HKSAR v. Mio Chiu Hing and Others
Read the full judgment text of DCCC 720/2024 on BabelCite. This District Court judgment was delivered on 15 April 2025.
1. All three defendants pleaded guilty to one count of Conspiracy to defraud with which they were jointly charged, contrary common law and punishable under section 159C (6) of the Crimes Ordinance, Cap 200.
Cited by 1 case · Cites 9 cases
|
DCCC 720/2024 [2025] HKDC 680 IN THE DISTRICT COURT OF THE HONG KONG SPECIAL ADMINISTRATIVE REGION CRIMINAL CASE NO 720 OF 2024 ________________________
________________________
________________________ REASONS FOR SENTENCE ________________________ 1.All three defendants pleaded guilty to one count of Conspiracy to defraud with which they were jointly charged, contrary common law and punishable under section 159C (6) of the Crimes Ordinance, Cap 200. Facts 2.SIM cards obtained through online applications to China Mobile Hong Kong (CMHK) were used in conjunction with a modem pool to send out a vast amount of phishing SMS messages which appeared to have been sent from legitimate courier companies such as SF Express regarding failed parcel deliveries. These phishing messages were sent with a view to luring the recipients to provide their credit card credentials to a phishing website set out in the messages. Credentials stolen in this way were used to set up on mobile phones virtual wallets which were then used to make unauthorized purchases without producing the credit cards. 3.On 8 November 2022, 3 recipients (the victims) of such phishing messages were asked to and did input their credit card credentials and the one-time password (OTP) in a phishing website which was made to look like the webpage of “SF Express” in the belief that such credentials were needed to effect payment of a handling fee of HK$6 to the courier. Later that day, their credit cards were used by others to carry out unauthorized transactions, which resulted in a total loss of HK$19,399 to the victims. The known credit limit of these cards amounted to HK$313,000. D1’s role 4.D1 was responsible for redeeming SIM cards with QR codes that he received from other people, setting up and configuring a modem pool and inserting SIM cards into the pool. 5.He was arrested on 8 November 2022 in a hotel room in Mong Kok (the Hotel Room). The police found in the Hotel Room a modem pool with 32 slots, 20 of which were inserted with SIM cards (3 of which were linked to the victims’ phone numbers), a router inserted with one SIM card, 53 other SIM cards and 3 mobile phones. 6.Under caution, D1 stated that he was recruited online to operate modem pool to defraud others, and that he did it for money. 7.In subsequent cautioned video-recorded interviews, D1 said that about a week ago D2, his friend for 3 to 4 years, introduced him for a job and obtained from him his personal information and residential address. Around 3 November 2022, D2 added him to a Telegram group called “Router” （the TG group）. Members of this group included “Yau”, “KK” and others. Yau asked D1 to expect delivery of a parcel, the contents of which would be used for committing fraud. Around 5 November 2022, the parcel was delivered to D1’s home. The parcel contained a modem pool, a router and around 10 CMHK SIM cards. D1 set up the equipment as instructed by Yau. The following day, D1 collected a laptop computer (laptop) and about 10 CMHK SIM cards from KK. He brought these items home, connected the modem pool to the laptop and installed a programme on the laptop, which was then operated remotely by Yau for about an hour. Later that day, he rented the Hotel Room. On 7 November 2022, he returned home where, under the instructions of Yau, he operated the modem pool by inserting 15 SIM cards into it. Later, he returned the laptop to KK and took the router and the modem pool to the Hotel Room and set them up there. On 8 November 2022, after redeeming 15 CMHK SIM cards with QR codes that he received from KK, he went to the Hotel Room, removed the SIM cards that were already in the modem pool and put in 22 new SIM cards. He was arrested later that day. He admitted that he knew the scheme involved fraudulently obtaining credit card credentials belonging to others. Up to the time of his arrest, he had not received any remuneration. D2’s role 8.D2 was responsible for redeeming SIM cards, monitoring the modem pool, making fraudulent purchases with virtual wallets, reselling the purchased goods, recruiting D1, liaising with and handing over the crime proceeds to D3. 9.He was arrested by the police in a hotel in Causeway Bay on 8 November 2022. 2 mobile phones were seized from him. Under caution, D2 stated that he and his friends stole credit card credentials belonging to others, linked the credit cards with Samsung Pay to make purchases, then sold the purchased goods for cash. He had purchased SIM cards and inserted them into the modem pool in order to obtain other people’s credit card credentials. 