HKCERT has noted recent reports involving a large number of Hong Kong residents whose credit cards were allegedly used in unauthorised online purchases of electronic products. According to media reports, the Police received more than 700 related reports within a short period, involving approximately HK$14.7 million in losses. Some affected individuals indicated that they had not conducted the transactions in question, while others reported that no additional payment authentication notifications had been received.
The root cause of the incident remains under investigation by the relevant organisations. While there is currently no evidence suggesting that any particular bank, payment platform or merchant system has been compromised, the incident highlights how cybercriminals may exploit payment information obtained through phishing websites, phishing messages, malware, account compromise or previously leaked data to conduct unauthorised transactions.
Cybercriminals may obtain credit card information through the following methods:
Attackers create fraudulent websites impersonating banks, payment service providers, e-commerce platforms or logistics companies to trick victims into submitting:
One-time passwords (OTPs)
Once obtained, the stolen information may be used to conduct unauthorised transactions.
2. Phishing Messages and Emails
Attackers distribute fraudulent SMS messages and emails impersonating banks, merchants or courier services, claiming that:
Unusual account activity has been detected
Payment information needs to be updated
A refund or reward is available
The objective is to persuade victims to disclose their payment information.
If victims have previously entered their credit card information on third-party websites or online services that subsequently suffer a data breach, the exposed information may be sold or reused by cybercriminals to carry out unauthorised transactions.
4. Malware and Information-Stealing Software
Compromised devices may be infected with information-stealing malware capable of collecting:
Credit card details stored in web browsers
Online banking credentials
Digital wallet information
The stolen information may subsequently be used for fraudulent activities or unauthorised transactions.
Individuals may face the following risks:
Unauthorised credit card transactions
Identity theft and misuse of personal information
Further account compromise
Adverse impacts on credit and account management
Businesses and service providers may also face:
Loss of customer confidence
An increase in fraud and chargeback disputes
Recommendations for the Public
Regularly review credit card statements and transaction records; enable real-time transaction alerts; and pay attention to any unauthorised transactions.
Do not submit payment information via SMS messages, emails or social media platforms. Only make payments through trusted and legitimate websites.
Stay vigilant against phishing attacks and avoid clicking links contained in SMS messages or emails without verification.
Verify the authenticity of message senders and be alert to suspicious messages impersonating banks, payment platforms or merchants.
If any suspicious transaction is identified, immediately freeze or suspend the affected credit card, the card issuer, retain relevant records and notifications, and report the incident to the Police.
Only make purchases through official websites or trusted merchants, and avoid storing credit card information on unknown or less reputable platforms.
Avoid making online payments or entering sensitive payment information when connected to public Wi‑Fi networks.
Recommendations for Organisations and Businesses
Strengthen monitoring and detection of suspicious transaction activities.
Regularly review the security controls of payment systems.
Continue providing anti-phishing and cybersecurity awareness training.
Establish incident response procedures for data breach incidents.
Enhance customer authentication and verification mechanisms.
Businesses or members of the public who wish to report to HKCERT on information security related incidents such as malware, phishing, denial of service attacks, etc. can do so by completing the online form at: , or calling the 24-hour hotline at +852 8105 6060. For further enquiries, please HKCERT at [email protected] .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
