Hong Kong Weighs Tighter SIM Card Limits as Phone Scam Losses Reach HK$1.94 Billion

Nearly 10,000 Phone Scams Put Registration Rules Under Scrutiny

Hong Kong is considering tighter limits on prepaid SIM cards after police recorded nearly 10,000 telephone fraud cases involving HK$1.94 billion in losses during the first nine months of the reporting year. Police Commissioner Joe Chow Yat-ming told a Southern District Council meeting that investigators had found most scam calls in their analysis of victims' telephone records came from local numbers.

The sharpest recent increase came in August and September, when police recorded more than 3,900 telephone scams. About 80% involved criminals pretending to be customer service staff. That amounts to roughly 3,120 cases in just two months, based on the proportion Chow gave.

Chow pointed to two weaknesses: people can register prepaid cards with numerous operators, and renting, lending or selling a SIM card is not itself a criminal offence. Investigators have found people registering cards in shops under their own names and then passing them to fraud groups.

The government is reviewing the registration system and preparing legislative changes. Options include reducing the number of prepaid cards an individual can register and creating an offence covering improper use of a SIM card registered in another person's name, without lawful authority or a reasonable excuse.

The stakes extend beyond telephone services. Fraud accounted for 34,679 of the 68,015 crimes recorded during the first nine months, or about 51%. Total fraud losses reached HK$6.02 billion. Telephone scams represented almost a third of those losses, making access to local numbers a central issue in the proposed response.

What the 310 Card Figure Actually Covers

Chow said an individual could register 10 cards with each of Hong Kong's 31 telecommunications operators, producing a potential total of 310. The existing rules specify that the limit applies to prepaid SIM cards, which users buy and top up with credit.

The government's registration launch notice sets the ceiling at 10 prepaid cards per individual per operator. Corporate users can register up to 25 prepaid cards with each operator. SIM cards supplied through service plans have no numerical registration limit.

A SIM card connects a device to a mobile network. It can provide calls, text messages, data or a combination of those services. Under the registration programme, cards issued by Hong Kong operators for local communications between people must be connected to identifying information.

The per operator structure explains Chow's concern. A person who reaches the prepaid limit at one company can register more cards at another. Lowering that ceiling would reduce the number available through each registration, although the government has yet to announce a replacement limit or whether it would apply across all operators.

How Registered Cards Reach Fraud Groups

Police investigations described by Chow found people completing registration at retail outlets before handing the cards to criminal groups. This gives investigators a registered name to follow, while leaving them to establish who actually controlled the number when a scam occurred.

Chow said a registered holder questioned by police could argue that they did not know another person would use the card for fraud. His concern is the difficulty of establishing responsibility when cards move from the named subscriber to someone else.

The proposed offence would address improper use of cards registered in another person's name. The government's stated proposal includes the conditions of having no lawful authority or reasonable excuse. Those conditions would matter when defining which conduct falls within the offence.

What the Government Is Preparing to Change

Secretary for Commerce and Economic Development Algernon Yau Ying-wah said in a written Legislative Council response that the government was conducting a comprehensive review of the SIM registration programme and developing more targeted measures.

Yau identified a lower registration ceiling for individual prepaid users and the proposed offence involving cards registered in another person's name. He said officials were preparing the legislative details and would consult the public in due course.

Chow's call for tighter rules and Yau's description of the review point to two related goals: reducing the supply of cards available through individual subscribers and giving police a more direct way to address misuse of another person's registration.

For residents, the practical effect would depend on the final wording. A lower ceiling would affect how many prepaid cards they could register. A new offence would make the circumstances in which they use or pass on a card more consequential. Officials have not announced a consultation date, a legislative timetable or the proposed penalties.

How Hong Kong Built the Registration System

Hong Kong introduced mandatory identification for SIM cards through the Telecommunications (Registration of SIM Cards) Regulation. In its regulation announcement, the government said the purpose was to help prevent and detect crimes involving prepaid cards and protect the integrity of telecommunications services.

