Hong Kong Police: Over 150 Cases of WhatsApp Account Hijacking in Two Weeks Resulting in Losses Exceeding HK$15 Million
Hong Kong police have received reports of over 150 cases of WhatsApp account hijacking scams in the past two weeks, with involved amounts exceeding HK$15 million.
One case involved an employee of a cryptocurrency exchange company, where the scammer hijacked their WhatsApp account, blocked the original work group, and blacklisted its members. They then created a fake group that completely replicated the real group's name, avatar, and member information.
In the fake group, the scammer impersonated clients to request currency exchanges. The employee, following standard procedures, transferred cryptocurrency to a designated wallet, only to later discover that the client’s account balance was insufficient and confirmed via phone that no such request had been made, resulting in a loss of over HK$4 million for the company.
The police pointed out that while fake groups can replicate names and avatars, the member phone numbers cannot match those of the real group, and the timestamps of conversations cannot be duplicated. Similar cases have been on the rise in recent months, with some involving AI voice imitation and phishing messages.
In this incident, the scammer gained the trust of the group through account hijacking and then induced transfers using routine work processes, with the employee only realizing the anomaly after verifying external information.
From a market mechanism perspective, the incident was driven by the forgery of groups after account hijacking and cryptocurrency transfers, with funds flowing from the victim company to wallets controlled by the scammer. Cryptocurrency exchange companies are under pressure due to internal communication security gaps, while police and platforms benefit from early warning releases. However, the high losses from individual cases indicate that the enterprise-level trust chain remains easily replicable.
Supplementary information shows that the police recommend enabling two-factor authentication, verifying transfers by phone beforehand, and avoiding logging into accounts over public networks.
Source: Public Information
ABAB AI Insight
In recent months, Hong Kong police have continuously recorded a surge in WhatsApp account hijacking cases, with nearly 2,000 related incidents in the first half of 2026, resulting in losses exceeding HK$140 million. Most of these cases involve obtaining account control through phishing messages and then impersonating contacts to request funds; the recent cryptocurrency exchange case extends this method to replicate entire work groups.
From a capital perspective, after hijacking accounts, scammers establish parallel channels by using the real group's name, avatar, and member list, with funds directly transferred through cryptocurrency wallets. Their motive is to exploit routine exchange processes to reduce suspicion, turning corporate operations into immediate losses.
In comparison, this is similar to historical corporate fraud cases implemented through forged internal communication channels, such as compromised business emails or social engineering attacks. Currently, Hong Kong's cryptocurrency and fintech industry is in a high transaction volume phase, making internal instant messaging a key trust node.
The structural judgment belongs to technological substitution: account hijacking and group replication shift real identity verification to forgable interface elements, with the mechanism being that the visual consistency of social software outweighs underlying identity verification, making communication habits relied upon by enterprises an attack entry point, with the flow of funds shifting from compliant exchanges to irreversible cryptocurrency transfers.
ABAB News · Cognitive Laws
- Replicating group names and avatars is more effective than hacking accounts.
- Once daily workflows are replicated, transfer instructions lose verification.
- Cryptocurrency wallets receiving funds are harder to trace back than bank transfers.