Hong Kong police have warned of a rising trend of fraudsters posing as tech support staff to carry out a cyber scam targeting expatriate and English-speaking residents, with victims losing more than HK$17 million (US$2.2 million) in the last two months.
Scammers would place pop-up ads with flashing alerts and loud alarms, claiming that victims’ computers were attacked by malware, said Superintendent Baron Chan Shun-ching of the force’s cybersecurity and technology crime bureau at a press briefing on Monday.
“The ads take up the entire screen and cannot be closed, causing victims to think their browser was really locked, so they would panic and call the so-called tech support hotline,” he said.
“Individuals posing as tech support staff would tell victims their computers have been hacked and their personal data and bank information is at risk.
“Scammers would redirect victims to so-called law enforcement officers who would use different excuses to manipulate victims to transfer funds to mule accounts.”
Chan said this scam was common in the West and Singapore, with more scammers targeting Hong Kong residents in recent months.
The fraudsters posing as tech support staff and law enforcement officers mostly communicated in English and targeted foreigners living in Hong Kong or residents proficient in the language, he added.
The force has received 12 reports of these technical support scams in the past two months, involving over HK$17 million.
May*, an expatriate in Hong Kong, lost nearly HK$10 million last month to fraudsters, the single largest such case yet.
The retired human resources personnel in her 70s said a warning claiming her computer was under attack popped up on her computer screen last month while she was browsing for travel information.
“A loud noise and flashing colours erupted from my screen and an alert popped up on my screen saying ‘do not shut down or do anything except to call Apple security’,” she said.
“The alert seemed urgent and official. Being accompanied by the ongoing loud noise and flashing colours on the screen, it was a relief to be offered a solution.”
She was prompted to call a number claiming to be a support hotline, where a man named Gary Watson posing as an Apple staff told her hackers had “corrupted her computer completely”.
A man calling himself Edward Jones and who claimed to be a police officer then contacted May and said a Trojan horse virus had been installed on her computer and nine hackers from five countries had already stolen her data.
“I saw my computer being operated by another person, impersonating me to increase my credit limit and set up accounts on nine cryptocurrency platforms,” she said.
“When I probed Edward about his identity, I was presented with websites purported to be from the Hong Kong Police Force.”
Over three days, May said Jones told her to authorise bank transfers, terminate her fixed deposit account and transfer her money to her savings account to “protect her funds from hackers”.
“Gary asked me to use my phone camera for facial recognition and take photos of my identity card and credit card, supposedly to protect my money,” she said.
She then discovered swindlers had made unauthorised transactions on her credit card and added three new payees to her bank account.
May was contacted by police on the third day over concerns about her bank account after the lender fagged the volume of transactions to the force.
Superintendent Chan said that the identity of the scammers was still under investigation and would not rule out the possibility that they were based overseas.
“Pop-ups on the different websites can customise content relevant to the victims, for example, providing a Hong Kong phone number for the tech support hotline,” he said, adding that placing ads on a variety of websites allowed scammers to cast a wide net to bait victims.
Chan Chi-wing, senior inspector of the cybersecurity and technology crime bureau, reminded residents that law enforcement officers would never request monetary transfers or ask for financial details.
“If your computer displays an alert message, you can press the Escape key, or the Ctrl +Alt+Del keys to launch the task manager to close the problematic page,” he said.
He also warned the public against downloading any applications that could grant a third-party complete control over computer operations.
The force logged 10,060 cases of online scams in the first five months of 2024, 14 per cent down from the 11,700 cases in the same period last year.
*Name changed to protect the victim’s identity
