A victim in Hong Kong has lost over HK$1 million in a sophisticated scam after fraudsters tricked them into turning their own smartphone into an electronic payment terminal to carry out unauthorized overseas credit card charges.
Police issued an urgent alert warning the public to stay vigilant if any purported customer service representative requests that they download unknown applications, enable screen sharing, or place their physical credit card against their mobile phone to process a refund.
According to details shared by police on the CyberDefender platform, the scam began when the victim received a phone call from a fraudster posing as an employee from a courier company.
The caller falsely claimed that a parcel belonging to the victim had been damaged during transit and instructed them to switch to WhatsApp to contact customer service and arrange compensation.
The fake customer service representative initially asked the victim to provide a payment QR code to receive the funds but later claimed the code was invalid.
To appear legitimate, the scammer stated that the logistics company was covered by insurance and sent an unfamiliar link, directing the victim to apply for compensation through a fraudulent website.
Victim tricked into paying off credit card balance before scammers vanished
After navigating to the fake website, the victim was asked to provide personal details along with the last four digits of their phone number.
The scammers then sent a forged compensation approval document, claiming the refund was ready for processing. The bogus customer service agent instructed the victim to download and install an unknown Android package (APK) file to receive the money.
Once the application was installed, the scammer told the victim to enable the Near Field Communication (NFC) function on their mobile phone and hold their credit card firmly against the back of the device.
This allowed the malicious software to read the card's data and effectively transformed the smartphone into a point-of-sale terminal, allowing the fraudsters to remotely execute unauthorized overseas transactions in the background.
When the credit card limit was maxed out, the fraudsters convinced the victim to settle the balance immediately, promising that all funds would be reimbursed together later.
Once the victim cleared the bill, the scammers carried out another round of unauthorized overseas transactions until the credit limit was exhausted once more.
The scammers then cut all communication, leaving the victim with financial losses exceeding HK$1 million.
