Deep Dive: Scams on the rise in Hong Kong thanks to technology and lack of regulations

One Sunday afternoon in June, May Lee* received eight phone calls from people who claimed to be the customer support staff from WeChat, the Chinese app that does everything from social networking to investments.

The callers claimed that Lee’s credit cards and bank account had been frozen because she had provided inaccurate data when she tried to unsubscribe from an insurance policy on WeChat’s wealth management platform. To free her account, she had to raise her daily remittance limit to HK$1 million (US$128,000) and make a handful of transfers to verify her identity, the callers said.

In an effort to look legitimate, the callers attached numerous photographs and documents, such as certifications by China’s securities watchdog.

They were all fake. The scheme was an elaborate plot to trick Lee into transferring money to a trickster. After four hours of phone calls, Lee was out HK$570,000.

Lee was the victim of a phone scam called Authorised Push Payment (APP) fraud. In Britain, a new law coming into effect on October 7 will compel the bank involved to compensate her for this type of fraud.

But that’s not the case in Hong Kong. Lee, an office worker in her early 30s, cannot recover her money because she authorised the push payment, albeit into a scammer’s account. “I was so surprised that my bank did not send a single alert to me,” Lee said.

Hong Kong students hit with employment scams as fake job listings flood their messages

Scams nearly doubled in value last year in Hong Kong to HK$9.18 billion, while the number of cases jumped 42.6 per cent to 39,824, putting the city of 7.5 million people at the top of the world in per-capita losses from fraud.

Lee’s frustration shows how Hong Kong’s banking and financial regulations have failed to keep up with fraudsters. Commercial banks must tread a fine balance between privacy and convenience for their customers.

The Hong Kong Monetary Authority, which oversees the city’s 149 licensed banks, has rolled out a number of anti-scam measures. However, these amount to piecemeal measures in a regulatory vacuum, where banks and social media networks are not legally required to weed out fraud. A cybercrime law remains a work in progress.

“Hong Kong is lagging in enacting laws to fight scams,” said Johnny Ng Kit-chong, a lawmaker in Hong Kong’s legislature and the founder of an anti-deception alliance.

Staff writers

1. Which of the following statements about scams in Hong Kong are true?

(1) Hong Kong banks allow customers to recover money lost in scams, even if they authorised the push payment.
(2) A new law in Hong Kong means people will be compensated in the event of fraud.
(3) Commercial banks must balance customer privacy and convenience with protection against scams.
(4) There is no cybercrime law currently on the books in Hong Kong.

A. (1), (2) only
B. (2), (3) only
C. (1), (4) only
D. (3), (4) only

2. Based on News, how is Hong Kong behind in enacting laws to fight scams?

3. To what extent do you agree that May Lee should be compensated for the money she lost in the scam? Explain using News and your own knowledge.

• Fraudsters are using AI to create deepfakes and impersonate government officials, celebrities to pull off hoaxes

• Cloud services, hybrid work environments have led to an increase in digital identity theft, security firm says

Online scams powered by new technologies are on the rise, and Hong Kong is particularly vulnerable as a global finance hub. The city’s police force recorded 16,182 technology-related criminal cases in the first half of the year, a 3.5 per cent increase over the same period in 2023. Losses in these cases amounted to HK$2.66 billion, according to Police Chief Superintendent Raymond Lam Cheuk-ho.

One cause for this increase is the explosion of artificial intelligence (AI), which has given rise to deepfake technology. This allows scammers to use cheaper, more accessible tools to pull off elaborate hoaxes.

The Hong Kong Police Force has recorded three cases related to the technology and discovered 21 clips using deepfakes to impersonate government officials or celebrities on the internet since last year, Hong Kong security chief Chris Tang said.

Among the three deepfake cases, one involved the loss of HK$200 million when a Hong Kong employee of a multinational design and engineering firm was fooled in a video conference call. Everyone else on the call, including a person who appeared to be the chief financial officer, was an impersonator. All fraudsters needed for the crime was publicly available video and audio.

Police also cracked down on a fraud group that sent more than 20 online loan applications that used deepfake technologies to bypass the online application process. One of the applications for a HK$70,000 loan was approved.

Another issue is digital identity theft. Classic examples of identity theft typically involve government ID numbers, credit card numbers or biological information, often used to commit fraud. The theft of digital identities is similar in that it allows fraudsters to impersonate others within computer networks. In some cases, it can be more insidious than traditional ID theft.

Digital identities are software and algorithms that are used as proof of a person’s or machine’s identity online, such as cookies that keep a user logged into platforms such as Google and Facebook. Stealing that information can allow a malicious actor to appear as someone with authorised access.

