WhatsApp hijackers use fake daughter to swindle HK$200k; bank staff foil plot

Police warned the public on Monday about a new tactic in WhatsApp account hijacking scams that directly targets the victim.

In a recent case, a scammer hijacked a parent's phone, deleted the chat history with the daughter, and created a new contact using the daughter's profile picture and nickname. The fake daughter then asked for a HK$200,000 transfer, even using old voice messages from the real daughter to sound convincing.

The parent almost fell for it but was alerted by a vigilant bank staff member during the transfer process, preventing any loss.

Police said the victim received a WhatsApp message from someone pretending to be the daughter, claiming an urgent need for HK$200,000. Only when a bank employee suggested calling the daughter to verify did the parent realize the WhatsApp account had been hijacked. The bank helped stop the transfer.

The scam involved three steps: the victim clicked a phishing link in a fake WhatsApp message and entered a code provided by the scammer, leading to the account hijacking; the scammer copied old voice messages from the daughter and deleted all chat history between the parent and daughter; the scammer then impersonated the daughter using her profile picture and nickname to request money.

Police said they received over 40 reports of WhatsApp hijacking scams in the past week, involving more than HK$5 million.

They advised the public to regularly log out from "linked devices" on WhatsApp, avoid entering unknown codes, enable two-step verification, and not blindly trust search engine results – suggesting bookmarking frequently used websites instead.

People should also avoid using public Wi-Fi or computers to log into online accounts, never disclose passwords or verification codes, scan QR codes or enter codes from unknown sources, verify any loan requests from contacts by calling them directly, and use the "Scameter" search engine or app to assess fraud risk before transferring money.