Phishing Alert - Beware of Phishing Activities Leading to Unauthorised Credit Card Transactions
Phishing Alert
Current Status and Related Trends
mickmick.net has noted recent reports involving a large number of Hong Kong residents whose credit cards were allegedly used in unauthorised online purchases of electronic products. According to media reports, the Police received more than 700 related reports within a short period, involving approximately HK$14.7 million in losses. Some affected individuals indicated that they had not conducted the transactions in question, while others reported that no additional payment authentication notifications had been received.
The root cause of the incident remains under investigation by the relevant organisations. While there is currently no evidence suggesting that any particular bank, payment platform or merchant system has been compromised, the incident highlights how cybercriminals may exploit payment information obtained through phishing websites, phishing messages, malware, account compromise or previously leaked data to conduct unauthorised transactions.
Attack Analysis
Cybercriminals may obtain credit card information through the following methods:
1. Phishing Websites
Attackers create fraudulent websites impersonating banks, payment service providers, e-commerce platforms or logistics companies to trick victims into submitting:
Credit card numbers
Expiry dates
CVV security codes
One-time passwords (OTPs)
Once obtained, the stolen information may be used to conduct unauthorised transactions.
2. Phishing Messages and Emails
Attackers distribute fraudulent SMS messages and emails impersonating banks, merchants or courier services, claiming that:
Unusual account activity has been detected
A payment has failed
Payment information needs to be updated
A refund or reward is available
The objective is to persuade victims to disclose their payment information.
3. Data Breaches
If victims have previously entered their credit card information on third-party websites or online services that subsequently suffer a data breach, the exposed information may be sold or reused by cybercriminals to carry out unauthorised transactions.
4. Malware and Information-Stealing Software
Compromised devices may be infected with information-stealing malware capable of collecting:
Credit card details stored in web browsers
Autofill information
Online banking credentials
Digital wallet information
The stolen information may subsequently be used for fraudulent activities or unauthorised transactions.
Potential Impact
Individuals may face the following risks:
Unauthorised credit card transactions
Identity theft and misuse of personal information
Further account compromise
Financial losses
Adverse impacts on credit and account management
Businesses and service providers may also face:
Loss of customer confidence
An increase in fraud and chargeback disputes
Reputational damage
Recommendations for the Public
Regularly review credit card statements and transaction records; enable real-time transaction alerts; and pay attention to any unauthorised transactions.
Do not submit payment information via SMS messages, emails or social media platforms. Only make payments through trusted and legitimate websites.
Stay vigilant against phishing attacks and avoid clicking links contained in SMS messages or emails without verification.
Verify the authenticity of message senders and be alert to suspicious messages impersonating banks, payment platforms or merchants.
If any suspicious transaction is identified, immediately freeze or suspend the affected credit card, contact the card issuer, retain relevant records and notifications, and report the incident to the Police.
Only make purchases through official websites or trusted merchants, and avoid storing credit card information on unknown or less reputable platforms.
Avoid making online payments or entering sensitive payment information when connected to public Wi‑Fi networks.
Recommendations for Organisations and Businesses
Strengthen monitoring and detection of suspicious transaction activities.
Regularly review the security controls of payment systems.
Continue providing anti-phishing and cybersecurity awareness training.
Establish incident response procedures for data breach incidents.
Enhance customer authentication and verification mechanisms.
