SIM Swap Scams in Hong Kong
How SIM hijacking in Hong Kong enables attackers to bypass banking OTPs and drain HKD accounts via faster payment systems.
Part of: SIM Swap Scams
Last reviewed: 1 June 2026
SIM swap fraud in Hong Kong enables criminals to intercept SMS one-time passwords used by Hong Kong banks, e-wallets, and FPS (Faster Payment System), gaining access to accounts before victims notice their phone has lost service. The concentration of high-value banking accounts in the city makes successful SIM swaps disproportionately damaging.
Hong Kong carriers have introduced additional safeguards, but fraudsters have adapted by combining social engineering with personal data obtained from phishing and data leaks to circumvent standard verification.
How this scam works on Hong Kong
Attackers compile personal data on targets — HKID number, date of birth, account details — through phishing websites mimicking Hong Kong bank portals or through dark-web purchased data. They then contact mobile carriers by phone or attend carrier stores claiming to need an emergency replacement due to a lost or damaged SIM.
Once the swap is completed, the attacker resets bank app passwords using the newly routed SMS OTPs. FPS transfers are made to mule accounts immediately — often in multiple small transactions to stay below alert thresholds. The victim notices the attack only when the phone shows no network service.
Because Hong Kong's banking infrastructure is highly interconnected with phone-verified accounts, a single SIM swap can compromise multiple bank relationships simultaneously.
Common red flags
- Phone suddenly shows no network service without a known outage
- You receive carrier messages about SIM changes or port requests you did not initiate
- Banking app login fails or shows recent activity you do not recognise
- FPS payment confirmation messages arrive for transactions you did not make
- Email password reset notifications arrive from linked banking email accounts
How to protect yourself
- Add an account PIN or security word at your carrier store (3HK, CSL/HKT, China Mobile HK, SmarTone) for SIM changes
- Use a banking security token or authenticator app rather than SMS OTP where your bank offers this
- Set up transaction alerts for all accounts and monitor for small unexplained transfers
- Regularly review all FPS registered contacts on your banking apps
How to report it
- Call your carrier helpline immediately to freeze and reverse the SIM swap — 3HK: 3033 3033, HKT: 1000, SmarTone: 2880 2688
- Call your bank's fraud line and request an immediate account freeze and FPS transaction recall
- Report to Hong Kong Police Cyber Security and Technology Crime Bureau and call ADCC at 18222
Frequently asked questions
Can Hong Kong banks reverse FPS transfers made after a SIM swap?
Banks can attempt to recall FPS transfers but success depends heavily on how quickly you report — the sooner you call, the better. If the recipient account is with a Hong Kong bank, inter-bank coordination through HKICL may allow a freeze. Report immediately to both your carrier and your bank, then file with Hong Kong Police so that a formal investigation can support the recall process.