Identity theft in Hong Kong:
HKID lost or leaked, or an account opened in your name?

Your ID or data has leaked: 3 urgent steps

1. 1

   Report to the police and get a report number

   If someone has used your identity to open accounts, borrow or sign contracts, report it to the police. The Privacy Commissioner also says identity theft involving crimes should be reported to the police. Keep the report number for follow-ups with banks, lenders and regulators.

2. 2

   Check your TransUnion credit report and set up alerts

   Get your personal credit report from TransUnion and look for loans, cards or credit enquiries you didn’t make. Since 2022 TransUnion has offered a free Basic Credit Alert Service (18 or over, valid HKID) that emails you about new loan enquiries, new credit accounts, or new addresses or phone numbers. TransUnion has also announced a free credit report offer for people who lost their HKID – check TransUnion for current terms.

3. 3

   Lost HKID: report and replace within 14 days

   According to the Immigration Department, you must report the loss and apply for a replacement in person at any Registration of Persons Office within 14 days of finding out (no appointment needed; or within 14 days of returning to Hong Kong). The fee is HK$370, and the old card becomes invalid once reported.

How to ask banks and lenders to cancel accounts and debts you didn’t open

1. 1

   Notify the institution in writing

   Use the template below and send it to the bank or lender’s customer service or complaints team with your police report record. Ask it to freeze and investigate, stop pursuing you, and confirm the outcome.

2. 2

   Ask for your credit record to be corrected

   Once it’s confirmed the account or loan isn’t yours, ask the institution to have TransUnion correct your record, then check your report again yourself.

3. 3

   Not handled properly? Escalate

   For banks, complain to the HKMA; for money disputes, consider the Financial Dispute Resolution Centre (FDRC); for personal data issues, the Privacy Commissioner.

Replace the [ ] parts with your details. You can mask part of your HKID number on copies.

Subject: Declaration – account / credit not opened by me (HKID first 4 characters: XXXX)
To the Customer Service / Complaints Department, [Bank or lender name]:
I am [name], HKID first 4 characters [XXXX], phone [number].
I recently found out [through my TransUnion credit report / from a collection letter / from your notice] that an [account / credit card / loan] was opened in my name with you (reference no. [number], if known). I declare that I never applied for, authorised or used this [account / card / loan], and never received any money from it.
I reported this to [police station] on [date], report no. [number]. [If applicable: I reported my HKID lost and applied for a replacement on [date].]
I ask you to:
1. Acknowledge this declaration in writing and, as far as the law allows, provide the opening date, application channel and identity documents used for the [account / loan]. I also make a data access request under the Personal Data (Privacy) Ordinance for copies of the application forms and related records submitted in my name;
2. Freeze and investigate the [account / loan] immediately and stop pursuing me for any payment;
3. Once confirmed, cancel the [account / debt] and ask credit reference agencies (such as TransUnion) to correct my credit record;
4. Reply to me in writing with the outcome.
Attachments: [HKID copy (part of the number may be masked), police report record, relevant credit report pages, collection letter copy]
[Name]
[Date]