The case, which has been classified as obtaining property by deception, is being investigated by the police’s Cyber Security and Technology Crime Bureau.
Speaking to reporters, chief inspector Chan Lai-yu said that there were currently no indications there had been a cyber attack on Apple or relevant banks whose cards were used to make the purchases, as their systems were functioning as normal.
She said the transactions involved did not require verification with a one-time password so the payment process could be completed without the cardholder’s confirmation, giving criminals a chance to exploit the opportunity.
“The investigation focuses on two main directions. First, we will trace the source of the leaked credit card information, including analysing whether the affected people had submitted information on a common platform, and whether they had previously fallen victim to phishing scams,” Chan said.
“We will also look into the identities of people involved and their digital footprints, in order to identify the individuals who used the stolen information to make online purchases.”
Superintendent Ferris Cheung also said the police had passed on the reports to the relevant banks and Apple for follow-up, so that they can cancel the suspicious transactions as soon as possible.
The force called on people to enhance their cybersecurity awareness and to check their credit card transaction records on a regular basis.
