HKCERT reminds the public to stay vigilant against social media identity theft

(Hong Kong, 30 April 2025) With the increasing popularity of social media, more and more users are sharing personal information on these platforms. However, this has also made social media a target for hackers and cybercriminals. Recently, media reported that the Facebook page of The Family Planning Association of Hong Kong was suspected to have been hacked, highlighting the severity of social media identity theft. Hence, the Hong Kong Computer Emergency Response Team Coordination Team (HKCERT) urges the public to stay vigilant and take necessary measures to protect their sensitive personal information against social media identity theft.

Phishing Attacks Targeting Social Platforms
Nowadays, cybercriminals often use phishing attacks to steal users' login credentials and personal information. Phishing attacks often involve sending scam emails that direct users to fake websites, tricking them into entering login or personal details. Another tactic is to hide part of a webpage's content, prompting users to enter their social media account credentials to access the full content, tricking them into providing login information.

Due to the rampant phishing attacks, users must stay vigilant every time they are asked to enter account information. Below are examples of phishing websites impersonating social media platforms. These phishing sites claim that the user's social media account has been blocked, and trick users into believing that entering their login credentials will unlock their account.

Phishing site impersonating Facebook login portal

Phishing site claiming the users’ account has been blocked

Dangers of Social Media Identity Theft

Social media identity theft refers to criminals illegally obtaining users' social media account information and using it for fraudulent activities. These activities may include:

1. Impersonation: Hackers may use stolen accounts to impersonate users, thereby gaining the trust of the user's friends or family;
2. Spreading Malicious Messages: Using stolen accounts to distribute spam or malicious links, which may lead to attacks on other users' accounts;
3. Stealing Sensitive Personal Information: Hackers may use stolen accounts to obtain users' sensitive personal information, further engaging in identity theft or other criminal activities.

How to Protect Your Social Media Accounts

To prevent social media identity theft, HKCERT recommends users take the following measures:

1. Use Strong Passwords and Avoid Reusing Them: Avoid using simple passwords, such as birthdays or letter-only combinations. Use passwords that include uppercase and lowercase letters, numbers, and symbols.Ensure not using the same password across different accounts, and change them regularly to enhance security;
2. Enable Multi-Factor Authentication: Many social media platforms offer multi-factor authentication, which enhance account security. Once enabled, even if the password is stolen, hackers will find it difficult to log into the account;
3. Be Cautious with Third-Party Apps: Limit the number of third-party applications that have access to your social media accounts. Revoke access for apps that no longer in use;
4. Stay Alert to Suspicious Links: Do not click on links from unknown sources, even if they are forwarded by friends or appear to be from well-known company websites;
5. Regularly Check Account Activity: Regularly review account login activity to ensure there are no unauthorized access attempts;
6. Install Security Patches Promptly: Hackers may exploit system vulnerabilities to invade users' accounts. Users should promptly update security patches for software on computers and mobile devices, including applications, browsers, and operating systems; and
7. Stay Vigilant: Keep up to date on phishing scams and other tactics used by hackers to protect personal and social media accounts.

How to Respond to Identity Theft

If users suspected their social media account has been stolen, take the following steps immediately:

1. Change Passwords: Immediately change passwords for all related accounts;
2. Review Account Activity: Check account login history and log out from any unknown devices;
3. Notify Platforms: Report suspicious activity to social media platforms and seek assistance;
4. Alert Friends and Family: Inform friends and family that identity theft may have been occurred to prevent them from being affected; 
5. Report to Authorities: If financial loss is involved, report to the police for criminal investigation. For personal data breaches, you can also consult or complain to the Hong Kong’s Office of the Privacy Commissioner for Personal Data.

For more information, please visit:

1. Identity Theft Protection for Social Media and Instant Messaging Accounts。
2. Protect sensitive information in the use of social media and beware of potential cyber attacks arising from data leakages
3. Comprehensive Guide to Social Media Scams: Setting up Defense to Safeguard Your Personal Information

- Ends -