How to Protect Your Business from Fraud in Hong Kong

Fraud is a material business risk in Hong Kong, and the numbers are sobering. The Hong Kong Police Force recorded 19,625 deception cases in 2022 involving losses of approximately HK$4.8 billion, according to the force's annual review. For business owners, the threat is twofold: external fraudsters targeting your payments and accounts, and internal actors exploiting weak controls. This post sets out the practical, legally-grounded steps you can take today to reduce both exposures.

Understand the Fraud Landscape in Hong Kong

The most common frauds against Hong Kong businesses are invoice redirection, CEO fraud (also known as business email compromise), and employee embezzlement. The Hong Kong Police's Anti-Deception Coordination Centre (ADCC) reported in 2023 that business email compromise alone accounted for losses exceeding HK$1 billion in the first half of that year. These are not exotic crimes—they exploit routine weaknesses in payment approval and vendor verification.

The legal framework you operate under matters. The Companies Ordinance (Cap. 622) imposes duties on directors to exercise reasonable care, skill, and diligence (Section 465). That duty extends to overseeing financial controls. If a director fails to implement basic anti-fraud measures, they may face personal liability for losses—not just the company. The Companies Registry (CR) and the Inland Revenue Department (IRD) also expect accurate books and records; falsified entries are an offence under Section 373 of Cap. 622.

Ongoing Compliance Execution

Ongoing statutory obligations are handled seamlessly through Captime's dedicated Hong Kong company secretary service, providing a licensed local representative and automated annual return management.

Verify Every Counterparty Before You Pay

The single most effective anti-fraud control is independent verification of bank account details before any payment. Fraudsters intercept legitimate invoices, change the bank account number, and redirect funds. A 2023 advisory from the Hong Kong Monetary Authority (HKMA) urged businesses to confirm payment instructions through a second, independent channel—a phone call to a known number, not the number on the invoice.

You can also use the Companies Registry's free online search to verify that a company actually exists and that its directors match the people you are dealing with. The CR's Integrated Companies Registry Information System (ICRIS) provides current and historical records, including charges and winding-up petitions. A company that has a winding-up petition filed against it is a red flag. For sole proprietorships and partnerships, the Business Registration Office under the IRD maintains a searchable database of business registration certificates.

"To safeguard against fraud, companies should adopt a policy of verifying any change in bank account details or payment instructions through a separate and independent means of communication." — Hong Kong Monetary Authority, circular on fraud prevention (2023)

Implement Segregation of Duties

Internal fraud thrives when one person controls an entire transaction cycle—raising the order, approving the invoice, and releasing the payment. The Companies Ordinance does not prescribe specific internal controls, but the duty of care under Section 465 implies that directors should ensure reasonable segregation exists. In a small company with limited staff, full segregation may be impossible; the remedy is a mandatory second approver for payments above a set threshold.

The Hong Kong Institute of Certified Public Accountants (HKICPA) publishes guidance on internal controls for SMEs, recommending that at minimum, the person who initiates a payment should not be the same person who authorises it. If you have only one finance officer, the director should review and approve all payments above, say, HK$10,000. This is not bureaucracy; it is a documented defence if fraud occurs and a claim is made against the directors.

Conduct Due Diligence on New Suppliers and Customers

Before onboarding any new supplier, verify their business registration certificate with the IRD and their incorporation details with the CR. For customers, consider a credit check through a licensed credit reference agency. The Hong Kong Association of Banks publishes a list of licensed credit reference agencies; using an unlicensed one exposes you to data privacy issues under the Personal Data (Privacy) Ordinance (Cap. 486).

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) requires certain businesses—including accounting, legal, and real estate professionals—to conduct customer due diligence. Even if your business is not a "scheduled person" under Cap. 615, adopting similar checks is prudent. A supplier that cannot produce a valid business registration certificate or that insists on payment to a personal account is a warning sign.

Protect Your Digital Perimeter

Business email compromise is the fastest-growing fraud vector in Hong Kong. The Hong Kong Police's CyberDefender platform reported that in 2023, over 70% of reported BEC cases involved compromised email accounts rather than fake domains. The fix is technical: enable two-factor authentication (2FA) on all email and banking accounts, and mandate it for any staff with payment authority.

The HKMA's "Banking Made Easy" campaign and the Police's "Scameter" tool both offer free resources. Scameter, launched in 2022, allows you to check suspicious phone numbers, email addresses, and website URLs. For a business, the practical step is to make Scameter checks part of your onboarding process for any new counterparty. The tool is free and maintained by the Police's Cyber Security and Technology Crime Bureau (CSTCB).

