A 48-year-old man has become the biggest victim of a WhatsApp scam in Hong Kong after being defrauded of HK$430,000 (S$74,000) in four hours.
Initial investigation showed the scammer hijacked the WhatsApp account of the victim's elder sister and used her account to send him text messages and lure him into buying points cards for online games, according to law enforcement sources.
"The victim was told he could make a profit by buying the points cards and selling them," one source said.
The Hong Kong man, who works as a customer service officer, first received the text message soon after 2pm on Wednesday.
In a period of four hours, the victim made more than 50 transactions that were paid in cash and credit cards in a convenience store on Castle Peak Road, Tuen Mun. He also gave all the PIN codes for the cards to the swindler, who posed as his sister.
He realised it was a scam when he contacted the sister. He then called police at 6.16pm on the same day.
"He was told his sister was unable to use WhatsApp after her account was hijacked," the source said.
Detectives from the Tuen Mun criminal investigation unit were handling the case. So far, no one has been arrested.
Another source believed the man was the biggest loser in a rash of WhatsApp scams that have hit the city in recent time. The source said most victims have lost thousands to tens of thousand dollars each.
In the first 10 months of 2018, police handled 540 reports of deception with the total losses of HK$4.9 million (US$625,000) in which fraudsters posed as users of instant messaging services such as WhatsApp to lure victims to buy points cards or top-up cards for online games. In the biggest case, the victim lost HK$300,000 (US$38,000).
The WhatsApp scam first came to the attention of police in November in 2017 when fewer than 10 cases were reported. The number soared to about 30 the following month. In the first three months of 2018, there were 245 cases with losses totalling about HK$1.9 million (US$242,000).
The surge prompted the police in April to warn the public and urge WhatsApp users to set up a two-step verification process on their accounts.
With two-step verification, users must enter a personal identification number as well as the verification code to reset their accounts.
According to police, swindlers usually pretend to be friends of WhatsApp users and invent different excuses to lure them into revealing their account verification codes. The con men then access the accounts with the codes and, posing as the users, send text messages to deceive the account holders' contacts.
Police said most of the victims were lured into buying MyCard points cards for online games. MyCard is a digital payment platform. Users can buy the cards from convenience stores across the city. After getting the passwords for the cards, scammers can sell them online.
This was first published in South China Morning Post.