Hong Kong’s privacy watchdog warns against WhatsApp account ‘hijacking’ as data of 900 people exposed in 1 month

Hong Kong’s privacy watchdog has warned the public against WhatsApp account hijacking after receiving several reports of data breaches within the past month.

social media apps smartphone instagram twitter facebook — Social media apps on a smartphone. Photo: Tracy Le Blanc/Pexels.

The incidents, involving five social welfare services groups and schools, resulted in the exposure of 900 people’s personal data, the Office of the Privacy Commissioner for Personal Data (PCPD) said in a statement on Thursday. Among the details disclosed were the names and mobile numbers of service users, as well as those of students, students’ parents, and staff.

Ada Chung, privacy commissioner for personal data, said on RTHK on Friday that scammers were randomly selecting WhatsApp accounts to hijack, adding that the public should be more cautious when receiving messages from strangers and take measures to secure the privacy of their online accounts.

According to the PCPD, swindlers will often pose as a WhatsApp user’s friend or relative and ask them to forward the registration codes of their WhatsApp accounts.

They also use use fake WhatsApp websites to obtain mobile phone numbers and WhatsApp registration codes.

Civil servant HKG — People were walking near the central government offices. Photo: Kyle Lam/HKFP.

A new scamming technique called “SEO poisoning” has also emerged, police said on their Cyber Defender social media page. By improving search engine optimisation (SEO) or paying for advertising, scammers are able to get fake WhatsApp websites to the top of search results. If people scan the QR codes from these websites, their data will be breached.

The police warned the public to be aware of sponsored posts that appear at the top of search results, and to always call the person involved to confirm their identity if they receive messages from friends or relatives asking to borrow money.

Following incidents of WhatsApp account hijacking, PCPD suggested enabling two-factor authentication, regularly checking linked devices in WhatsApp settings, and logging out of any devices that are no longer in use.

Fraud-related crime surged

Hong Kong has seen 58,453 crime cases in the first eight months of this year, a 34.6 per cent increase compared with the same period last year.

The security chief Chris Tang said in late September that the rise was attributed to a 52.2 per cent year-on-year spike in fraud-related crime, including e-commerce and phone scams.

Phone fraud rose by 73.6 per cent compared with the same period last year, averaging 272 cases per month, Tang said.