Following the devastating Wang Fuk Court blaze in Tai Po, Hong Kong, criminal syndicates are capitalizing on public sympathy by deploying sophisticated phishing scams disguised as charitable donation drives. These fraudsters are circulating SMS messages impersonating government entities, falsely notifying recipients of a purported HK$5,000 automatic donation to a “Red Cross Fund,” and then directing victims to fake hotlines and fraudulent websites designed to steal bank credentials. Authorities are urging extreme caution, emphasizing that government bodies and legitimate charities do not solicit sensitive financial data via unsolicited messages or high-pressure tactics.
Anatomy of a Sophisticated Scam
The scam initiates with a text message that spoofs the sender name as “GovHK.” Screenshots reveal the message, often employing simplified Chinese characters and a nine-digit contact number, claims that HK$5,000 will be deducted that day for victims of the Wang Fuk Court disaster. The immediate goal is to cause alarm and prompt the recipient to call the provided number, labeled as a “24-hour hotline.”
A local reporter investigating the scheme found the hotline staffed by Putonghua-speaking operators who employed elaborate deception. One operator claimed the organization placed advertisements on news sites, asserting that clicking these ads automatically detected a reader’s bank details and initiated an automatic donation. To reverse the supposed charge, the operators coached the caller through a complex process involving multiple transfers and platforms, designed to confuse and create a sense of urgency.
The intensity of the deception escalated when the reporter was guided to communicate via WhatsApp with a supposed “Promotion Unbinding Centre.” During this exchange, the terms changed: the one-time donation morphed into a recurring HK$5,000 monthly charge for a year. Operators even invoked a supposed partnership between a “national banking centre” and the Hong Kong Monetary Authority (HKMA) to justify these automated debits.
Phishing for Banking Credentials
Ultimately, the core objective of the scam is data theft.
After multiple frustrating transfers, the reporter was directed to a website branded with UnionPay logos and titled the “UnionPay Cancellation and Unbinding Centre.” Francis Fong, honorary president of the Hong Kong Information Technology Federation, analyzed the domain, noting it was newly created and flagged as unsafe by security tools.
“The site is clearly a phishing page,” Fong confirmed. “Its design, with largely non-functional buttons and pages demanding bank account numbers and passwords, is intended solely to harvest banking credentials or prompt the download of malware capable of remote device control.”
Operators specifically coached the reporter on how to interact with the third-party platforms to ensure the “refund” could be processed, providing complicated instructions to explain the payment as made “by mistake while reading the news.”
Recognizing and Reporting Fraud
The Hong Kong Police Force confirmed that these text messages originate from fraud syndicates, and the Anti-Scam Helpline tool has already flagged the associated numbers as high risk.
The public must remain vigilant against these tactics:
- Never Click Dubious Links: Do not click on links in unsolicited messages, regardless of the purported sender.
- Government Policy: The police reiterate that the government will never use SMS messages to solicit sensitive personal or financial information, nor will they demand transfers via non-official channels.
- Protect Credentials: Never disclose bank account numbers, passwords, or login details over the phone or on unverified websites.
Any text claiming automatic deductions or demanding immediate action to cancel a payment should be treated as suspicious. If you receive one of these messages, report it immediately to the Hong Kong Police Anti-Scam Helpline at 18222. Protecting vulnerable disaster victims and the wider public requires collective caution against these opportunistic criminal enterprises.