The number of commercial e-mail fraud cases rose more than four times in the year to September compared with the same period last year, with victims suffering a record HK$113 million in losses, an eight-fold increase.
In the largest cyber scam this year, a Middle Eastern company was conned out of HK$16 million, believing it was dealing with a mainland business partner.
Fraudsters would hack into the e-mail accounts of targeted companies in an attempt to understand their businesses, police said. They would then send e-mails to those companies, impersonating their trading partners, to ask for payment.
Intelligence showed most of the hacking and e-mail activity originated in Africa, police said.
"The e-mails used to contact and cheat the victims were sent out from Nigeria," a police source said yesterday. "Scammers even visit Hong Kong to set up shell companies, open bank accounts and handle crime proceeds."
Police said the perpetrators were also from Lebanon, mainland China and South Asian countries and belonged "to sophisticated international syndicates that target companies worldwide."
The Commercial Crime Bureau investigated 281 reports of e-mail fraud in the first nine months, up from 67 cases in the same period last year. The total losses incurred rose from HK$14 million to HK$113 million.
The rise witnessed in Hong Kong was part of a "global trend in this new type of technology crime," said Chief Inspector Chan Chi-yung, of the bureau's technology crime division.
Hong Kong police are co-operating with overseas law enforcement agencies in an effort to track down the hackers.
Fraudsters pass themselves off as the business partners of companies by imitating their e-mail correspondence. Victimised companies are fooled into thinking they are dealing with authentic business associates and send payments to a bank account controlled by the hackers.
To hinder contact with the real trading partners, the scammers tell the victims that their e-mail addresses had been changed. Chan urged companies to verify changes to bank and e-mail accounts.
Police said local firms accounted for about 40 per cent of the victims this year, while the other 60 per cent comprised overseas companies that reported losses when they found their funds had been diverted.
In most of the cases, the scammed amounts were below HK$500,000, police said.
Chief inspector Fanny Kung Hing-fung said: "Because the transactions involved less than half a million dollars, some companies might let down their guard and fail to verify with their business partners."
Senior Inspector Hui Kong-kit, who is part of a task force set up in April to fight commercial e-mail fraud, said that up to September, his squad had arrested 18 people and frozen HK$20 million in crime proceeds.
He noted that some local secretariat and accounting firms were helping e-mail fraudsters set up bank accounts in the city. Such firms might be guilty of aiding and abetting money laundering, he warned.
Police also noticed a slight change in the mode of operation recently.
In one case, e-mail hackers deceived the secretary of a company boss into transferring HK$8.7 million into four bank accounts when he was out of town.
In another case, scammers used the MSN account of a company to fleece its business partner of HK$580,000.
Online shopping scams rose to 550 in the first nine months from 424. The amount involved rose to HK$4.05 million this year from HK$3.95 million last year.
Police will set up a cybersecurity centre by the end of the year to combat technology crime.