HKEX Warns of Fraudulent Sites Using Virtual Wallets for Phishing

The Hong Kong Exchanges and Clearing Limited (HKEX) has issued an urgent public notice regarding the discovery of multiple fraudulent websites targeting digital asset users. These platforms are reportedly operating under the guise of providing security services while utilizing virtual wallets and "real-name verification" protocols to harvest sensitive personal data from unsuspecting investors. The exchange operator has alerted the public to exercise extreme caution against these sophisticated phishing schemes that mimic official financial infrastructure.

Sophisticated Phishing Tactics and Data Theft

According to the official announcement released on July 11, 2026, scammers are employing a multi-layered approach to deceive the public. The fraudulent entities claim to offer "buyer online security protection," a tactic designed to build a false sense of trust. Once a user is lured to the site, they are prompted to complete a verification process that requires the submission of:

• ID card numbers and high-resolution photographs of identification documents.
• Primary contact information, including mobile phone numbers.
• Integration with external virtual wallets for alleged transaction processing.

To further incentivize participation, these illicit platforms often promise cash rewards and financial bonuses. These incentives are used to encourage victims to perform top-up and withdrawal operations through unverified digital wallets, which allows the attackers to potentially intercept funds or compromise private keys. Such tactics are increasingly common in the decentralized finance (DeFi) space, where scammers leverage the complexity of wallet interactions to obscure their activities.

Regulatory Response and Public Safety Measures

In response to these findings, HKEX has emphasized that it does not solicit personal information or facilitate private wallet transactions in this manner. The exchange urges the public to remain vigilant against suspicious communications, including unsolicited phone calls and emails that link to external domains.

HKEX urges the public to beware of suspicious phone calls, websites, or other communications, and to report to the police as soon as possible if they suspect they have been scammed.

The rise of these "cloned" websites highlights the ongoing security challenges within the blockchain ecosystem and traditional financial intersections. Cybercriminals frequently exploit the brand reputation of major institutions like HKEX to bypass the natural skepticism of retail investors. Users are advised to verify the SSL certificates and exact URL structures of any site requesting sensitive data or wallet connectivity.

In conclusion, as the integration between traditional finance and virtual assets continues to grow in Hong Kong, the prevalence of sophisticated phishing remains a significant threat. Investors are reminded that legitimate financial institutions will never demand private security credentials or ID photos via unofficial third-party links. Those who believe they have interacted with these fraudulent sites should immediately contact local law enforcement and secure their digital assets by migrating funds to new, untainted hardware or software wallets.