Crypto scams in Hong Kong: spot them, check, report

How big is the crypto scam problem in Hong Kong?

The police crime figures for 2025, published in February 2026, counted 43,212 deception cases with losses of about HK$8.1 billion. The fastest-growing category was online investment fraud: 5,135 cases, up 30.7% on the year, with losses of HK$3.58 billion, up 58.4%. Roughly a third of that, around HK$1.18 billion, involved virtual assets. The SFC repeated the HK$3.58 billion figure when it briefed the industry on 28 September 2026.

Crypto scams in Hong Kong come in a surprisingly small number of flavours. Look through recent cases and almost all fit one of five patterns: clone sites impersonating licensed platforms; unlicensed “investment” platforms; walk-in shop and cash-handover scams; P2P trades paid with stolen money; and slow-burn “investment mentor” and romance scams that start on social media or dating apps. We go through each, then show how to check a licence and where to report.

JPEX: the lessons of Hong Kong’s biggest crypto fraud

JPEX claimed licences from the US, Canada, Australia and Dubai. It bought ads in MTR stations, paid influencers, and took deposits through walk-in OTC shops. It never held an SFC licence. The SFC put it on its Alert List in July 2022 and issued a public warning on 13 September 2023, after which withdrawals stopped. More than 2,700 investors reported losses above HK$1.6 billion.

Police went on to arrest around 80 people and freeze about HK$228 million in assets. On 3 November 2025, 16 people were charged, including influencers and OTC shop operators, with offences including conspiracy to defraud, money laundering and, for the first time, the AMLO offence of fraudulently inducing someone to invest in virtual assets. Ten more were charged on 26 March 2026, bringing the total to 26. The lesson is simple: no ad campaign or influencer endorsement replaces a two-minute licence check.

Clone websites: the dominant scam of 2026

Since JPEX, scammers have changed tactics. Rather than building their own brand, they copy one that is already licensed. Through 2026 the SFC added a steady stream of look-alike URLs to its Alert List, and the pattern barely varies: one or two letters off, an extra hyphen, or a different ending such as .cfd, .us or .art.

The usual script: you meet an “investment mentor” on social media or a messaging app who sends you a link. The site looks almost exactly like HashKey or EX.IO, and may even quote the real platform’s SFC CE number. You deposit, watch your balance climb, then try to withdraw and are told to pay “tax”, a “deposit” or an “unfreezing fee” first. A genuine licensed platform never asks you to pay into a personal account and never charges fees like these before releasing a withdrawal.

Walk-in shops and cash handovers: hell notes, fake shops, robberies

Many people assume a face-to-face trade at a shopfront is safer. In practice, cash handovers are exactly what fraudsters and robbers look for. Crypto shops currently hold no virtual asset licence, so if something goes wrong your only route is the police; there is no regulator to complain to. These are the cases with verifiable dates:

1. 15 May 2024Tsim Sha Tsui: hell notes for USDT

   A customer sent about HK$1 million in USDT and was handed hell banknotes; three staff arrested, 3,000 hell notes seized.

2. Jan–Sep 2024West Kowloon: fake exchange shops

   13 investors lost about HK$14.8 million; one businessman was locked inside the shop on his third deal.

3. Oct 2024Tai Kok Tsui: shop staff vanish

   A woman sent 12,000 USDT (about HK$93,000) and the staff walked out.

4. 17 Apr 2025Kwun Tong: cash for USDT

   A buyer brought HK$1 million in cash to an upstairs shop; the shop said no USDT had arrived and a third party took the cash.

5. 13 Dec 2025Mong Kok, 608 Nathan Road: shop owner attacked

   Knife attack at closing time; owner injured, nothing taken.

6. Dec 2025 – Mar 2026Sheung Wan: three large cash robberies

   All linked to money-changer cash deals; in the January 2026 case, two staff of a TST virtual currency shop were arrested over handling the loot.

7. Jun 2026Fake OTC dealer

   A man lost 1.6 million USDT, about HK$14 million.

The cases share a profile: large sums, settled in cash or USDT, with an unlicensed counterparty, in an upstairs unit or private flat. If you must buy with cash, read our crypto shop guide first, and wherever possible use a bank transfer to a licensed platform instead.

