Xin Zheng'er - WhatsApp Account Hijacking Prevalent: Don't Impulsively Transfer Money Over Excuses | Editorial

Published time: 02:00 2026-10-02 HKT

Over the past week, the police received about fifty reports of 'WhatsApp account hijacking' scams, with total losses approaching HKD 20 million. In one case, the victim, mistakenly trusting a message from a 'business partner,' transferred 2 million Tether coins, resulting in a loss of about HKD 15 million. At the same time, the Sheung Shui Women's Association under the Family Planning Association of Hong Kong also discovered that its WhatsApp account had been hacked, requiring a report to the police and notification to the Privacy Commissioner. Placing these two news items side by side reveals a harsh reality: the technical threshold for fraudsters is decreasing, while public awareness and defensive measures are far behind.

Looking closely at the 'Internet Guardians' breakdown of the hijacking process by the police, the method is not complicated—sending a random message, fake customer service, fake verification process, stealing an eight-digit code, and logging in with another device. The entire script targets not system vulnerabilities, but human habits. When victims receive transfer requests from 'partners,' they often skip verification due to trust; when receiving instructions from 'customer service,' they comply by entering verification codes out of urgency to solve the problem. Scammers understand human nature well: fear, trust, and haste are all gaps easier to exploit than passwords.

The Family Planning Association incident further reminds us that institutional accounts are equally vulnerable. With many members in women’s associations, once an account is hijacked, scammers can send messages to members under the guise of being 'official,' requesting personal information or money. The institution's reputation, invisibly, becomes an endorsement for the scammers. While post-incident apologies and reviews are certainly necessary, what is even more important is prevention beforehand—regularly checking connected devices, strengthening staff training, and sending clear warnings to members are all indispensable.

Facing endless scams, how should citizens protect themselves? First, remain vigilant toward any WhatsApp messages and do not let your guard down just because the sender is a 'familiar person.' Second, when someone asks for personal information or to enter a password for verification, you should first refuse, hang up, stay calm, and then verify through official channels. Third, any message requesting immediate transfer of funds without verified identity should never be complied with; always double-check with a phone call. Fourth, download anti-fraud apps to stay informed about the latest scam tactics.

However, relying solely on citizens to help themselves is not enough. Regulatory agencies and communication platforms must take on greater responsibility. WhatsApp's 'linked devices' feature was originally designed for convenience, but it has been repeatedly exploited by fraudsters. Should the platform implement stricter secondary verification? Can telecom operators intercept suspicious verification code forwarding? Can banks and cryptocurrency wallets introduce cooling-off periods for unusually large transfers? These issues cannot forever remain at the level of 'urging citizens to be careful'; various sectors need to push for changes to strengthen society's anti-fraud firewall.

Xin Zheng'er