A voice message came from his Wu’s fathers WhatsApp Account. The voice matched his fathers exactly. It had the same speech patterns as his dad and the same urgency his busy father often had when he needed to close a business deal.
His father needed HK$1 million (about $127,000) wired into a business friends account. Since he was the senior manager at his fathers company, he didn’t give it another thought and quickly wired the money.
The problem? It was all a fraud. His father never sent that message. It was a perfect AI clone. Scammers had hijacked the account, and Hong Kong police warn the fraudsters behind this wave may be using artificial intelligence to clone the voices of family members.
Over 150 Reports To Hong Kong Police And Escalating
Police say Ng’s case is the worst of more than 150 WhatsApp account hijackings reported in Hong Kong in just the past two weeks, with losses topping HK$26 million, which is about $3.3 million in US dollars.
The problem is so bad they issued a major alert Wednesday with a serious message: “Do not blindly trust voice messages.”
“In WhatsApp account hijackings, scammers may use AI to fake the voices of people close to you,” the police post said.
They Drained $10 Million From Wu’s Accounts
To Ng, the scam actually worked in stages. After the first $1 million went through, the fraudsters posing as his father with more voice messages claimed the friend needed HK$2 million more, and Ng paid again.
The requests kept coming with fresh excuses and fresh bank accounts. Ng sent the money in seven transfers through Hong Kong’s Faster Payment System to three local accounts, stopping only when he told the scammers his savings had hit zero.
Then the messages stopped. Ng learned the truth only when police proactively contacted him when they started investigating. By then more than $10 million was gone from their accounts.
How The WhatsApp Hijacking Works
The hijacking starts with a simple phish. Fraudsters impersonate friends or run fake WhatsApp login pages to steal phone numbers and registration codes from victims.
There is a good blog here that you can read how the different hijacking schemes work.
Once the scammers are in the account, they start to work through the victims contacts list – focusing on family members first asking for money.
Hong Kong has seen hijacking attacks like this at scale before. Police recorded 3,137 messaging account hijackings between August and December 2023 with more than $65 million stolen, then another 864 cases in the first quarter of 2024 costing HK$20.4 million.
What has changed this time around is the voice cloning. Text messages from a hijacked account can be questioned, but a voice message that sounds exactly like someone’s father or daughter is far more believable.
This is a developing story and I will provide more details as they become available.