10.In subsequent cautioned video-recorded interviews, D2 said that in mid-October 2022, he was invited by someone in a bar for a job involving operating a modem pool and making credit card purchases. He knew the scheme involved inserting SIM cards into modem pool for sending out phishing messages requiring victims to input their credit card credentials which would be linked to mobile phones for making purchases. On 6 to 7 occasions in October 2022, he was given by D3 mobile phones linked to credit cards belonging to others and he used those phones to purchase Apple products, which he later sold. He would keep 10% of the sale proceeds. The rest of the proceeds along with the phones would be handed back to D3. On 4 November 2022, he was added to the TG group. His name in the group was “KK”. It was he who added D1 to the group, which included “Yau” and others as well. QR codes would be sent out via the TG group for redemption of SIM cards at convenience stores. On 7 November 2022, he redeemed 15 SIM cards which he passed to D1. He was asked via the TG group to redeem SIM cards for a reward of HK$500 and to monitor the modem pool for a reward of HK$700. In total, he had obtained around HK$5,000 for making credit card purchases, HK$700 for operating the modem pool and HK$500 for redeeming SIM cards. D3’s role 11.D3 was responsible for recruiting others to join the conspiracy, arranging tasks for other members, providing the necessary tools for carrying out the scheme and making payment to other members. 12.He was arrested in his own home on 9 November 2022. Under caution, he claimed that he had been instructed by D2 and others to register 11 SIM cards for a reward of HK$800. 13.In subsequent cautioned video-recorded interviews, D3 stated that on an unknown date, D2 introduced him to an unknown man who promised D3 a reward of $800 for the use of the Wi-Fi at his home to register CMHK SIM cards for elderly people. Using D3’s home Wi-Fi, that man did register CMHK SIM cards with the personal information of 11 elderly people. D3 claimed that he did not receive any reward for this in the end. Other investigations 14.The SIM cards that were linked to the victims’ phone numbers were ordered online using the IP address of D3’s home. 15.Communication records of the TG group found on D2’s phone showed that D2 was added to the group on 4 November 2022. D1 was added by D2 to the group on the same day. The TG group had 6 members. Yau and other members gave instructions for redeeming SIM cards with QR codes and instructions for setting up the modem pool, the router and the laptop. The TG group contained 43 photos of the modem pool, the router and the laptop, and 34 photos of QR codes. 16.WhatsApp conversations between D2 and D3 showed that:
Defendants’ Backgrounds D1 17.D1 has a conviction for theft for which a Rehabilitation Centre Order was made on 20 April 2023. 18.He was born on 25 November 2004 in Hong Kong and was schooled to Form 4 level. At the time of this offence, he was aged 17. Now he is 20 years old. 19.D1 never saw his father who had left his mother before D1 was born. His mother later formed a relationship with another man who D1 regarded as his stepfather. His mother had drug and mental problems and never took part in his upbringing, which fell on the shoulders of the stepfather’s mother. The stepfather committed suicide when D1 was 6 years old. When the stepfather’s mother became too old to look after D1, he was sent to a foster family. In 2022, D1’s mother committed suicide as well. D2 20.D2 has 3 convictions, one was committed before and 2 were committed after the present offence. None of these convictions are of a similar nature to the present offence. None of them resulted in any sentence of imprisonment. 21.He was born on 17 August 2004 in Hong Kong. He dropped out of secondary school in 2020. At the time of this offence, he was aged 18. Now he is 20 years old. His family consists of his parents and a younger sister. D3 22.D3 has a conviction dated 16 October 2024 for trafficking in dangerous drugs for which he finished serving a sentence of 20 months’ imprisonment on 15 November 2024. 23.He was born on 10 December 2004 in Hong Kong and completed Form 6. At the time of this offence, he was aged 17. Now he is 20 years old. He is his parents’ only child. Mitigation D1 24.Counsel for D1 Mr Pannu asked the Court to note that the conspiracy lasted for about a month, that the loss caused was HK$19,399, and that D1’s role can be said to be a relatively minor cog in the conspiratorial wheel. 25.It appeared that D1 was involved in the conspiracy for seven odd days before his arrest, and his activities involved mainly gofer work such as picking things up from the mastermind and setting things up according to instructions given by others. He was not an IT expert but was just an expendable pair of hands hired by his friend D2. 26.Moreover, D1 was not involved in the setting up of virtual wallets with stolen credit card credentials, or in making purchases with those wallets. 