The tragic Tai Po fire at Wang Fuk Court left 168 people dead and thousands more without a roof over their heads. While the city mourned, scammers saw a business opportunity. You'd think some things are sacred, but for the bottom feeders of the internet, a disaster is just another chance to run a phishing script. This week, a Hong Kong court handed down an 11-month jail sentence to Cham Shu-shing, a 35-year-old cook who decided that selling his digital wallet credentials for a quick buck was worth the risk. It wasn't.
Cham wasn't the mastermind behind the fake donation site that mimicked a local social welfare organization. He didn't build the phishing page or send out the QR codes that preyed on the grief of Hong Kongers. But he did something just as dangerous: he provided the getaway car. By selling his Alipay account for a measly HK$2,000, he gave criminals a "puppet account" to funnel stolen money. This is the reality of modern crime in the city. The big fish stay hidden, and the small-time sellers take the fall.
The Cost of Being a Puppet
Magistrate Jeffrey Sze Cho-yiu didn't mince words during the sentencing at Sha Tin Court. He pointed out the obvious—selling an account that you know is going to be used for something illegal is a serious breach of social responsibility. Cham pleaded guilty to one count of conspiracy to deal with property known or believed to represent proceeds of an indictable offense. In plain English? Money laundering.
It's a pattern I've seen play out across the city too many times. People think they're just selling "data" or "access." They convince themselves that what happens after the transaction isn't their problem. Honestly, that's a lie we tell ourselves to feel better about taking dirty money. When you hand over your digital identity, you're hand-delivering a tool to a predator. In this case, that tool was used to impersonate a charity helping families who had lost everything in the Wang Fuk Court blaze.
The scale of the disaster was immense. The Tai Po fire was a systemic failure that has already led to the arrest of 15 people for manslaughter and several others for fraud related to fire safety inspections. To then have people trying to siphon off the HK$2.3 billion in relief funds is just sickening. Cham’s account was a cog in that machine.
Why Your Alipay Is More Than a Wallet
The scam worked by creating a carbon copy of a legitimate charity webpage. Scammers pushed out phishing messages and QR codes, claiming to raise funds for the families of victims or even simulating the identities of fallen firefighters. If you clicked, you weren't helping a survivor; you were padding a criminal’s pocket.
Here’s what you need to understand about puppet accounts:
- They provide anonymity for the real criminals.
- They make it nearly impossible for police to trace the money in real-time.
- The person whose name is on the account is the one who gets the knock on the door.
Cham claimed he sold the account because he was in financial trouble. It’s a common story. But the court didn't buy it as an excuse. Along with his 11-month prison sentence, he was slapped with a HK$4,500 fine. Think about that math. He made HK$2,000 selling the account and ended up paying more than double that in fines, plus a year of his life behind bars. It’s a terrible deal by any metric.
The New Face of Disaster Fraud
We’re living in an era where scammers move faster than the fire department. The police removed the fake webpage on the very night it went live, November 29, but the damage to public trust is harder to fix. When people get burned—no pun intended—by fake charities, they stop giving to the real ones. That's the real crime here.
The Privacy Commissioner’s Office has been screaming from the rooftops about this. They’re telling everyone to avoid clicking suspicious links and to always verify the sender. It sounds like basic advice, but when you're looking at photos of a destroyed apartment block and grieving neighbors, your guard drops. That’s exactly what these guys count on.
If you want to help, do it the right way. Use the government-established assistance funds or well-known NGOs with a physical presence. Don’t trust a random QR code in a WhatsApp group, even if it looks professional. Scammers are experts at making the fake look real.
Protect Your Identity or Pay the Price
If you're ever approached by someone offering cash for your bank account, SIM card, or digital wallet—run. It’s never a "marketing test" or a "favor for a friend." It’s an invitation to a jail cell. The Hong Kong Police Force is being aggressive about this. They aren't just going after the hackers; they're going after the enablers.
- Enable two-factor authentication on everything.
- Never share verification codes, even with people you think you know.
- Check your account history regularly for "test" transactions of a few cents.
- Report lost phones or IDs immediately so they can't be used to open puppet accounts.
The 11-month sentence for Cham Shu-shing is a warning shot. The court is basically saying that being a "small player" won't save you. If you provide the infrastructure for fraud, you own the consequences of that fraud. Don't let a moment of financial desperation turn you into a literal criminal. It's not worth the HK$2,000, and it's certainly not worth the stain on your record. If you suspect your account has been compromised or used without your permission, contact the "Anti-Deception Coordination Centre" at the 18222 hotline immediately.
