In recent times, malicious actors have been impersonating customer support staff from major platforms. They send text messages urging users to "synchronize their account to a Hong Kong site" to steal their assets.
Please note that no legitimate platform operates an official "Hong Kong site." If you encounter any such links, do not click on them. Never enter your account information or verification codes on unfamiliar websites, and certainly do not transfer any assets if instructed to do so by an unknown party.
How the Scam Operates
How do these scammers carry out their deception? Let's break down their process.
Step 1: The Bait
Scammers send a text message that mimics an official platform notice. It instructs users to click a link to synchronize their account with a purported "Hong Kong site."
Step 2: The Fake Website
Users are directed to a counterfeit website that closely resembles the official platform. Here, they are prompted to enter their account credentials. The scammers then request immediate identity verification under the pretext of "ensuring fund security."
Step 3: The Illusion of Failure
After users complete the verification, the fake site claims the process failed for various reasons. A fake customer support agent then provides a wallet private key and instructs the user to convert all their assets into USDT and transfer them to this wallet within 10 minutes.
Step 4: The Theft
Once the assets are moved to the scammer's wallet, they are immediately stolen, resulting in significant financial loss for the victim.
Although this scam scheme isn't overly complex, it is highly deceptive. Here's why it works:
- Sophisticated Packaging: Scammers invent false regulatory policies to induce panic, making users more likely to fall for the trap. The phishing site is designed to look nearly identical to the official platform, complete with multiple verification steps that create an illusion of professionalism and security.
- Misuse of Wallet Basics: By having users import a wallet using a provided private key, scammers exploit a common knowledge gap. Many beginners mistakenly believe that setting a password means they control the wallet. In reality, whoever holds the private key has full control over the assets. Scammers use this to their advantage.
How to Protect Yourself
No matter how clever the scam, staying vigilant and informed can protect you from most fraud attempts. Here are essential tips to avoid falling victim to such phishing scams.
1. Avoid Clicking Unknown Links
Legitimate platforms will never send you unsolicited links via private message. They won’t ask you to deposit, withdraw, transfer funds, or log in through an unofficial website. Refrain from clicking or scanning any links, QR codes, or files from unverified sources. Never enter your account passwords or verification codes on untrusted sites.
2. Verify Official Channels
If you receive a call, message, email, or link claiming to be from an official source, always verify it through the platform’s official channels. Use the in-app customer support feature or visit the official website directly. In chat support, look for verified official badges. If someone claims to be official but lacks verification, do not trust them.
👉 Learn how to verify official platforms
3. Safeguard Your Private Keys
Never share your passwords, private keys, seed phrases, or Keystore files with anyone. Prefer physical backups, like writing them down on paper, over digital methods. Avoid transmitting sensitive data through messaging apps, email, or taking screenshots.
4. Act Quickly If Compromised
If you suspect you’ve entered a phishing website, contact platform support immediately. If you’ve been scammed, cease all transactions, preserve all chat and transaction records, and report the incident to the police without delay.
Frequently Asked Questions
What is a phishing scam?
Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity. Scammers often use fake websites, emails, or messages to trick users into revealing login credentials or transferring assets.
How can I identify a fake website?
Check the URL carefully—official websites use secure connections (https://) and correct domain names. Look for slight misspellings or unusual characters. When in doubt, navigate directly to the platform’s official site rather than clicking provided links.
What should I do if I accidentally shared my private key?
Immediately transfer your assets to a new, secure wallet if possible. Then, revoke any permissions linked to the compromised key and contact your platform’s support team for further assistance.
Why do scammers ask for asset transfers?
Scammers instruct victims to transfer assets to wallets they control. Once the assets are moved, they are irreversibly stolen. This is why you should never transfer funds based on unsolicited requests.
Are there tools to help verify official channels?
Yes, most reputable platforms provide official channel verification pages or in-app features. Always use these resources to confirm authenticity before taking any action.
What makes this scam convincing?
The use of fake policies, professional-looking websites, and multi-step verification processes can make the scam appear legitimate. Always double-check through official sources to avoid being deceived.
Staying informed and cautious is your best defense against phishing attacks. Always prioritize security and verify any unusual requests through official channels.