Fake customer service scams surge with NFC phone trick

Summary

Key Points

• Police said fake customer service scams accounted for about 17% of all fraud cases and about 13.3% of total losses recorded in the first eight months.14
• Message-based fake customer service cases rose from about 40 a month in January to July to more than 80 in August, with August losses at HK$12 million.14
• Phone-call fake customer service cases averaged about 440 a month in January to July, then jumped to about 1,600 in August, with losses of HK$210 million.124
• In the biggest phone scam case, a 53-year-old housewife lost HK$4.46 million after entering a fake verification code as a transfer amount on online banking.124
• In the biggest message-linked case, a 74-year-old businessman lost HK$3.4 million after calling a fake courier service number and providing bank account details.14
• Police said scammers typically pose as insurance, financial services, membership operators, logistics firms or e-commerce platforms, claiming a premium is due, a membership will auto-renew, or a parcel is damaged, lost or being held. Victims are then told to call a supposed service hotline or are contacted directly by phone, before being moved to WhatsApp or other messaging apps for further manipulation.124
• According to police, the fraudsters often use video calls, screen sharing and even remote control to build trust and direct victims through so-called verification, refund or cancellation procedures. In one common tactic, victims are told to add a designated account as a new payee and enter a so-called verification code into the transfer amount field, resulting in a real transfer to the scammer.1234
• Police said the newer NFC-based method emerged from August after public awareness of phishing text messages improved. In these cases, scammers send malicious application files through WhatsApp or WeChat, persuade victims to approve permissions, then ask them to switch on NFC and place a credit card against the back of the phone, allowing the card to be misused remotely.123
• Chief Inspector Wong Cheung-hing (黃長興) of the Cyber Security and Technology Crime Bureau said scammers may show forged approval papers, shipment documents or limited personal information to appear genuine. Superintendent Hui Yee-wai (許綺惠) said the overall fraud picture was relatively stable, but fake customer service scams had risen clearly in recent months.14
• Police said nearly half of the victims in these cases were aged 31 to 50, though all age groups could be targeted. They urged the public not to use contact details provided in suspicious messages, not to share screens or verification information with strangers, and not to perform credit-card tapping operations after installing unknown apps.24
• The Office of the Communications Authority said that, by the end of August, more than 880 companies and public or private organisations had joined the SMS Sender Registration Scheme. Registered senders use names beginning with a hash sign, and the public can check the approved list online.23
• The regulator also said telecom networks automatically block suspicious messages that use a hash-prefixed sender name without authorisation. It added that some scam messages beginning with a hash sign had been sent through illegal mobile devices using 2G technology, but said 2G services had disappeared from the market since June and users of older phones should update software and disable 2G.23

Why It Matters