Key Takeaways
- For a company, the real risk is not one infected laptop: it is a stolen email or WhatsApp account used to request payments, or one staff password that opens shared files and the bank portal.
- Phishing is a message that pretends to come from someone you trust so you click a link, type a password or code, or send money.
- Phishing was 5,305 of the 8,358 incidents HKCERT handled in Hong Kong from January to June 2026, or 63%.
- Two habits stop most cases: never type a code or password into a link someone sent you, and confirm every payment change by phone on a number you already have.
A staff member receives a water bill reminder with a payment link. The logo and wording match the Water Supplies Department. Thirty seconds later, the company credit card details are on a criminal's server.
What is phishing?
Phishing is a scam in which a criminal sends a message pretending to come from a trusted bank, government department, colleague or app, so that you click a link, open a file, type a password or one-time code, or transfer money. Think of it as a fake security guard politely asking for your office keys.
In Hong Kong it is the single largest type of cyber incident. According to the Hong Kong Computer Emergency Response Team Coordination Centre's mid-year review published 31 August 2026, phishing made up 5,305 of the 8,358 incidents HKCERT handled from January to June 2026, or 63%.
How does a phishing attack work?
Most phishing follows the same path. The attacker copies a trusted brand, gives you an urgent reason to act, sends you to a fake page or file, collects whatever you type, and then uses it within minutes to log in, take over the account or move money before anyone notices.
A Hong Kong example: the fake water bill
In March 2026 HKCERT warned of messages titled "Water Account Information Update Notice". The links used look-alike addresses such as "wsdbg" and "wsdio" and led to a fake payment page asking for phone and card details. Related cases more than doubled from February to April 2026, according to HKCERT's mid-year review.
- Bait: the message copies a real brand's logo, tone and timing, such as tax season, bill cycles or parcel notices.
- Pressure: a short deadline or a threat makes you act before you think.
- Trap: a link opens a look-alike website, or an attachment asks you to "enable content".
- Capture: you type a password, card number or one-time code, and the attacker receives it instantly.
- Use: the attacker logs in, changes the recovery details and messages your colleagues or clients from your account.
What are the main types of phishing?
Phishing is named after the channel it uses or the person it targets. Email phishing is the classic form, but in Hong Kong most cases now arrive through messaging apps, SMS, QR codes and fake websites, and the most costly attacks are written for one finance or management role.
| Type | How it reaches you | Typical Hong Kong bait |
|---|---|---|
| Email phishing | Mass email with a link or attachment | Bank, Microsoft 365 or courier notices |
| Spear phishing | Email written for one person or role | A fake director asking finance for an urgent transfer |
| Smishing | SMS text message | Tax refund, water bill, parcel fee |
| Messaging app phishing | WhatsApp, Telegram, social media | "Account locked, scan this QR code to unlock" |
| Quishing | QR code on paper, a poster or an email | Parking fine, restaurant booking, Wi-Fi login |
| Vishing | Phone call or voice message | Fake bank or customer service hotline |
| ClickFix | Fake CAPTCHA or error page | "Paste this command to prove you are human" |
Messaging apps are now the main battleground. HKCERT's first-half 2026 figures show social media and messaging apps were the target in 46% of phishing cases, with WhatsApp impersonated in 1,435 cases, about three times Telegram (557). Banking, finance and payment services followed at 17%.
How can you spot a phishing message?
Look for urgency combined with a request: a deadline plus a link, a code, a file or a payment. Then check the sender's real address or number and every letter of the website address. Real banks, government departments and WhatsApp do not ask you to unlock an account through a link.
- The sender address or number does not match the organisation, or the domain is slightly misspelt.
- A short deadline: "account suspended in 24 hours" or "final notice".
- A request for a one-time code, a password, card details or a QR code scan.
- A shortened link, or link text that hides the real address.
- A new bank account, changed payment details or "please keep this confidential".
- A page that asks you to paste a command into Windows Run or Mac Terminal.
If you are unsure, do not reply. Look up the organisation's number yourself, or check the link, phone number or payment account on the police Scameter search engine.
How do you prevent phishing?
Prevention has two layers. Individuals should turn on multi-factor authentication (MFA, a second check beyond the password), switch on built-in scam filters and never type codes from links. Companies should add a payment call-back rule, protect their email domain, keep software updated and train staff with realistic tests.
For individuals: settings to switch on today
- iPhone, filter unknown SMS: Settings → Apps → Messages → Unknown & Spam → turn on Filter Unknown Senders.
