HKCERT Urges Public to Remain Vigilant Against Recovery Scams Impersonating HKCERT

(Hong Kong, 27 May 2025) HKCERT has identified a recent trend of criminals impersonating our organisation to commit recovery scam. These scammers proactively contact previous fraud victims, falsely claiming they can help trace stolen funds, where their true intention is to defraud the victims again. HKCERT urges the public to remain vigilant against anyone claiming to be able to recover stolen funds.

What is a Recovery Scam?
In the past, scammers have impersonated authoritative organisations such as the Hong Kong Police Force, Anti-Deception Coordination Centre, and law firms to conduct recovery scams. Scammers typically contact previous victims through social media platforms such as Facebook, WhatsApp, and Telegram, claiming they have traced or would be able to recover stolen funds.

In some cases, scammers target victims’ personal information, bank account details and passwords to gain unauthorised access to bank accounts. In other cases, the scammers may request a guarantee or application fee. Due to the sunk cost fallacy, victims may be willing to pay these fees in hope of recovering their previous loss.

Recent Cases
HKCERT has recently identified a new type of recovery scam where scammers obtained a list of previous scam victims, including names, phone numbers and amount of financial loss. First, the scammer (Scammer-A) contacts a previous victim through WhatsApp, claiming to be a fellow scam victim, who is gathering other scam victims to collectively seek assistance. Scammer-A establishes credibility by accurately providing the victim’s personal information and financial loss. After a few days, Scammer-A claims to have found a method to track stolen funds and invites the victim to a WhatsApp group, disguised as a legitimate “Scam Asset Recovery Program”. Another scammer in the WhatsApp group (Scammer-B), who impersonates a technical expert from HKCERT appointed by Hong Kong Monetary Authority, claims to be able to recover the stolen funds.

Scammer-B requests copies of their identification documents of the victim, such as HKID card, passport or driver’s license. Subsequently, they provide a counterfeit “Certificate of Asset Recovery” issued from “Hight Court of Hong Kong” (misspelling of “High Court of Hong Kong”).

Scammer-B then claimed to have tracked the stolen funds, along with crime evidence, identity of the “original scammer” and associated IP address. The victim is instructed to create a bank account on a specific web platform allegedly used by the “original scammer” for money laundering, supposedly to facilitate fund recovery.

Based on past recovery scam patterns, the account creation process likely requires additional personal information from the victim that could be used for blackmail or future scams. Victims may also be asked to pay guarantee, application, or processing fees to retrieve the “recovered funds”.

HKCERT has immediately reported the fraudulent account and this incident to the operator of the instant messaging platform, but we anticipate scammers will continue to develop new deceptive methods. To protect yourself from these fraudulent activities, HKCERT recommends the public to take the following security measures:

1. Do not trust anyone who claims to be able to recover stolen funds. Visit a police station to report your case and seek legitimate assistance.
2. Stay vigilant of all suspicious payment requests, emails, or text messages. If in doubt, verify directly through official channels. For example, contact hkcert@hkcert.org to confirm the identity of anyone claiming to representing HKCERT.
3. Use “CyberDefender” to identify fraud and cyber traps by checking email addresses, URLs, and IP addresses, or call the Hong Kong Police Force Anti-Deception Coordination Centre “Anti-Scam Helpline 18222” for assistance.
4. Enhance your cyber security awareness and stay informed about new fraudulent tactics and preventive measures.

- Ends -