Police alert as WhatsApp scams rise

The police have reminded people to pay attention to WhatsApp hijacking scams after it recorded 1,366 cases of online account hijacking in August and September, resulting in a total loss of HK$28.2 million.

More than 95 percent of these cases occurred on the WhatsApp platform, according to the Cyber Security and Technology Crime Bureau.

The largest online account hijacking case this year involved a loss of up to one million renminbi (HK$1.07 million).

In addition to the common phishing SMS methods used for account hijacking, the police discovered a new conning strategy in September, known as search engine optimization poisoning.

SEO poisoning involves scammers creating fake WhatsApp login pages and placing advertisements on search engine platforms.

When users search for WhatsApp, the fake website appears. The users are then prompted to scan a malicious QR code.

Once scanned, the scammers gain access to the user's account information to deceive their friends and family for money.

"Scammers typically leverage the conversations and content in victims' account contacts to borrow money from or conduct transfers with their relatives and friends," said Chan Chi-wing, senior inspector of Cyber Security and Technology Crime Bureau.

A scammer sent a message to a client from a victim's contact list, who frequently engaged in business transactions, claiming that the exchange rate for renminbi that day was favorable.

The scammer persuaded the client to exchange renminbi for him. The client transferred one million renminbi in two transactions to two mainland accounts.

Subsequently, the victim realized his WhatsApp account had been compromised when he had a conversation with this client via WeChat.

In September last year, the police launched the Scameter to assist the public in identifying fraud. People can enter relevant information in the Scameter when encountering suspicious phone calls and websites to assess the risks of fraud.

By the end of this year, the Scameter database will be linked to the Faster Payment System platform.

This helps identify suspicious accounts, which enables an alert message to appear on the screen of the transfer confirmation page.

When receiving monetary transfer requests through text messages on social media, it is essential to double confirm the request, the police cautions.

The police recommends that people regularly check the devices linked to their accounts, log out of unfamiliar devices, pay attention to abnormalities, and avoid connecting to a public WiFi network or logging into accounts on public computers.