The growth of cloud services has heightened the risks of this type of cyber threat. If a system uses a single form of digital identity to verify whether users are who they say they are, it is even more vulnerable.

“There is a chance that cookies will be stolen or be exposed to the third party and they use the cookie to access other applications or in-house resources,” said Sandy Lau, district manager for Hong Kong and Macau at CyberArk, an Israeli information security provider.

Hybrid work environments and using personal devices at work may increase the risk of cyber theft, Lau added.

Staff writers

1. According to Issue, which of the following statements about fraud are true?

(1) Hong Kong has recorded a slight increase in technology-related criminal cases in 2024 compared to the same period of 2023.
(2) Hybrid work environments can help prevent the risk of cybercrimes.
(3) In a deepfake scam worth HK$200 million, fraudsters illegally obtained private video and audio to fake a conference call.
(4) If a system uses only one form of digital identity to verify users, it is more vulnerable.

A. (1), (4) only
B. (2), (4) only
C. (2), (3) only
D. (1), (3) only

2. Using News and Issue, list THREE types of scams on the rise in Hong Kong.

3. Are people in 2024 more vulnerable to online scams? Use News, Issue and your own knowledge to support your answer.

1. Identify and explain TWO key trends from the graph.

2. Have you ever received a call or text message that looked suspicious? What did you do?

AI can detect wildfires and monitor endangered birds, according to Hong Kong experts

1. What does the illustration depict about fraud prevention?

2. Based on News, Issue, and your own knowledge, suggest TWO preventive measures a person or company can take to minimise the impact of scams.

Watchdog: a group that monitors the activities of another individual, corporation, non-profit group, or governmental organisation on behalf of the public to ensure there is no illegal or unethical behaviour.

Authorised Push Payment fraud: also called APP fraud, it is a scam in which criminals manipulate their victims into making payments or sharing personal details under false pretences. They may pose as a legitimate business or a government body to win a victim’s trust. These scams are called “authorised” because they depend on the victim voluntarily transferring money.

Deepfake: photos, videos or audio that have been changed or created using technology like artificial intelligence. They are often used for malicious purposes and to spread false information.

Digital identity: a collection of information about a person, company or organisation that exists online. This could include data like a person’s usernames and passwords, search history, government identification number and online purchases.

Hong Kong researchers use drones, artificial intelligence to protect horseshoe crabs

1. D

2. Although the HKMA has rolled out some applications and measures to fight fraud, they are only piecemeal measures. Banks and social media networks are not legally required to weed out fraud, and no cybercrime law is on the books. Banks are also not required to compensate customers who fall victim to the common Authorised Push Payment fraud.

3. I think Lee’s bank should compensate her for the money she lost, especially since she claims that her bank did not send her an alert before she authorised the push payment. The scammers created an elaborate scheme to trick her, including using security certifications to look legitimate, and the bank should have been the last line of defence against these scammers. (answers may vary)

1. A

2. Authorised Push Payment (APP) fraud is a phone scam where fraudsters coerce and manipulate victims into giving sensitive information or transferring money to criminals. Deepfakes have become prevalent with the rise in AI technology. Deepfakes are convincing videos and audio that impersonate a person. Meanwhile, digital identity theft allow criminals to access a person’s information online, which includes private and personal information.

3. I do think that people nowadays are more vulnerable to scams. As mentioned in Issue, cloud services – a common tool for storing and saving personal data – have increased the risks of cyber threats. Additionally, the Covid-19 pandemic made hybrid work environments more normalised, which is a greater threat to security. Finally, as AI technology develops, it will get increasingly harder to spot deepfakes. (answers may vary).

1. The graphic shows a fraud in progress, with “social media platforms”, “regulators”, “law enforcement”, and “banks” each written on a pair of scissors. The scissors are pointing at the line connecting the scammer and the victim’s digital devices, and the idea is that any one of the pairs of scissors could sever the connection between the two and prevent the scam. The fact that the scissors have these various entities written upon them reflects the fact that each of these groups can take measures to prevent scams from happening. (Accept all similar answers)

2. Hybrid work environments, especially the use of personal devices for work, can increase the risk of cyber theft. One easy thing that people can do is use separate devices. Public awareness and education can help prevent scams and crimes before they are committed. Not only will this help the public be more aware, but bringing these problems to light will prioritise police crackdowns on scams, as mentioned in Issue. (Accept all reasonable answers)

1. The number of cases has risen dramatically over the last five years, possibly due to the advance of AI technology. The amount of money lost in scams nearly doubled from 2022 to 2023, the biggest jump in a one-year period, according to the graph. (accept all reasonable answers)

2. I have received messages from numbers I don’t recognise and ones that ask me to click on a link. I ignore them because I don’t know where they come from. (accept all reasonable answers)