Most scam stories aimed at businesses focus on the money lost. For an SME holding customer data, the bigger problem is what the scammer walks away with: a contact list, a supplier price sheet, a copy of your invoice template, or a set of login details that opens the door to your customer records. The scam call is often just the first step.
The pattern is consistent. Someone contacts your team pretending to be a customer, a supplier, a bank, or even a colleague. They are friendly, they know a real order number, and they need something urgent. The urgency is the tell. Once you recognise the shape of the attack, you can design a simple process that makes it much harder to succeed.
Why SMEs in Hong Kong are a preferred target
A small team has no dedicated security desk. The person answering WhatsApp is often the same person issuing invoices, chasing payment, and managing the customer database. That concentration of access is exactly what a scammer wants: one convincing conversation can reach both money and data.
Hong Kong's recent cyber defence exercises have repeatedly shown that attackers prefer the easiest route in, and a human conversation is usually easier than breaking encryption. Fake buyer enquiries, fake supplier bank-change notices, and fake IT support calls all follow the same logic. They do not need to hack your website if they can simply ask your staff for the information.
The four scams that reach your customer data
1. The fake buyer with a file attached
A supposed new customer sends a purchase enquiry with an attached "order form" or a link to a shared folder. Opening it installs something, or the link asks for a login. Either way, the goal is access to your mailbox, which usually contains years of customer correspondence.
2. The supplier bank-detail change
An email that looks like it comes from a known supplier says their bank account has changed and asks you to update your records. The money goes elsewhere, and your genuine supplier is left unpaid. This is one of the most common and most expensive business email scams, and it works because it targets a routine task nobody double-checks.
3. The WhatsApp impersonator
Someone copies your director's profile photo and name, then messages a junior staff member asking for a customer list or a quick transfer. The request feels normal because it appears to come from the boss.
4. The fake IT or platform support call
A caller claims your website hosting, domain, or email account has a problem and needs remote access to fix it. Once inside, they can read customer records or install a backdoor that survives the call.
A front-line defence plan you can start this week
Step 1: Name a verification phrase for money and data requests
Agree on a simple rule: any request to change bank details, send a customer list, or grant remote access must be confirmed by a phone call to a number you already have on file, not a number supplied in the message. This single rule blocks most of the scams above.
Step 2: Separate the person who can approve from the person who can pay
If one person can both approve a payment and release it, a single convincing conversation is enough. Even in a three-person company, a second pair of eyes on any new payee is worth the friction.
Step 3: Reduce what a stolen mailbox would reveal
Your inbox is probably your largest customer database. Move customer records into a proper system with its own access controls, and archive old email rather than leaving everything searchable forever. If your team handles customer data in shared inboxes, it is worth reviewing how that data is stored and who can reach it; our team can walk through a practical review of what you are holding and where.
Step 4: Train the first responder, not everyone
The receptionist, the sales inbox, and the accounts clerk are your real front line. A 20-minute session on the four patterns above, with real examples from your own industry, is more useful than a generic annual security module.
Step 5: Make reporting fast and blameless
Staff hesitate to report a mistake because they fear blame. Set the expectation that reporting a suspicious message within the hour is a good outcome. Speed of reporting matters far more than perfect judgement.
Step 6: Check your domain and email authentication
If your domain does not have SPF, DKIM, and DMARC configured, scammers can send email that appears to come from your own address. This is a technical setting, but it directly protects your customers from receiving fake invoices that look like yours. Ask whoever manages your domain to confirm all three are in place.
What to do in the first hour after a suspicious contact
- Do not reply, click, or forward the message internally as an attachment.
- Preserve the message and any headers; screenshot the WhatsApp profile.
- Warn the team in a single channel so nobody else engages.
- If credentials were entered, change passwords and revoke active sessions immediately.
- If money was transferred, contact your bank at once; the first hours matter most.
Summary
Scam calls and fake buyer messages are not just a finance risk for Hong Kong SMEs; they are a route into your customer data. The defence is procedural rather than technical: a verification call before any bank or data change, a second approver for payments, customer records kept out of shared inboxes, a short training session for the people who answer first, and a blameless reporting habit. None of these require a large budget. They require a decision that the routine request is exactly the one worth double-checking.