The Hong Kong Monetary Authority (HKMA) issued a public alert Wednesday warning residents about a fraudulent website impersonating Alipay Financial Services (HK). The scam site tries to trick users into handing over sensitive financial information.
How the scam works
The fake website mimics the look and feel of the legitimate Alipay Financial Services platform. Victims might land on it through phishing emails, social media links, or search engine ads. Once there, they're prompted to enter login credentials, banking details, or other personal data—the kind of information crooks can use to drain accounts or commit identity theft.
The HKMA said it's not a hack of Alipay's real system. The fraud relies on deception, pure and simple. Alipay Financial Services (HK) is a stored value facility operator licensed by the HKMA, so any official communication would come through verified channels.
What the HKMA is telling people
In its short statement, the regulator stressed that no financial institution—Alipay or any other licensed operator—would ever ask customers to provide sensitive details through a website link sent by email or text. It urged anyone who's clicked the fake site to contact their bank immediately and report the matter to the police.
The HKMA didn't name the exact domain of the fraudulent website, saying only that it's now aware of the threat and is coordinating with relevant parties. It also didn't say how many people might have fallen for it.
Similar alerts on the rise
This isn't the first such warning from the HKMA this year. The regulator has issued several alerts about bogus banking websites and phishing scams targeting e-wallet users. Hong Kong's rapid adoption of digital payments—Alipay alone serves millions of local users—makes the city a tempting target for fraudsters.
The pattern is always the same: create a near-identical copy of a trusted brand's login page, then drive traffic to it. Once a user enters their password and OTP, the scammer has full access. The HKMA's job is to shut those sites down fast, but prevention still falls on the user.
What you can do
The best defense? Type the official Alipay Financial Services URL manually into a browser. Don't click links from emails or texts. Double-check the website's address bar for subtle misspellings or extra characters. And if something feels off, stop—then call the company's official hotline.
The HKMA has a dedicated page listing all stored value facility licensees, including their authorized websites. Anyone doubting a site's legitimacy can check it there.
As of now, no arrests have been reported, and the fraudulent website may still be online. The HKMA says it's working with law enforcement to take it down. Users who spot suspicious activity should report it to the HKMA's hotline and the police's anti-scam unit.