- iPhone, Safari warnings: Settings → Apps → Safari → turn on Fraudulent Website Warning.
- Android, SMS spam filter: Google Messages → your profile icon → Messages settings → Spam protection → turn on Enable spam protection.
- Android, browser protection: Chrome → ⋮ → Settings → Privacy and security → Safe Browsing → Enhanced protection.
- WhatsApp on both phones: Settings → Account → Two-step verification → Turn on, then check Settings → Linked devices every week.
Menu paths last checked in November 2026 for iOS 18 and later and current Android versions. On older iPhones, Messages and Safari sit directly under Settings, and some Android brands label menus slightly differently.
For SMEs and IT teams
- Turn on MFA for email, cloud storage and online banking, preferably with an authenticator app or passkey rather than SMS codes.
- Set up email authentication (SPF, DKIM and DMARC) so criminals cannot easily send email in your company's name.
- Keep browsers, operating systems and website plug-ins updated.
- Run a realistic phishing simulation and briefing at least once a year, and again after a large hiring round.
The company scenario: a fake boss asks for a transfer
The finance clerk receives a WhatsApp message showing the director's photo and name: "In a meeting. Pay HK$180,000 to this new supplier today. Don't call." The account may have been hijacked, or it may be a new number using the same photo. Either way, the money leaves unless a rule stops it.
Company rule: any new payee, changed bank account or urgent transfer must be confirmed by calling a number already on file, never the number in the message, and approved by a second person.
Copy-and-paste staff notice
Team reminder on phishing:
1. Never type a password or verification code into a link someone sent you.
2. Payment request or bank detail change? Call the person on the number we already have before acting.
3. Strange message from IT, the bank or the boss? Do not reply. Send a screenshot to [IT contact].
4. Already clicked? Tell us now. No blame, speed matters.What should you do if you clicked a phishing link?
Act within the first hour. Disconnect the device, change the affected password from a different device, sign out all other sessions, call your bank if you entered card or banking details, then report it. Speed matters more than blame, because criminals usually use stolen details within minutes.
- Stop: disconnect the device from Wi-Fi if you opened a file or pasted a command.
- Secure: from another device, change the password, turn on MFA and sign out all other sessions; check WhatsApp Linked devices.
- Bank: if you entered card or banking details, call your bank's hotline immediately to block the card or stop the transfer.
- Report: call the police Anti-Scam Helpline 18222 (24 hours), and report to HKCERT on 8105 6060 or through its incident report form.
- Warn: tell colleagues and clients not to act on messages from the affected account.
- Privacy: if customer or staff personal data may have been exposed, consider notifying the Privacy Commissioner for Personal Data (PCPD) and the people affected.
Hotline numbers checked on the Anti-Deception Coordination Centre and HKCERT websites on 4 November 2026.
Phishing targets people, so protect the process
Phishing borrows trust that already exists. No filter catches everything, so combine a few settings with a payment process that does not depend on anyone spotting a fake in time.
60-second self-check
- MFA is on for company email and online banking.
- WhatsApp two-step verification is on and Linked devices shows only your own devices.
- Every staff member knows the payment call-back rule.
- Everyone knows who to tell, and the 18222 number, if they click.
- Staff have seen a realistic phishing example in the last 12 months.
Find out who in your team would click
HKCERT urges organisations to strengthen staff ability to recognise suspicious messages. A simulated phishing test built around your own departments and workflows shows where the gaps are, followed by on-site training led by local security specialists.
Frequently Asked Questions
Is it dangerous just to open a phishing email?
Opening a message on an updated device is usually low risk. The danger comes from clicking links, opening attachments, scanning QR codes or typing details, so delete it and report it instead of interacting.
Can multi-factor authentication stop phishing?
It stops most password-only theft, but criminals can still trick you into reading out a one-time code. Authenticator apps with number matching, or passkeys, resist phishing much better than SMS codes.
Is phishing a crime in Hong Kong?
Yes. Phishing for money or data can be prosecuted under offences such as fraud and obtaining access to a computer with dishonest intent. Report cases to the police through 18222 or the e-Report Centre.
Must I tell the Privacy Commissioner if phishing leaks client data?
Data breach notification to the PCPD has been voluntary in Hong Kong, but the PCPD recommends notifying it and affected people promptly. Check the PCPD's latest guidance, as reforms have been proposed.