Online scams and deepfakes
AdvancedPhishing uses panic, urgency and fake links to steal passwords and codes; AI deepfakes fake faces and voices — seeing is no longer believing; the three steps: alert, verify (official channels), seek help (18222).
- Three phishing alarms: panic and urgency, strange links, requests for passwords and codes.
- No genuine institution ever asks for your password or one-time code by message.
- AI deepfakes can clone faces and voices — seeing and hearing are no longer believing.
文體小知識：時事議題課結合新聞案例和實用建議，學完可以即刻應用在日常生活，保護自己。
§Text Passage
1Online scams never stop evolving; the most common is phishing: scammers pretend to be a bank, school or friend and lure you into fake links, passwords or one-time verification codes. Familiar scripts include 'your parcel is held, pay to release it', 'your account is abnormal, verify now' and 'cheap concert tickets'. Hong Kong loses billions to online scams every year — secondary students are targets too.
2Phishing messages leave clues: manufactured panic ('your account will be frozen'), urgency ('act now or never'), strange link addresses (like bank-secure123.com instead of the official one), and requests for passwords or codes. Remember the iron rule: no genuine institution ever asks for your password or verification code by message or phone.
3AI deepfakes take scams up a level: with a few seconds of voice a cloned voice can be made, with a few photos a fake face — 'officials', 'your classmates', even 'family' can be fabricated. Scammers have used synthetic voices to impersonate children phoning parents for money transfers, and fake celebrity investment videos circulate widely. Seeing and hearing are no longer believing — that is simply today's reality.
4The three anti-scam steps (as advised by Hong Kong police): one, stay alert — pause whenever a message rushes or tempts you; two, verify — contact the person through official hotlines or apps, never the contact details inside the message; three, seek help — when unsure, ask parents or teachers, or call the Anti-Scam Helpline 18222. If money is already lost, report to the police and your bank immediately.
1Summary 重點摘要
Phishing uses panic, urgency and fake links to steal passwords and codes; AI deepfakes fake faces and voices — seeing is no longer believing; the three steps: alert, verify (official channels), seek help (18222).
2Vocabulary cards Vocabulary
Pretending to be a trusted body or friend to steal passwords, money or data through fake messages and links.
A crime that takes money or data by deception, in ever-changing online forms.
The one-time code sent by SMS at login or transfer — the last line of defence, never shared with anyone.
AI-synthesised images or voices convincing enough to imitate a real person's face and voice.
Faking a trusted source, e.g. copying an official phone number, email address or organisation name.
A link whose address differs from the official one or contains odd strings, leading to fake sites.
An organisation's published contact (official hotline or app), which must be used for verification instead of links in the message.
A second check (like a code) beyond the password, protecting accounts even if the password leaks.
The Hong Kong police helpline to call when a scam is suspected.
3Step by step Steps
- Four signs of phishingPhishing messages impersonate banks, couriers or official bodies to steal passwords, codes or money. Learn four signs: manufactured panic ('your account will be frozen'), urgency ('verify today'), a non-official address (bank-secure123.com), and requests for passwords or codes. The sample message hits three signs at once, so treat it as suspicious and never tap the link.
- Dissecting the web addressTo judge a website, read the last part of the domain before .com — not the brand words at the front. The genuine HSBC site is hsbc.com.hk; in hsbc.security-check.com the domain actually belongs to security-check.com, with hsbc as camouflage. Note too that https only means the connection is encrypted — fake sites hang it as well — so having https does not mean trustworthy; the domain itself is what must be checked.
- The code is the last line of defenceA one-time verification code is the temporary password sent by SMS at login or transfer, proving that whoever holds your phone is you. Scenario: the scammer already has your password from a fake site and needs only the 6-digit code to drain the account. Whoever asks — bank staff, police or customer service — refuse and hang up. The iron rule: genuine staff never ask for passwords or codes; asking is itself the alarm.
- Clues of a deepfakeDeepfakes synthesise convincing images and voices with AI. Examine a suspicious video frame by frame: unnatural blinking, lips out of sync with the sound, inconsistent lighting, distorted fingers and teeth. When a 'friend's' voice or video asks for money, never judge by face or sound — test with a private question only you two know, or ring the number saved in your contacts, because a few seconds of audio is enough for AI to clone a voice.
- Traces of AI-generated contentAI-generated portraits leave traces: background text becomes gibberish, earrings and spectacle arms mismatch, hair melts into the background, skin looks unnaturally smooth. To verify a news photo, run a reverse image search to find its earliest appearance and judge whether it is an old picture recycled or a composite. Seeing is no longer believing — before forwarding any startling image, do a reverse search and a source check, and share only when it passes.
- Rehearsing the three anti-scam stepsThe three anti-scam steps are alert, verify and seek help. Drill: a WhatsApp message from a 'classmate' — 'I saved you a cheap concert ticket, pay now.' First, alert: pause and refuse to rush. Second, verify: call the classmate on the number saved in your contacts, not by replying to the message or using its contact details. Third, seek help: if unreachable, tell a parent or teacher, or call the anti-scam hotline 18222.
- Recovery after being scammedIf a password has been typed into a fake site or money paid, the speed of response decides the loss. Immediate checklist: change the password there and everywhere it was reused; switch on two-factor authentication; ask the bank to freeze the account or stop the transaction; report to the police or call 18222 and keep the messages as evidence; and tell a parent or teacher. Never stay silent out of embarrassment — the earlier the report, the better the chance of recovering the money.
4Diagrams Diagrams
5Worked example Example
Example: Ken receives an SMS: '[Courier] Your parcel contains a prohibited item and is held. Pay $500 at link.sf-express-pay.com today to release it, or it will be destroyed.' Write his correct handling steps.
- Spot the alarms: manufactured panic (prohibited item, destruction) + urgency (today) + payment demand + suspicious address (link.sf-express-pay.com is not the official domain) — all four signs.
- Alert: do not tap the link, do not pay; real couriers never demand release fees by SMS.
- Verify: open the official app or call the official hotline with the tracking number — never the link or number inside the message.
- Report and protect: use the messaging app's report function, tell a parent, and check the address rating with an anti-scam app.
- Answer: No link, no payment; verify via the official app or hotline; report and inform a parent — the three steps of alert, verify and seek help in full.
6Common mistakes Mistakes
7Quick check Quick check
Q1Which is a typical sign of phishing? A. official address, calm tone B. urgent action + password request C. from a saved contact
Q2A 'bank officer' calls asking for your SMS code. What should you do?
Q3What is a deepfake?
Q4A 'classmate' messages you to pay immediately for cheap tickets. Apply the three anti-scam steps.
Q5You typed your password into a fake site — what comes first?
8Recap Recap
- Three phishing alarms: panic and urgency, strange links, requests for passwords and codes.
- No genuine institution ever asks for your password or one-time code by message.
- AI deepfakes can clone faces and voices — seeing and hearing are no longer believing.
- Three steps: stay alert, verify via official channels, seek help (18222).
- If hit, act at once: change passwords, enable 2FA, tell the bank, report to police.