Double 11 Shopping Rush Arrives HKCERT Urges Public to Beware of Scams Throughout the Online Shopping Journey and Merchants to Strengthen Cybersecurity

(Image created using generative AI and reviewed under professional human supervision.)

(Hong Kong, 6 November, 2026) As the Double 11 shopping rush gets under way, online shopping scams can strike at every stage of the customer journey, and consumers should remain vigilant even after completing a payment. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) reminds the public to stay alert not only to fake online shops, fraudulent social media pages and bogus offers, but also to scams involving payment, delivery, refunds and customer service.

According to HKCERT’s latest figures, 8,764 phishing cases involving 84,312 phishing links were recorded between January and October 2026, representing an increase of approximately 75% compared with the same period in 2025. Looking at the distribution of phishing cases in October, social media remained the primary target of phishing attacks, accounting for over 40% of all cases. E-commerce and E-payment together accounted for approximately one-quarter of the total cases.

Three High-Risk Stages to Watch During Double 11
1. Before Ordering: Fake Online Shops, Fraudulent Social Media Pages and Impersonated E-commerce Platforms

Scammers may use heavily discounted products, limited time offers or rewards to lure consumers to fake online shops, fraudulent social media pages and websites impersonating e-commerce platforms, before stealing their personal and payment details, or inducing them to transfer money directly to designated accounts.

HKCERT recently detected phishing websites impersonating Fortress, offering “exclusive deals” for completing a questionnaire and exceptionally low-priced products to entice consumers to place orders, with the aim of stealing their personal and payment details.

Image: Fake Fortress phishing website using discounted products to lure users into providing personal and payment information

Some fraudulent websites go further by replicating the entire transaction process of an e-commerce or online service platform, including product pages, order details, payment options and customer service interfaces, to appear more credible. HKCERT has also recently observed suspicious websites misusing the Klook brand and imitating transaction pages for services such as dining reservations and concert tickets. While these websites can look highly convincing, the giveaway often lies in the web address: the primary domain used by the fraudulent website does not match that of the official platform.

Image: Fake Klook website directing users to make payment via FPS

Image: Fake Klook booking and payment page

HKCERT reminds the public not to judge a website’s authenticity solely by its design, brand logos or product information. Before making a purchase, consumers should carefully check the full web address and the merchant’s contact details, and wherever possible access shopping pages directly through the official website or app.

2. When Paying: Fake Payment Pages
Payment platforms are also frequently impersonated by Scammers. They may create a sense of urgency by claiming that an account has unusual activity, a payment has failed, a transaction requires re-verification, or an account has been restricted or needs to be unlocked. Users are then instructed to visit an external website, contact a designated “customer service” representative, or submit account and payment details.

HKCERT has recently observed phishing websites impersonating PayPal and AlipayHK. Some fake AlipayHK websites use warning about “abnormal receiving account risk” to pressure users, claiming that their accounts could face service suspension, agreement termination or freezing, and instructing them to contact a so-called “customer service assistant” to unlock their accounts. AlipayHK has also warned the public about phishing websites impersonating its brand and reiterated that it will not proactively request sensitive information or payments from users through text messages, emails or websites.

Image: Fake AlipayHK phishing page claiming an account anomaly

3. After Shopping: Fake Delivery Notifications and Customer Service Scams
Completing a payment does not mean the risk is over. Consumers waiting for a parcel or refund may be more susceptible to scams that exploit the context of a genuine purchase.

Fake Delivery Notifications
When consumers are waiting for a parcel, messages claiming that “parcel delivery has failed”, “incomplete address”, “delivery needs to be rescheduled” or “additional payment required” can appear particularly convincing. Scammers may impersonate logistics companies, couriers or parcel collection services and use such claims to trick users into reconfirming their addresses and making payments, with the aim of stealing personal and credit card details.

HKCERT has recently received reports of phishing websites impersonating 7-Eleven’s E-Service Shipping and Pickup Services website which lured users into submitting personal information. In other cases, fake SMS messages impersonating SF Express claim that a parcel has been delayed or that repeated attempts to contact the recipient have failed, and direct the recipient to call a fake customer service number.

Image: Fake 7-Eleven parcel delivery service website

Image: Fake SF Express SMS message claiming a parcel delay

HKCERT reminds the public that, even if a message arrives at a time that coincides with an online purchase, this does not mean it comes from a genuine merchant or logistics company. Consumers should log in to the shopping platform directly to check order, delivery and payment records, or make enquiries through the relevant organisation’s official website, app or customer service channels.

Fake Customer Service
Scammers may also impersonate customer service representatives, citing an order issue, failed payment or a refund as a pretext to move users away from the original platform and onto another communication channel. They may then ask users to verify their identity, make another payment, remove account restrictions or process a refund, before requesting bank or credit card details, one-time passwords, or even money transfers.

Hong Kong Police Force’s Anti-Deception Coordination Centre also reminded the public to stay alert to scams involving scammers impersonating Taobao and Pinduoduo customer service representatives. Scammers may claim that a parcel has been lost or goods have been damaged and offer compensation, before inducing victims to click on phishing links, log in to fraudulent websites, or complete a purported “transfer verification”. The public should note that online banking and the Faster Payment System (FPS) do not offer any “transfer verification” function. Entering a purported “verification code” in the transfer amount field as instructed will in fact transfer the corresponding amount directly to the scammers.

The public should also beware of fake customer service scams involving “automatic renewal” or “service cancellation”. Recent examples include SMS messages impersonating PayPal and Google, that direct recipients to call fake customer service numbers to cancel an alleged renewal or subscription charge.

