Hong Kong police have for the first time cracked the local operations of an international phishing syndicate, arresting five members of a gang they say stole the personal data of two billion people worldwide.

The scammers used the stolen information to cheat the victims of their credit card details and make online purchases which were later sold.

The operation came to light in May when Singaporean police notified their Hong Kong counterparts that credit card details of residents in the country had been stolen and used to buy electronic goods from chain stores in the city.

After a two-month probe, Hong Kong police identified members of the syndicate in the city. On July 6, officers arrested five people - two Moroccan men and three local women - in Sai Ying Pun, Tuen Mun and Yau Ma Tei.

The five suspects, aged between 26 and 37, were arrested for conspiracy to defraud. They were later released on bail, pending further investigations.

On Monday, police again arrested two of the suspects, a man and a woman, for another offence - access to a computer with dishonest intent. Police froze HK$850,000 worth of their assets, which were believed to be the proceeds of crime. As of Tuesday afternoon, the pair were still being held for questioning.

Acting Chief Superintendent Kelly Cheng Lai-ki of the commercial crime bureau said the roles of the five suspects included sending out phishing emails to their targets, setting up bogus websites to steal credit cards information from victims, and making online purchases.

She said investigations showed the local gang used stolen credit card details to make 150 transactions involving HK$1.3mil . The card owners were from various places, including Europe, the United States and Singapore.

“We also found the personal information of two billion people stored in a computer belonging to one of the suspects. The information included email addresses and names and some were also attached with phone numbers and addresses,” she said.

“The two billion people are from over 40 countries and regions. We believe the gang was planning to use the information to send out phishing emails to steal credit card data and shop online to make money.”

Cheng said it was the first time the force had detected an international syndicate that used phishing scams.

Police believed the gang had been operating in the city for about a year.

A police source said Hong Kong was one of the operational bases run by the syndicate around the world. “We believe its headquarters could be either in Europe or the United States,” he said.

The source said officers seized evidence on how the gang produced phishing emails, sent out massive amounts of such messages and set up a bogus website.

According to police, the syndicate hacked into computers to steal personal information such as email addresses and names. The fraudsters then sent out phishing emails with hyperlinks that directed victims to a bogus website in which victims were persuaded to input credit card details such as card verification value (CVV) numbers.

The source said the scammers usually pretended to work for online music and video providers and used different excuses to trick victims into clicking the hyperlink, asking them to update their credit card information on the website designed to steal the details.

The syndicate then used the card data to buy electronic goods online and sold them to make a profit.

The bureau’s Senior Inspector Cheung Man-hon said each online transaction ranged from HK$200 to HK$30,000 and cards were only used once or twice so the owners might not notice.

Police said further arrests were possible.

 - SCMP