As the Easter holiday approaches, many citizens are turning to online platforms to purchase festive goods and book party supplies. However, cybercriminals are also seizing this opportunity, creating numerous phishing websites and false promotional messages to steal consumers' personal information and assets.
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) recently reported an increase in incidents involving hackers creating counterfeit websites that impersonate second-hand trading platforms like Carousell. These fraudulent sites lure users into completing purchases. When users select "bank transfer" on the payment page, they are redirected to a fake banking payment interface. This page closely mimics the official interface of local banks, prompting users to enter their bank account numbers, login passwords, and even SMS verification codes. Since the entire process is embedded within the trading platform, consumers may mistakenly believe it to be a legitimate payment procedure, leading to the exposure of sensitive financial information.
The fake pages switch to designs mimicking the victim's chosen bank. For example, if a victim selects a specific bank for the transfer, the webpage automatically loads an interface that matches the bank's official colors, logos, and form fields to create confusion. There have been cases where victims entered their online banking passwords on these counterfeit pages, only for the fraudsters to immediately use the stolen information for multiple high-value cross-boundary transactions.
Additionally, scammers employ techniques such as "spoofed official notifications" and "multi-URL redirection," significantly enhancing the misleading nature of their fraudulent messages. They send disguised WhatsApp messages via SMS, requesting account verification. These messages use shortened URLs to mask the actual domain, displaying links like "t.ly/wsapps-hk" that do not reveal the true target URL. Once clicked, the displayed page completely imitates the WhatsApp account verification process, demanding users to input their account information.
Consumers are urged to remain vigilant during this festive season, avoiding suspicious links and verifying the authenticity of websites before entering any personal or financial information.
Related News:
Fake Facebook pages and phishing links lead online scam surge
SF HK abandons SMS amid scam surge, moves to App pick-up notifications
Comment