Train Staff to Spot Red Flags

Fraud prevention is not solely a finance function. Every employee who handles invoices, emails, or phone calls is a potential defence. The Hong Kong Police's Anti-Deception Coordination Centre runs free awareness sessions for businesses, and the CSTCB publishes a "Cyber Security Information Portal" with training materials. A 30-minute annual refresher on the following red flags is a proportionate response:

• Urgent requests for payment, especially from "senior management" via email
• Changes to bank account details without a prior phone call
• Invoices with minor discrepancies in company name or address
• Unusual payment methods, such as cryptocurrency or prepaid cards

The Companies Ordinance does not mandate fraud training, but the duty of care under Section 465 arguably extends to ensuring staff are competent. A documented training record is also useful evidence if you need to show the CR or a court that you took reasonable steps.

Know Your Reporting Obligations

If fraud occurs, you have legal obligations beyond recovering the money. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), if you suspect that any property represents proceeds of crime, you must file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU), regardless of the amount. Failure to file is an offence. The JFIU operates under the Police and the Customs and Excise Department.

You should also report the fraud to the Police's Anti-Deception Coordination Centre via the 18222 hotline or the Scameter platform. For frauds involving electronic transfers, contact your bank immediately—the HKMA's "Coolman" system, launched in 2023, allows banks to freeze suspicious accounts faster, but only if you report promptly. The longer you wait, the lower the recovery odds.

Review Your Insurance and Legal Protections

Commercial crime insurance is available in Hong Kong from major insurers, covering employee dishonesty, forgery, and computer fraud. Premiums vary, but for a small business, a policy covering HK$1 million in losses typically costs a few thousand Hong Kong dollars annually. This is a proportionate cost compared to the average BEC loss of HK$1.2 million reported by the Police in 2023.

Your articles of association may also contain indemnity provisions for directors. Under Section 165 of the Companies Ordinance, a company may indemnify directors against liability incurred in defending proceedings, provided the director acted honestly and in good faith. Review your articles to confirm the indemnity scope, and consider directors' and officers' (D&O) liability insurance if you do not already hold it.

Build a Fraud Response Plan

A fraud response plan is a written document that sets out who does what when fraud is suspected. It should name a response coordinator, specify the evidence preservation steps, and list the reporting contacts (bank, Police, JFIU, insurer). The Companies Ordinance does not require such a plan, but the duty of care under Section 465 suggests that a director who has a plan is better positioned to demonstrate reasonable steps than one who does not.

The plan should also address communication. Do not discuss the fraud with the suspected employee before preserving evidence. Do not alert the counterparty before your bank has had a chance to freeze funds. The HKMA's guidance on fraud response recommends that the first call is to your bank's fraud hotline, followed by the Police's 18222 line, and only then to your insurer.

The Practical Takeaway

Fraud protection in Hong Kong is not about eliminating risk—it is about reducing it to a level that is proportionate to your business size and transaction volume. The minimum viable package is: independent verification of payment details, segregation of payment duties, 2FA on all financial accounts, and a documented response plan. These four steps address the majority of frauds reported to the Hong Kong Police.

If you are setting up a new company or reviewing an existing one, ensure your business registration and company records are accurate and current—fraudsters often exploit mismatches between your registered details and your actual operations. The Companies Registry's ICRIS search is free, and the Business Registration Office's database is searchable online. Use them before you pay anyone.

For a quick reference on the correct HSIC codes for your business activities—useful when updating your business registration with the IRD—use our HSIC Code Finder at /hsic-finder. Accurate classification reduces administrative friction and ensures your records match your actual operations, which is itself a small but meaningful fraud deterrent.

Q: Do I need to report a suspected fraud to the authorities even if I am not sure? A: Yes. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), if you have reasonable grounds to suspect that property represents proceeds of crime, you must file a Suspicious Transaction Report with the Joint Financial Intelligence Unit. Failure to do so is an offence.

Q: Can a director be personally liable for fraud committed by an employee? A: Potentially. Under Section 465 of the Companies Ordinance (Cap. 622), directors owe a duty of reasonable care, skill, and diligence. If a director fails to implement basic controls—such as segregation of duties or payment verification—and that failure enables fraud, the director may face personal liability for the resulting losses.

Q: What is the fastest way to report a fraud in Hong Kong? A: Call the Police's Anti-Deception Coordination Centre at 18222, and simultaneously contact your bank's fraud hotline. For electronic transfers, prompt reporting triggers the HKMA's "Coolman" mechanism, which allows banks to freeze suspicious accounts more quickly.