Deep Dive: Scams are increasing in Hong Kong, but the law can’t keep up

One Sunday afternoon in June, May Lee* received eight phone calls. They were from people who claimed to be the customer support staff from WeChat, the Chinese app that does everything from social media to investments.

The callers claimed that Lee’s credit cards and bank account had been frozen. They said it was because she gave incorrect information when she tried to cancel an insurance policy on WeChat. To free her account, she had to raise the limit on the amount of money she was allowed to transfer daily to HK$1 million (US$128,000). The callers also said she had to make a few money transfers to prove her identity.

In an effort to look real, the callers attached many photographs and documents, such as certifications by China’s securities watchdog.

They were all fake. It was all a lie to trick Lee into sending money to a scammer. After four hours of phone calls, Lee was out HK$570,000.

Lee was the victim of a phone scam called Authorised Push Payment fraud. In Britain, a new law coming into effect on October 7 will make the bank involved pay her back for this type of fraud.

But that’s not the case in Hong Kong. Lee, an office worker in her early 30s, cannot get her money back. This is because she authorised the payment, even though it went to a scammer’s account. “I was so surprised that my bank did not send a single alert to me,” Lee said.

Scams nearly doubled in value last year in Hong Kong to HK$9.18 billion. The number of cases jumped 42.6 per cent to 39,824. This puts the city of 7.5 million people at the top of the world in per-person losses from fraud.

Lee’s frustration shows how Hong Kong’s banking and financial rules have failed to keep up with fraudsters. This is partly because banks try to balance privacy with making things easy for their customers.

The Hong Kong Monetary Authority oversees the city’s 149 licensed banks. It has introduced a number of anti-scam measures. However, they are being introduced slowly, and banks and social media networks are not legally required to find and eliminate fraud. A cybercrime law remains a work in progress.

“Hong Kong is lagging in enacting laws to fight scams,” said Johnny Ng Kit-chong. He is a lawmaker in Hong Kong’s legislature and the founder of a group that works to warn people about fraud.

Staff writers

1. Which of the following statements about scams in Hong Kong are true?

(1) Hong Kong banks allow customers to recover money lost in scams, even if they authorised the push payment
(2) A new law in Hong Kong means banks will have to repay people in the event of fraud.
(3) Commercial banks must balance customer privacy and convenience with protection against scams.
(4) There is no cybercrime law currently on the books in Hong Kong.

A. (1), (2) only
B. (2), (3) only
C. (1), (4) only
D. (3), (4) only

2. Based on News, how is Hong Kong behind in enacting laws to fight scams?

3. To what extent do you agree that May Lee should be repaid for the money she lost in the scam? Explain using News and your own knowledge.

1. Identify and explain TWO key trends from the graph.

2. Based on News, Issue and Graph, what are some reasons for these changes/what has contributed to them/word this in some way like this.

Watchdog: a group that monitors the activities of another individual, corporation, non-profit group, or governmental organisation on behalf of the public to ensure there is no illegal or unethical behaviour.

Authorised Push Payment fraud: also called APP fraud, it is a scam in which criminals manipulate their victims into making payments or sharing personal details under false pretences. They may pose as a legitimate business or a government body to win a victim’s trust. These scams are called “authorised” because they depend on the victim voluntarily transferring money.

cybercrime: illegal activity that targets or uses a computer or a computer network. Most cybercrime is committed to make money.

1. D

2. Although the HKMA has rolled out some applications and measures to fight fraud, they are small measures. Banks and social media networks are not legally required to look out for fraud, and no cybercrime law is on the books. Banks are also not required to repay customers who fall victim to the common Authorised Push Payment fraud.

3. I think Lee’s bank should repay her the money she lost, especially since she claims that her bank did not send her an alert before she authorised the push payment. The scammers created a scheme to trick her, including using security certifications to look real, and the bank should have been the last line of defence against these scammers. (answers may vary)

1. The number of cases has risen dramatically over the last five years, possibly due to the advance of AI technology. The amount of money lost in scams nearly doubled from 2022 to 2023, the biggest jump in a one-year period, according to the graph. (accept all reasonable answers)

2. I have received messages from numbers I don’t recognise and ones that ask me to click on a link. I ignore them because I don’t know where they come from. (accept all reasonable answers)