Police reports recorded 1,993 WhatsApp account-hijacking cases in Hong Kong from January to July 2026, with reported losses exceeding HK$140 million. The cases rose substantially from the same period a year earlier, although the supplied reports gave different growth rates. Police issued a warning about the scams in late August.
Most hijackings begin with phishing messages pretending to come from WhatsApp or a security centre. The messages warn that an account will be suspended, frozen or penalised, then direct recipients to fraudulent websites. Victims may be asked for their phone numbers, verification codes or an eight-digit pairing code, allowing criminals to link the account to another device.
Once in control, scammers can inspect chat histories and imitate the account holder’s language. They then approach friends or relatives through the hijacked account and ask them to make transfers or payments.
The reports included individual losses of more than HK$10 million. In one case, a finance manager transferred more than HK$12 million after receiving instructions that appeared to come from a superior’s hijacked account. In another, a victim transferred more than HK$10 million after receiving voice messages purportedly from the victim’s father. Police said the voice may have been generated using artificial intelligence and deepfake technology.
The published figures differ in scope and amount. One report said police recorded 2,020 hijackings involving instant-messaging accounts, with WhatsApp making up 99 per cent; two other reports gave 1,993 WhatsApp cases. Reported losses were variously described as more than HK$140 million, HK$146.3 million or HK$150 million. The reports also cited different year-on-year increases, ranging from 154 per cent to 170 per cent or more than double.
Police advised people to verify unexpected payment requests through another communication channel, avoid suspicious links and QR codes, and never share verification codes. They also urged users to check recipient-account details carefully before transferring money.
The Anti-Scam Scameter was reported to have identified more than 180 suspicious WhatsApp accounts. Police said the information would be passed to telecommunications operators for interception and warning messages.