Ip said 12 percent, or 169 of the 1,388 participants, fell for the phishing e-mails.