September 2026
With fraud and scam activities evolving in both scale and sophistication, no segment of society is spared, including insurance customers. Fraudsters are increasingly employing highly convincing tactics, often impersonating trusted organizations or individuals and using seemingly legitimate communications to deceive victims. As mentioned in our 9th Issue of the Conduct in Focus1, as fraudsters constantly evolve their mechanisms for separating victims from their hard earned money, so insurers need continually to adapt and update their prevention measures and intelligence-sharing to keep customers safe. In this update, we set out certain key measures that insurers should consider taking:
When policyholders seek to update their contact details, payment instructions, beneficiary information or policy ownership, it is already common practice for insurers to notify policyholders to the pre-existing contact details that the request has been received. This serves as an important safeguard against fraud (for example, if it is a fraudster seeking to make the change as a prelude to illegally extracting benefits out of the policy).
Insurers are encouraged to make these notifications to policyholders through more than one communication channel, to make sure it gets through to the real policyholder (and not to the fraudster who may have already commandeered one of the channels).
Notifications may be sent through a combination of channels, such as SMS, emails or letters. This helps ensure that policyholders are promptly made aware of any change requests relating to their policies and can alert the insurers if the request is unauthorized or fraudulent. Early detection of suspicious or unauthorized changes enables insurers to take timely preventive action, minimizing potential financial loss or other detriment to policyholders.
Insurers are encouraged to make greater use of the Hong Kong Police Force's Scameter+ App (“Scameter+”)2 by reporting suspicious websites, phone numbers, SMS messages and other scam-related information identified in the course of their operations. Prompt reporting can help enrich the Scameter+ database, facilitate intelligence sharing and support the timely identification of fraudulent activities. Insurers should also promote Scameter+ and raise awareness of its functions among both customers and their intermediaries. In particular, insurers may invite customers and intermediaries to use Scameter+ to check suspicious websites, phone numbers, SMS messages, social media accounts and other digital communications before taking any action.
The IA has maintained an Alert List3 to enhance public awareness of fraudulent websites, phishing emails, impersonation scams and other insurance-related frauds. The Alert List is compiled based on reports received from various sources, including insurers, intermediaries, complainants and members of the public, and is updated from time to time as new cases come to light. The list serves as a crucial source of fraud intelligence, enabling insurers, intermediaries and consumers (also the public) to stay informed of emerging scam trends and fraudulent activities targeting the insurance sector. Intermediaries or policyholders who encounter suspicious communications, websites or domain names are encouraged to consult the IA's Alert List, as well as Scameter+, before responding or providing any personal data. Insurers are also encouraged to subscribe to IA’s notification service4 to receive timely updates to the Alert List and incorporate relevant intelligence into their fraud monitoring and risk management processes. By making active use of these resources and sharing relevant intelligence, we can collectively strengthen our defences against fraud and better protect customers from financial loss and other detriments.
Notes:
2 https://cyberdefender.hk/en-us/scameter/