Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has issued an urgent consumer alert after uncovering a cluster of fraudulent websites masquerading as official e-visa portals for Canada, the United Kingdom and Thailand. The warning, released late on August 3, follows several complaints from residents who were lured into paying application fees of up to HK $1,700 and surrendering passport scans and credit-card details. According to the PCPD, the scam sites use domain names and layouts almost identical to the legitimate immigration pages but redirect payments to overseas accounts. Victims realised they had been duped only when confirmation e-mails failed to arrive or when they were later refused boarding because no valid visa had been issued. The watchdog has referred the case to the Commercial Crime Bureau and asked overseas law-enforcement partners to take down the rogue domains. Why this matters for global mobility teams: Hong Kong is Asia’s third-largest origin market for corporate travel to Canada and the UK, and an estimated 190,000 Hongkongers visit Thailand annually on business or bleisure trips. Visa arrangements for all three destinations are increasingly self-service and digital, making employees prime targets for look-alike phishing portals. A compromised passport copy can enable identity fraud, while charge-back disputes may strand travellers and force costly re-ticketing. Practical steps recommended by the PCPD include bookmarking only the official government URLs (for example, cic.gc.ca for Canada), avoiding sponsored search-engine ads, and verifying secure-socket certificates before entering data. Companies should cascade these guidelines through their travel-booking platforms and consider whitelisting approved links in corporate browsers. Travel managers are also advised to monitor expense claims for unusual ‘visa processing’ charges and to brief staff on reimbursement policies that mandate using official channels. The incident is a reminder that visa cyber-fraud is escalating alongside the worldwide shift to e-authorisations. Australia, New Zealand and Malaysia have also reported cloned sites in recent months. As governments embrace digital mobility, the onus is on employers to embed cyber-hygiene into pre-trip workflows, from automated link-checking in travel approval forms to mandatory cyber-security training for frequent flyers.
