Privacy watchdog records 558 data scam inquiries in first half of 2026, up 16pc

Hong Kong’s privacy watchdog received 558 inquiries regarding suspected personal data breaches in the first half of the year, representing a 16 percent increase from the same period last year.

Speaking at a public seminar titled "Preventing Online Scams and Staying Safe on Messaging Apps and Social Media," Privacy Commissioner for Personal Data Ada Chung Lai-ling highlighted recent credit card fraud involving unauthorized iPhone purchases.

Merchant flaws fuel credit card fraud

The police have received around 1,200 reports linked to the incident, with total losses reaching HK$25 million. In one case, a victim’s card was fraudulently charged more than 10 times, totaling HK$110,000.

Chung attributed the security breaches to merchant websites failing to implement transaction safety mechanisms, such as one-time passcodes or mobile app authorizations. 

This allowed scammers to execute unauthorized purchases using only the credit card number and the card verification value (CVV) security code.

She advised residents to contact their banks immediately to freeze or disable their cards upon discovering any abnormal transactions.

Organized by the Hong Kong International Data Privacy Academy under the Office of the Privacy Commissioner for Personal Data, the seminar aimed to foster public scam awareness and promote safe habits on social media and messaging platforms.

Chung said the office logged 1,163 inquiries regarding suspected personal data harvesting last year, while the 558 cases in the first half of this year marked a rise from 481 in the same period last year.

She also noted that the watchdog received 28 inquiries or complaints regarding fake electronic visa websites between June and August. 

Victims submitted identity documents, passport details, and their children’s information to fraudulent websites, with some suffering losses ranging from hundreds to several thousand dollars.

Customer service impersonation & platform hacks

Between February and late August, the office recorded 48 inquiries or complaints concerning scammers impersonating the customer service staff of home appliance retailers. 

Fraudsters claimed purchased products were defective and offered refunds or replacements, demanding handling fees, security deposits, or credit card details. Chung said citizens can verify such claims by contacting retailers directly.

In addition, an online shopping platform was hacked last month, exposing the names, addresses, emails, phone numbers, and order details of more than 33,000 customers. The watchdog has received two related inquiries, while the police logged six reports with losses surpassing HK$300,000.

Messaging account hijacking reaches critical levels

Messaging platform hijacking remains a severe threat, with more than 2,000 WhatsApp account takeover cases recorded in the first seven months of the year, averaging more than HK$21.4 million in monthly losses.

The primary tactic involves phishing SMS messages requesting WhatsApp verification codes. Police recently arrested a scammer who used fake base stations to transmit 6,000 fraudulent messages over four days, tricking recipients into entering eight-digit pairing codes that granted the scammers instant access to their accounts.

Chung shared two notable cases, including a mother who transferred HK$10,000 after a scammer impersonating her daughter requested urgent tuition fees, and a victim who lost more than HK$10 million after fraudsters used artificial intelligence (AI) voice cloning to impersonate his father, requesting emergency business funds through repeated transfers.

She urged the public to enable WhatsApp two-step verification, regularly review linked devices, never share passwords or verification codes, avoid unverified websites, download applications solely from official app stores, and call family members or companies directly to verify suspicious messages.

𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱 𝗧𝗵𝗲 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱 𝗔𝗽𝗽 ↓