27.Mr Pannu further submitted that the statement produced by the prosecution in support of its application for enhancement of sentence does not prove beyond reasonable doubt the prevalence of the particular kind of conspiracy to defraud that this case is concerned with. Moreover, the figures in the statement do not show the actual harm done to the society. 28.3 mitigation letters coming respectively from D1’s foster parents, his former teacher and his former classmate were submitted. The foster parents spoke of D1’s sad and unfortunate family background, attested to D1’s fundamental goodness and took the view that his breaches of the law were partly driven by his misfortunes. D1’s former teacher said D1 was a simple, lovable and well-behaved student, and that D1 is now truly remorseful. D1’s former classmate expressed a similar view of the defendant. D2 29.Mr Albert Cheung, counsel for D2, admitted that the biggest mitigating factor was his client’s early guilty plea. He pointed out that D2 was co-operative with the authorities, has learned his lesson, is remorseful and understands the need to make a fresh start and stay out of trouble. 30.D2’s mother said in her mitigation letter that she observed significant changes in her son since his remand. She pointed out that D2 had become more mature and prudent, and he deeply regretted what he had done in this case. 31.Mr Cheung made no submission with regard to the application for enhancement of sentence. D3 32.Counsel for D3 Mr Richard Leung conceded that the fraudulent scheme involved in this case was quite sophisticated. Fortunately, the conspiracy did not last very long and the loss caused was not tremendous. Moreover, prior to the commission of the present offence, D3 had a clear record. Mr Leung urged the Court to consider a starting point within the range of 3 years to 3 ½ years. 33.D3 has been remanded in custody since 9 September 2023 for a drug-trafficking offence. Having served his sentence for that offence, he indicated his desire to plead guilty to the present offence, made no bail application and has since remained in custody. This course of action demonstrates his remorse and his willingness to shoulder his responsibilities. D3’s remorse and determination to turn over a new leaf are borne out by the mitigation from him and his parents respectively. 34.Mr Leung did not challenge the statement presented by the prosecution in support of its sentence enhancement application, but would like to point out that the number of phishing scam cases as well as credit card misuse cases have both been on the decline since 2023, indicating that both types of cases have become less prevalent by 2024. He therefore urged the Court not to enhance the sentence. However, should the Court accede to the application for enhancement, he asked that the sentence be increased by no more than 25%. Sentencing considerations 35.The offence which the defendants admitted is a serious one. According to s.159C (6) of the Crimes Ordinance, the maximum penalty upon conviction on indictment is 14 years’ imprisonment. 36.There are no sentencing tariffs for this kind of offence, which can be committed in a variety of ways. However, there are factors which can be taken into consideration in assessing sentence. Since this case involves both internet fraud and credit card fraud, sentencing cases concerning either or both of these types of fraud can be of assistance. 37.On behalf of D1, Mr Pannu referred to the District Court case of HKSAR v Ait Benaoumar Yassine [2023] HKDC 341 where the defendant pleaded guilty to 21 counts of Theft and 2 counts of Fraud arising out of purchases made with credit card credentials obtained through phishing scams. The Court took the view that 45 months’ imprisonment was sufficient to reflect the defendant’s overall criminality. After giving a one-third discount for the guilty pleas, the eventual sentence was 30 months. 38.Mr Pannu argued that D1’s role is incomparable to the all-inclusive criminality perpetrated by the defendant in Yassine case, who single-handedly played the role of the instigator, the participant in all roles, and eventually the purchaser of the items and the realization of the money. The scam in that case lasted over a year, involved 21 purchases and a total loss of well over $200,000. 39.Mr Pannu suggested that a starting point of 20 to 30 months could not be faulted given D1’s limited role, and that guidelines are inappropriate for cases of this nature, as the superior courts have always indicated. 40.On behalf of D3, Mr Leung pointed out that there are no sentencing tariffs and that the factors relevant to sentencing are the sophistication and size of the fraudulent scheme, the number of victims, the length of time the scheme was perpetrated, the amount of money obtained or lost and individual defendant’s involvement and role in the scheme. The cases of HKSAR v Dai Chi Wai [2011] 4 HKLRD 534 [3]-[6] and R v Chan Sui To & Anor [1996] 2 HKCLR 128 were referred to for these sentencing factors. 