The programme was introduced in stages, giving operators time to build registration systems and existing prepaid users time to submit their details:

• June 4, 2021: The government gazetted the Telecommunications (Registration of SIM Cards) Regulation, with Legislative Council scrutiny scheduled to begin on June 9.
• September 1, 2021: The regulation took effect and operators began a preparation phase lasting about 180 days.
• March 1, 2022: New prepaid cards and new SIM service plans required registration before activation.
• February 23, 2023: Existing prepaid users reached the registration deadline, after which unregistered cards would be deactivated.

Existing service plan customers were not required to register again unless they changed operator or subscribed to a new telephone number. The distinction allowed the government to bring previously anonymous prepaid cards into the system while retaining existing customer arrangements for service plans.

What Subscribers Must Provide

Individual subscribers must provide their name, date of birth, Hong Kong identity card number and a copy of their identity card. Registration can take place through operator shops, websites or mobile applications.

Users younger than 16 need endorsement from an adult aged 18 or above, whose personal information must also be registered. Corporate subscribers must provide business registration information and designate a responsible person, with that person's identifying details.

The government recognised at the programme's launch that some people, particularly older residents, would need assistance. It arranged support through government departments, social welfare organisations and telecommunications operators, and encouraged operators to help customers at their shops.

These requirements establish an identity record when a card is registered. Chow's account of cards being handed to fraud groups shows why the current review also focuses on what happens after activation: the person named in the records and the person using the card may be different.

Telephone Fraud Is Growing Faster Than Crime as a Whole

Hong Kong's total recorded crime rose 2.1% to 68,015 cases in the first nine months. Fraud cases increased 7.9% to 34,679, while the amount lost to fraud rose 6.7% to HK$6.02 billion.

Telephone scams overtook online shopping scams as the most serious fraud category described by Chow. Nearly 10,000 telephone cases accounted for close to three in every 10 fraud reports. Their HK$1.94 billion in losses represented about 32% of all fraud losses, calculated against the HK$6.02 billion total.

The concentration in August and September explains the urgency of the proposed changes. More than 3,900 cases in those two months represented roughly two fifths of the nearly 10,000 telephone scams recorded across nine months. Customer service impersonation dominated that recent surge.

Other major crime categories moved in the opposite direction. Chow said homicide, robbery and drug cases declined. Serious drug cases fell 12% to 826, while indecent assault, fraud and youth crime increased. Fraud therefore accounted for more than half of recorded crime even as several other categories fell.

Apple Purchase Complaints Raise a Different Security Issue

Chow also discussed complaints about suspected unauthorised credit card purchases connected with Apple product launches. He cited 1,589 reports relating to one iPhone launch and another 138 relating to preorders for a folding phone, a combined 1,727 reports.

People had received text messages notifying them of transactions on Apple's website and suspected that their credit card details had been used without permission. Chow said police contacted Apple, credit card companies and banks, after which all the problematic transfers and purchase records were cancelled.

According to Chow, investigators found that Apple had disabled 3D Secure measures during the online transactions concerned, allowing payments to proceed without checks such as a one time password or approval through a mobile application.

3D Secure is a system used in online card payments to help a bank check that the person making a purchase is the cardholder. An extra verification step may ask the customer to confirm the payment with a code or through their banking app. Chow said police had repeatedly discussed the issue with the companies involved and wanted effective verification measures in place for future product launches.

The purchase complaints concern a different point of protection from SIM registration. Registration gives police a named subscriber to investigate after a suspicious call. Payment verification gives a bank an opportunity to confirm a purchase before money is transferred. Chow's account placed both the availability of telephone numbers and checks at the point of payment under scrutiny.

Key Points

• Police recorded nearly 10,000 telephone scams and HK$1.94 billion in related losses during the first nine months of the reporting year.
• More than 3,900 telephone scams occurred in August and September, with about 80% involving customer service impersonation.
• The current individual limit is 10 prepaid SIM cards per operator. Service plan cards have no numerical registration limit.
• The government is preparing tighter prepaid registration limits and an offence addressing improper use of cards registered in another person's name.
• The proposed ceiling, penalties and public consultation date have not been announced.
• Chow said problematic transactions connected with 1,727 Apple purchase reports had been cancelled after police contacted the companies involved.