Hong Kong

A Free Address Undermines a Credible Business

A client, supplier, or bank that receives an invoice from a free personal mailbox reads it as unpolished, not professional. In Hong Kong's business environment, a domain-matched email address is one of the simplest signals that a company is properly established and worth trusting with a contract. Professional email is a small investment that pays back in credibility every time a message is opened.

Phishing Is the Leading Cause of Cyberattacks on Hong Kong Enterprises

Hong Kong's Privacy Commissioner for Personal Data (PCPD) found that phishing attacks, which trick recipients into handing over sensitive information, were the main culprit behind cyberattacks on local enterprises, affecting 96% of the businesses that were attacked. Hong Kong authorities separately reported a record 15,877 cybersecurity incidents in 2025, a 27% year-on-year increase, with AI-enabled attacks, phishing, and supply chain compromise flagged as the leading risks. The PCPD has also documented cases where a finance employee at a multinational company was deceived into transferring funds after receiving a convincing fraudulent request, underlining how business email compromise continues to exploit routine payment workflows in the city.

Unverified Domains Get Sent to Spam or Blocked

Mailbox providers score every sending domain before a message reaches an inbox. A domain without SPF, DKIM, and DMARC authentication looks unverified to these filters and gets routed to spam or blocked outright, regardless of how legitimate the sender is. Every quote, invoice, or follow-up lost this way is business the company never knew it lost.

Hong Kong's PDPO Applies Directly to Business Email

Hong Kong's Personal Data (Privacy) Ordinance (PDPO), enforced by the PCPD, places responsibility on organizations, as data users, to ensure the security of personal data they hold and process at every level. While a mandatory data breach notification requirement has been proposed but not yet enacted, the PCPD has grown more active in enforcement, issuing a sharp rise in investigation reports on data breaches at Hong Kong organisations in recent years. Business email, which routinely carries customer records, contracts, and financial correspondence, falls within the scope of this ordinance.

What to Do Right Now

Every week spent on an unverified or personal mailbox adds to the risk of impersonation, blocked mail, and BEC fraud. Hong Kong businesses should move to a verified company domain, implement SPF, DKIM, and DMARC authentication, and require phone or callback verification for any payment or bank-detail change requested by email. UCN Mail is built to make that shift straightforward — professional email with the authentication, security, and reliability a Hong Kong business needs to be trusted and reach the inbox.

A Deepfake Video Call Tricked a Finance Employee Into Sending $25.6 Million
In one of the most cited cases in the region, a Hong Kong finance firm employee joined what looked like a normal video call with the company's CFO and colleagues — every face and voice deepfaked — and was convinced to transfer $25.6 million across 15 overseas bank accounts. The scam started, as most do, with a convincing email setting up the call. A properly authenticated business domain won't stop a deepfake video, but it makes the initial email impersonation that sets the trap in motion much harder to pull off.

Phishing Drove 57% of a Record 15,877 Cybersecurity Incidents in 2025
HKCERT recorded 15,877 cybersecurity incidents in Hong Kong in 2025, a 27% jump year-on-year, with phishing accounting for nearly 60% of all cases — a five-year high. Nearly 30% of enterprises still lack any dedicated cybersecurity personnel, leaving many small businesses relying entirely on basic email hygiene as their main line of defense.

A Sold Database of 106,000 Business Contacts Raises the BEC Stakes
Threat intelligence researchers found a threat actor advertising a database of roughly 106,000 Hong Kong business entries — contact emails, phone numbers, and product details — explicitly marketed as useful for phishing and business email compromise targeting. When attackers already have your suppliers' and clients' real contact details, the only remaining line of defense is making sure any email claiming to be from your business is provably, verifiably yours.

A Free Gmail or Yahoo Address Still Undercuts a Serious Business
Many small Hong Kong businesses default to a personal Gmail or Yahoo address, which can look informal next to a competitor emailing from [email protected]. A domain-matched address is a small, low-cost way to look as established as the business actually is.

Getting Started: What You'll Need
Have your domain name ready (or one to register), a short list of who needs a mailbox, and about 15–20 minutes to update your domain's DNS records with your registrar. UCN Mail handles domain verification and authentication setup, so your invoices and client correspondence land reliably — and are far harder for a scammer to convincingly spoof.