Police have issued a fresh warning over a sharp rise in WhatsApp account hijacking scams, stressing that a recent dip in total monetary losses should not be mistaken as improved security.

The force said it had handled 1,993 such cases between January and July, up 170 percent year-on-year. The seven-month figure already eclipsed the total of 1,669 last year.

Victims this year reported aggregate losses of HK$146.3 million. While that was down 22.7 percent from the same period in 2025, authorities warned against complacency.

Most victims suffered losses ranging from a few thousand to tens of thousands of dollars. But some were conned out of millions of dollars, or even more than HK$10 million.

Chief Inspector Alvin Wong, from the Cyber Security and Technology Crime Bureau, said the scammers relied on a simple trick.

"We found that is nothing related to any new technology used by the scammer, they use the same technology by sending the phishing SMS," he said.

"WhatsApp's got a very large market share in Hong Kong and is commonly used by Hongkongers, and that's why the WhatsApp hijacking is the most market share in our hijacking cases."

Wong said that victims would receive a text message claiming their account was about to be suspended or had a problem, and they must act immediately or face a penalty.

Users who clicked on an embedded hyperlink would then expose their accounts to scammers, allowing them to access chat histories, impersonate trusted contacts, and eventually seek payments under different disguises.

Police urged the public to avoid accessing suspicious links or QR codes, or sharing verification codes. Before transferring money, users must also scrutinise the recipient's account, and treat unfamiliar e-wallet or third-party requests as major red flags.

WhatsApp owner, Meta, said it is devoted to fighting fraud, with AI tools deployed to detect suspicious activity.

Philip Chua, the company's Asia‑Pacific policy director for products, said that account hijacking was especially serious.

He said the breach allowed criminals to gather personal information and compromise more accounts, setting the stage for "potentially more criminal activity down the road".

Chua stressed that the fraudsters' tactics will keep evolving, but the overriding message for users is simple: be alert, think twice, and double-check through other platforms before taking any action.

On the technology front, he noted that AI is already helping Meta proactively remove accounts and block suspicious device linking.



Edited by Raymond Yeung