41.Dai Chi Wai is a conspiracy to defraud case involving the use of false instruments to apply for letters of credit from banks. The Court of Appeal pointed out that sentencing factors should include “the amount of money involved, the number of banks deceived, the period over which the fraudulent act was committed, whether the banks had suffered any loss and the roles played by each of the defendants.” 42.Chan Sui To was concerned with the use of counterfeit credit cards by criminal syndicates. The various factors to be taken into consideration in sentencing credit card fraud include: (i) the size of the operation; (ii) the planning that had gone into the perpetration of the fraud; (iii) whether there was an international dimension; (iv) the role played by the accused; and (v) whether there was a plea of guilty. After referring to a number of decisions, the Court of Appeal said:
43.In the more recent case of Secretary for Justice v Chung Pui Kit Billy [2023] 2 HKLRD 825, when referring to the Chan Sui To guidelines, the Court of Appeal pointed out that “Clearly, these sentencing guidelines were addressing the particular type of credit card fraud that was then prevalent and were calculated on sums of money that were based on cost of living at the time. This needs to be borne in mind when referring to the sentencing guidelines in the context of current criminal conduct which may be not only different but more elaborate.”[1] 44.The Court further warned that “The reliance on or reference to sentencing guidelines in this way does create problems, especially when they are dealing with a particular form of criminal activity and may now need updating because of the passage of time and changing circumstances. It is apparent that the criminality of credit card frauds has changed and there is less and less syndicated counterfeit credit card frauds but more online frauds where offenders are fraudulently using credit card information and other fraudulent methods to defraud others.”[2] 45.HKSAR v Leung Yiu Fai CACC 100/2014 was concerned with fraudulent online sale of admission tickets to Halloween activities held by Ocean Park. The Court of Appeal pointed out that factors rendering the crime in question serious include: (i) its target being the public, any member of the public will be exposed to the risk of being defrauded; (ii) online frauds are easy to imitate and easy to carry out, and if not deterred, a large number of similar crimes may occur; (iii) since online transactions do not involve face-to-face transactions and the perpetrators can use different methods to conceal their identities, these crimes are difficult to detect; (iv) victims’ losses are generally extremely difficult to recover. [3] 46.The Court went on to say that it would impose harsher sentences on certain unscrupulous, annoying and shameless fraud cases targeting the public, such as street scams, phone scams etc in the hope of deterring these crimes and preventing innocent people from being harmed. The amount of money involved in this type of crime is not necessarily too large, and even if the defendant has no criminal record, the court would adopt a starting point of 3 to 4 years. [4] 47.In Secretary for Justice v Kong Chi Kiu [2023] 1 HKRD 72, on the gravity of internet frauds, the Court of Appeal said, “…this was an internet fraud, which by its very nature has unlimited reach, is relatively easy to perpetrate but difficult to detect and from which it is often impossible to recover losses. As such, there must be a significant element of deterrence for those contemplating committing such offences.”[5] 48.The conspiracy in our case lasted from 7 October 2022 to 8 November 2022. It was on the last day of the conspiracy period that the 3 victims’ credit card credentials were stolen and used in unauthorized transactions, resulting in a loss totalling HK$19,399. 49.From the WhatsApp conversations between D2 and D3 and from D1’s confession, it seems that the tools and equipment for dissemination of the phishing SMS messages were set up and ready for deployment on or about 5 or 6 November 2022. 50.It is not clear how many phishing messages were sent out, but according to the defendants’ confessions, it appears that no less than 41 SIM cards had been redeemed (D1 and D2 each redeemed 15 cards whereas D3 redeemed 11 cards) for that purpose. This amount of SIM cards, coupled with the employment of a modem pool with a capacity for 32 SIM cards, give some idea as to the size of the operation. There is also the admission by D1 that at one stage, he had replaced the 15 SIM cards that were already in the modem pool with 22 cards. 51.With regard to D1’s role, I agree with Mr Pannu’s submission that what D1 did was mainly gofer work – redeeming SIM cards, receiving and setting up the modem pool, router and the laptop, inserting SIM cards into the modem pool to enable someone else to operate the equipment remotely. These matters require little to no technical skills. Although playing a necessary role in the scheme, his skills and work are not so unique as to be irreplaceable. His role fits the description of “a cog in the wheel”. 