P2P trades: one bad payment, one frozen account

The classic P2P (or C2C) fraud is the “triangle scam”. A scammer lures a victim with a cheap item or an “investment”, then opens a P2P order to buy USDT from you and tells the victim to pay straight into your account. The money arrives, you release the USDT, and the scammer disappears. When the victim reports it, the trail leads to your bank account, which can be frozen while police investigate.

The other risk is mule accounts. In May 2025 police broke up a laundering ring handling about HK$118 million through more than 500 stooge accounts; victims’ money was withdrawn and taken to exchange shops in Tsim Sha Tsui to be turned into crypto, and 12 people were arrested. The HKMA repeats the message often: renting, lending or selling your bank account can be money laundering. If anyone offers you a cut for “borrowing” your account, say no. More in our P2P guide.

Romance scams, “mentors” and ATM scams

Scams that start on dating apps or social media are patient. The other person chats for weeks, builds trust, then casually mentions the platform that made them rich, and offers to walk you through signing up. The platform is often one of the clones above. A variant is the WhatsApp or Telegram “investment group”, full of members posting profit screenshots who are, in fact, all the scammer’s accounts.

Bitcoin ATMs get pulled in too. A South China Morning Post feature in September 2026 described how some “grey-market” crypto ATMs in laundromats and claw-machine arcades can turn users into fraud victims: scammers tell victims to feed cash into a machine and send the coins to a wallet address the scammer supplies. One rule covers it. If someone tells you to turn cash into crypto at an ATM and send it to an address they give you, it is almost certainly a scam. For normal ATM use, see our Bitcoin ATM map.

How to check an SFC licence: six steps, two minutes

Whether you’re dealing with an exchange, a broker or a self-described “agent”, these steps work, take under two minutes, and screen out nearly every clone site and unlicensed platform.

1. Open the SFC’s list of licensed platforms

   Go to “Lists of virtual asset trading platforms” on the SFC website (our licensed platforms page links to it). As of October 2026 there are 13 licensees; the list was last updated on 29 May 2026.

2. Match the company name and CE number

   HashKey Exchange is operated by Hash Blockchain Limited, CE number BPL992; OSL by OSL Digital Securities Limited, BPJ213. Scammers copy real numbers, so go on to the next step.

3. Check the web address letter by letter

   The SFC list doesn’t show websites. Reach the platform through its official app or a domain you already know, such as hashkey.com or osl.com, and watch for extra letters, hyphens or odd endings.

4. Don’t confuse “deemed” with licensed

   Applicants on the list, including deemed-to-be-licensed ones marked ^, are not licensed.

5. Search the Alert List

   Search the platform’s name and URL on the SFC’s suspicious virtual asset trading platforms list. If it appears, stop.

6. For brokers and banks, use the public register

   A bank’s or broker’s crypto service can be checked on the SFC Public Register of licensed persons and registered institutions, including licence conditions.

For walk-in shops and OTC dealers there is no virtual asset licence to look up yet. You can check whether a shop holds a Customs money service operator licence, but that covers currency exchange and remittance, not crypto. Once the dealer licensing regime takes effect, this step becomes much simpler.

Scammed? Where to report and get help

Speed matters more than anything. A bank transfer can sometimes be stopped before it reaches the scammer, and crypto that lands on a licensed platform may be frozen. If you think you’ve been scammed, act in this order:

• Call your bank to stop or recall any payment still in process.
• Call 18222, the Anti-Scam Helpline, run around the clock by the police Anti-Deception Coordination Centre (ADCC).
• File a police report through the e-Report Centre or at the nearest police station. Bring transaction records, bank account numbers, wallet addresses, transaction hashes, URLs and chat screenshots.
• Tell the platform if the money passed through a licensed exchange, and complain to the SFC if a licensed firm is involved.
• Check first next time with the police Scameter tool, which flags suspicious websites, phone numbers, bank accounts and wallet addresses.

Further reading: is crypto legal in Hong Kong lays out the whole regulatory map, and the Anti-Deception Coordination Centre publishes the latest scam statistics.

Frequently asked questions

Sources

1. SFC — Suspicious virtual asset trading platforms (Alert List) · checked 6 Oct 2026
2. SFC — Lists of virtual asset trading platforms · checked 6 Oct 2026
3. SFC — Public register of licensed persons and registered institutions · Oct 2026
4. HKSAR Government — Law and order situation in 2025 · 11 Feb 2026
5. Anti-Deception Coordination Centre — scam statistics · Oct 2026
6. HKFP — 16 charged in JPEX crypto fraud case · 5 Nov 2025

Read next