A scam that knew too much
A Hong Kong traveller reportedly lost about HK$1.2 million after fraudsters posing as airline customer service staff quoted specific flight details back at them. The detail matters more than the loss. The caller did not guess. They knew the booking, the route, the timing — enough to sound like the real thing.
For an SME owner, the instinct is to file this under "consumer scam, not my problem". That instinct is wrong. The same information that made that call convincing sits in your booking forms, enquiry logs, chat transcripts, delivery notes and CRM exports. If someone can quote it back to your customer, your customer will believe them. And your business name will be on the story.
Why your SME is a target even if you are small
Fraudsters do not need to breach a bank. They need one weak link in a chain of small businesses that all hold the same customer: the travel agent, the clinic, the logistics firm, the e-commerce shop, the event organiser. Small firms are attractive because they often have:
- Customer data spread across email inboxes, spreadsheets and a website database with no single owner
- Staff who share logins because it is faster than requesting access
- Third-party plugins and form tools that were installed once and never reviewed
- No habit of asking a caller to prove who they are before confirming anything
None of that requires malice. It is just how a busy office works. But it means a single leaked export can fuel dozens of convincing calls.
The uncomfortable question: who can quote your customers back to themselves?
Before adding tools or policies, answer this honestly. If a stranger called your customer and claimed to be from your company, what could they say that would make it believable? An order number? A delivery address? The name of the person who handled the enquiry?
Now ask: who inside and outside your business can see that same information? Write the list down. It usually includes more people than expected — a former freelancer with an old admin login, a marketing agency with export access, a supplier copied on every email thread.
Step 1: Shrink what you collect
Every field on a form is a liability with a marketing benefit attached. Review your website enquiry and checkout forms this week. If you do not use a customer's date of birth, full address or ID number for a specific operational purpose, remove the field. Data you never collected cannot leak, and it cannot be quoted back to a customer by a fraudster.
Step 2: Separate identity from conversation
Train front-line staff on one rule: never confirm account or booking details to an inbound caller until identity is verified through a channel the caller did not choose. Call back on the number you hold. Send a message to the email address on file. This single habit defeats most impersonation attempts, because the fraudster controls the inbound call but not your outbound records.
Step 3: Close the shared-login habit
Shared passwords make it impossible to know who accessed what, and impossible to revoke access cleanly when someone leaves. Give each person their own login to your website admin, hosting panel and email. Remove accounts the day a contractor finishes. If your website platform cannot do individual accounts, that is a reason to raise it with your developer — see how we handle access and handover in our studio plans.
Step 4: Audit who your website talks to
Open your site's plugin and integration list. For each one, ask: what customer data does it receive, where is it stored, and who can export it? Remove anything nobody has used in six months. A contact form plugin that pipes every enquiry into three inboxes is three chances for that enquiry to end up somewhere it should not.
Step 5: Write a one-page incident script
If a customer tells you they received a suspicious call quoting their order, what happens in the first hour? Decide now: who takes the call, what you ask them to save (caller number, screenshots, time), who reviews access logs, and who drafts the message to other affected customers. A one-page script beats an improvised panic. Keep it somewhere the whole team can find it, not in one person's head.
What to do when the data is already out
If you suspect customer records have leaked, resist the urge to stay quiet while you investigate. Customers who are warned can hang up on a convincing fraudster. Customers who are not warned will assume you were careless, and they will be right to ask why you did not tell them.
Notify affected customers plainly, describe what information may have been exposed, tell them what you are doing, and give them a real contact for questions. Then fix the access path that allowed it. If you are unsure where to start, our team can walk through your setup with you — get in touch and we will look at what your site actually stores.
Summary
The airline scam worked because the caller knew real details. Your customers' details are just as quotable. This week: cut unnecessary form fields, require call-back verification before confirming anything, give every staff member their own login, prune unused plugins that touch customer data, and write a one-page script for the day a customer says someone called them. None of it is technical. All of it makes your business a harder target — and a safer name to trust.