52.However, I do not accept the submission that the fact that D1 had received no remuneration underscores that his participation was not driven by personal gain but by a desire to help a friend. One must not lose sight of what he said under caution upon his arrest, namely he did it for money. 53.This scam was aimed at members of the public at large. Given the popularity of online purchases these days, expecting deliveries from courier companies has become an experience shared by people from virtually all walks of life. Unsuspecting and even cautious individuals can fall prey to messages seemingly coming from legitimate courier companies alleging problems with delivery of parcels and requiring remedial actions to be taken to rectify the problems. This kind of phishing scam is just as unscrupulous, annoying and shameless as the scams mentioned in Leung Yiu Fai case, and the sentence for it should contain “a significant element of deterrence”. 54.If D1 was an adult offender, I would adopt a starting point of 3 years’ imprisonment. 55.However, he is currently 20 years old, and was only 17 at the time of the offence. In view of section 109A(1) of the Criminal Procedure Ordinance, I called for a Detention Centre/Training Centre Suitability Report (the Report) to see if he can be dealt with otherwise than by way of imprisonment. 56.The Report says D1 is mentally and physically fit for detention in either Centre, but is more suitable for detention in a Detention Centre. Having considered the contents of the Report, which makes reference to his personal background, his breaches of the law and his failure to comply with the institution’s rules while he was being remanded in Pik Uk Correctional Institution (PUCI) for the present case and his upcoming drug-trafficking case, it is obvious that he has limited realization of his problems and is in need of strict disciplinary training to enforce his rule- and law-abiding concepts. I accept the assessment officer’s opinion and order that D1 is to be detained in a Detention Centre. 57.D2 was more extensively involved than D1. He played a part in the recruitment of members, redemption of SIM cards, monitoring of the modem pool, making purchases with mobile phones embedded with virtual wallets, reselling the purchased goods and handing over the proceeds to D3 for distribution. If he was an adult offender, I would adopt a starting point of 3 years 6 months for the role he played in a scam which can be said to be a small but bordering on medium scale operation. 58.In view of his current age, I also called for a DC/TC Suitability Report. His Report says he is mentally and physically fit for admission to either Centre, but is more suitable for detention in a Detention Centre. 59.Having considered the whole report, in particular the parts about his repeated transgressions of the law and his resort to various criminal activities such as triad-related gang fights, drug trafficking and debt collection, and his failure to behave himself in accordance with the rules when he was being remanded for the current Report, it is obvious that this defendant has a weak law-abiding concept and little to no insight into his problems. His alleged determination and readiness to reform himself are open to doubt. He is obviously in need of strict discipline and a vigorous routine. The programmes available in the Detention Centre will hopefully mend his unruly ways and bring him back on the proper track. I accept the recommendation made by the assessment officer and order that D2 is to be detained in a Detention Centre. 60.D3 was involved in the recruitment of and payment of rewards to members of the scam, arrangement of tasks for members and provision of tools and equipment for the carrying out of the scam. He had also registered 11 SIM cards. 61.The WhatsApp conversations between D2 and him give the lie to D3’s claim under caution that he had been instructed by D2 and others to register 11 SIM cards for an $800 reward. He may have registered 11 SIM cards, but it was extremely unlikely that he was acting under the instruction of D2 who, according to those conversations, had been recruited by himself. 62.D3 is also 20 years old now. By reason of his previous drug-trafficking conviction, he is a person who has been convicted of an excepted offence. Section 109A(1A) of the Criminal Procedure Ordinance declares that section 109A(1) does not apply to such a person. In light of the information before me about this defendant’s condition and background, the facts of the case and the gravity of the offence, I am satisfied that a sentence of imprisonment is the right way of dealing with him. 63.For the part played by D3, I would adopt a starting point of 3 years 6 months’ imprisonment. His guilty plea would reduce this to 2 years 4 months. 64.As for the prosecution’s application for sentence enhancement under paragraphs (c) and (d) of section 27(2) of the Organized and Serious Crimes Ordinance (OSCO), Mr Pannu objected to the application on the ground that “prevalence” was not proved. He argued that the information and data set out in the statement relied on by the prosecution in proof of their application (the statement)[6] were based on generic figures and not specific ones. 65.In support of his arguments, Mr Pannu cited HKSAR v Chan Ka Kin & Anor CACC 474/2004 where the Court of Appeal said,