Image: Fake PayPal and Google SMS messages involving automatic renewal or subscription charges

HKCERT reminds the public that, whether the stated reason involves delivery, a refund, verification or cancellation of charges, consumers should stop immediately and verify independently through official channels if asked to leave the official platform to submit sensitive personal information or one-time passwords, download an app, or make an upfront payment.

AI Makes Fraudulent Content Harder to Identify
Artificial intelligence (AI) is making it easier for attackers to create convincing fraudulent content, changing the way phishing and social engineering attacks are carried out. Attackers can rapidly produce fraudulent messages tailored to local contexts and communication styles, including bank notifications, courier text messages and messages impersonating online shopping platforms using AI, making the content appear more authentic and personalised.

As AI makes fraudulent content increasingly convincing, natural-sounding language, familiar brand logos and professional-looking interfaces are no longer sufficient indicators of authenticity. HKCERT reminds the public that the focus should shift from “Does it look trustworthy?” to “Has it been verified through an official channel?” and encourages consumers to adopt a “verify first, act second” approach.

Merchants and Individual Sellers Must Also Stay Vigilant to Cyber Threats and Transaction Scams 
Consumers are not the only ones who need to stay alert during the Double 11 shopping rush. As transaction volumes and website traffic increase, e-commerce platforms, online shops and retailers must also pay attention to cyber security risks involving system vulnerabilities, account security, service disruptions, brand impersonation and third-party services.

HKCERT has identified supply chain vulnerabilities and third-party security gaps as one of the major enterprise cyber security risks for 2026, noting that even businesses with robust security measures may face knock-on effects if a third-party partner suffers an attack or has a security vulnerability.

Merchants should also be alert to brand impersonation. Even where fake e-commerce platforms, payment pages and customer service scams do not result from a compromise of the merchant’s own systems, consumers may mistakenly believe that fraudulent websites or messages are official. Businesses should therefore proactively monitor websites, social media accounts and suspicious domains impersonating their brands, and clearly communicate their official websites, apps and customer service channels.

HKCERT recommends that e-commerce platforms and online shops prioritise the following protective measures during peak shopping periods:

• Protect accounts: Enable multi-factor authentication (MFA) for back-end, administrator and other important accounts, and restrict unnecessary administrative privileges.
• Protect systems: Update e-commerce platforms, servers, plug-ins and other internet-facing systems to reduce the risk of known vulnerabilities being exploited.
• Ensure service continuity readiness: Review website capacity, redundancy and incident response arrangements, and prepare for potential scenarios, such as denial-of-service attacks, that may affect website availability.
• Protect the supply chain: Review access permissions, security measures and incident notification mechanisms for payment, logistics, cloud and other service providers.
• Protect the brand: Watch for fraudulent websites, fake social media accounts and bogus customer service representatives. Report them and issue alerts promptly when detected, and clearly communicate official websites, apps and customer service channels to consumers
• Establish incident response procedures: Define responsibilities, internal and external contact arrangements, and service recovery procedures in advance, rather than making ad hoc arrangements after a cyber security incident occurs.
   

Online shopping scams do not target buyers alone. Individual sellers on second-hand trading platforms are also at risk. HKCERT continues to receive reports of phishing websites impersonating Facebook Marketplace and Carousell. Fake pages may claim that “the buyer has paid”, prompting sellers to click “Receive Payment” and submit personal information for so-called “identity verification”. Some also redirect sellers to fake bank login pages to steal their login credentials.

Image: Fake Facebook Marketplace website luring sellers into submitting personal information for identity verification

Image: Fake Facebook Marketplace website luring sellers into fake bank login pages

Sellers should log in directly to official trading platforms and their bank accounts to verify transactions and confirm that funds have actually been received. They should not rely solely on payment screenshots or payment collection links as proof of payment, nor enter banking login credentials or one-time passwords through links provided by the other party.

HKCERT Urges the Public to Remain Vigilant During and After Double 11
The key to avoiding online shopping scams is to make “verify first, act second” a habit at every stage, from browsing offers and making payments to delivery and after-sales support.

• Verify offers first: Visit official websites or apps directly to check offers and promotions. Do not rush to submit information because of countdown timers or low-stock alerts.
• Check web addresses carefully: Do not trust a web address simply because it contains a brand name. Check the full domain name, and avoid accessing payment pages through links in unfamiliar text messages, search advertisements, social media or instant messages.
• Verify payments: Before paying or transferring money, check the merchant or recipient, the amount and the purpose of the transaction. If someone claiming to represent a branded merchant asks for payment to a personal account, verify the recipient’s identity first.
• Keep verifying after purchase: If you receive a notification about delivery, a refund, unusual account activity or automatic renewal, open the official website or app yourself to check order, delivery and payment records. Do not act directly through links or “customer service hotlines” provided in the message.
• Protect your accounts: Use different, strong passwords for online shopping, email and payment accounts, and enable multi-factor authentication (MFA) and transaction notifications where supported.
• If you suspect that you have submitted sensitive information or made a suspicious transaction, stop communicating with the other party immediately, notify the relevant bank or payment service provider as soon as possible, and retain website screenshots, messages and transaction records. If in doubt, call the Police Anti-Scam Helpline on 18222 for advice.
   

Businesses and members of the public can report cybersecurity incidents to HKCERT using the online incident reporting form: https://www.hkcert.org/form/ or by calling its 24-hour hotline on (852) 8105 6060. For other enquiries, email hkcert@hkcert.org.

- Ends -