Officers said the amount involved was nearly HK$14.7 million, with one case amounting to HK$114,000.
Police said they were treating the matter as “obtaining property by deception”, but no arrests had been made so far.
In response to enquiries from RTHK, a spokesperson for Apple noted that all orders received would be reviewed before being processed.
Local banks have also urged customers to suspend their credit cards — either via their banking apps or by phone — if they spot any unauthorised transactions.
Lawmaker Johnny Ng on Monday said that Apple’s retailers should ultimately bear responsibility for any unauthorised credit card transactions.
Speaking in an interview with RTHK, Ng said the multi-factor verification tool, 3D-Secure (3DS), which allows for smooth and efficient transactions online, may have been disabled.
“[By] using the 3DS, every transaction might add around 30 seconds or even one minute more,” he said.
“I think the seller thinks that there’ll be a lot of people, a lot of citizens who simultaneously do the transactions, [so] they may relax the security level [as] as they want to make more businesses,” he added.
Ng also pointed to scammers who might have stolen and stored the credit card or financial information of residents from a long time ago, and took the opportunity to make the transactions this time for profit.
He urged residents to be mindful when receiving suspicious hyperlinks and called on authorities to ramp up cyber security protection.
“As an end user, never click on the hyperlink from a WhatsApp [message] or SMS, because a lot of phishing websites use the fake links to let you see an ‘official website’, but it is not a good one and [will steal] your information or your money.
“The second thing is about all organisations, including government or non government organisations — they have to use more cybersecurity [tools] to protect the information of users.
“I think these two parties [need to work] together to make sure the safe environment of our cyber world,” he said.
Despite this, Ng estimates that the actual losses from the reported cases “might not be high”, given the products have not yet been delivered and the banks can withhold the funds involved.