66.In HKSAR v Li Kin Keung [2012] 4 HKC 303, McWalters J (as he then was), giving the judgment of the Court of Appeal, said,
67.In our case, “Phishing Scam” is defined in the statement as cases involving the sending of unsolicited messages that mimic a trusted third party/organization. The aim is either: (a) to trick victims into clicking on a malicious website which allows the culprit to lure the victims into providing sensitive data such as personally identifiable information, banking and credit card details, login credentials and so on; or (b) to trick victims into providing personal information by responding to the messages. 68.“Credit Card Misuse” is defined in the statement as any fraudulent online purchases made using the victim’s credit card information. 69.As for the MO of this case, the statement says it falls under the category of “Phishing Scam” with an element of “Credit Card Misuse” as the victims’ credit cards were misused in making fraudulent transactions. 70.In my view, the figures and statistics provided in the statement of cases falling under the phishing scam and credit card misuse categories are relevant to the s 27 OSCO application. They relate to the prevalence of the acts carried out pursuant to the conspiracy we are concerned with, and they are about this specific kind of conspiracy to defraud, namely conspiring to steal credit card credentials by phishing and using the stolen credentials for unauthorized purchases. 71.As for the observation that the numbers of phishing scam cases and credit card misuse cases have both dropped in 2024, one should bear in mind what the Court of Appeal in paragraphs 15 and 16 of its judgment in HKSAR v Xu Mai Qing CACC 464/2005 said,
72.The number of cases and the amount of loss for both phishing scams and credit card misuse have indeed declined in 2024. However, looking at the overall figures, the number of credit card misuse cases and the cumulative loss had both steadily been increasing since 2019, reaching the peak in 2023, and then declined in 2024. Moreover, the numbers for the year 2024 (656 cases and HK$10.3 million loss) are still higher than those for the year 2022 (544 cases and HK$8.7 million loss). 73.It is true that the statement sets out only 2 years’ data and figures in respect of phishing scams, and these data show that for the year 2023, there were 4,322 reported cases involving a total loss of HK$102.4 million, whereas for 2024, there were 2,731 reported cases involving a total loss of HK$53.5 million. As for credit card misuse cases, data and figures are available from 2019 to 2024. Looking just at the figures for 2023 and 2024, there were 933 reported cases with a total loss of HK$11.4 million for 2023, and these figures declined to 656 reported cases and a total loss of HK$10.3 million for 2024. 74.It is worth-noting that the number of phishing cases and the total loss resulting therefrom for 2024 (2,731 cases, total loss of HK$53.5 million) are both higher than their corresponding figures for credit card misuse for its peak year of 2023 (933 cases and HK$11.4 million). 75.Moreover, in 2024, there were 2,731 reports of phishing scams involving a total loss of HK$53.5 million and 656 reports of credit card misuse involving a total loss of HK$10.3 million. There were still a lot of such cases in 2024, resulting in significant losses. 76.I find it proved beyond reasonable doubt that these means of committing crimes are still prevalent, causing significant harm to the community and raising obvious concerns. The bases for enhancement of sentence have been established. 77.I am in agreement with parties’ view that a Detention Centre Order cannot be enhanced. There will therefore be no enhancement for D1’s and D2’s sentences. 78.Although D3’s sentence of imprisonment can be enhanced, given that both D1 and D2 will not have their sentences enhanced, as a matter of fairness to D3 and to obviate an understandable sense of grievance that he might otherwise have if he was the only defendant in a joint charge to receive an enhanced sentence, I will not enhance his sentence, even though I am satisfied as to the prevalence of this mode of committing the present offence, which is a specified offence, and would otherwise consider an enhancement of one-third to be appropriate. D3’s final sentence is 2 years 4 months’ imprisonment.
|
Cases cited in this judgment
Other judgments that cite this case