Dataverse | How Selling a Gaming Account Is Landing More Secondary School Students in Scams

For many secondary school students, the most valuable thing on their phone may not be their photos, but a gaming account they have spent years building and painstakingly leveling up. This seemingly ordinary attachment has quietly become a prime entry point for scammers specifically targeting secondary school students.

According to figures released by the police in 2025, in just the first ten months of 2024, there were 1,261 student victims of online scams in Hong Kong, with the youngest being only 11 years old.¹ Police noted that many of these cases involved the buying and selling of gaming accounts. Using high-price purchase offers as bait, scammers specifically targeted young people deeply invested in online gaming, posing as buyers across various platforms to lure students into entering their account login credentials on fraudulent trading sites, before deceiving them out of money under pretexts such as "unfreezing accounts" or "paying a security deposit."

1. Why Are Secondary School Students Particularly Vulnerable to Gaming Account Scams?

To attribute this simply to "greed" would overlook several real and understandable circumstances facing young people.

To them, a gaming account is never just "a game"; it represents a significant investment of time, effort, and sometimes a considerable amount of real money spent on in-game purchases. The idea of switching to a new game and selling the old account to recoup some costs sounds perfectly reasonable, even financially savvy.

More critically, many students are handling money and transactions independently for the first time, yet no one has ever seriously explained to them what risks come with privately transferring an account, or what those "too-good-to-be-true offers" actually signal.

The result: they know the gaming ecosystem inside out, yet are almost entirely ill-equipped when it comes to protecting themselves.

2. Fourteen Gaming Account Scam Cases in One Week: Eight Victims Were Students, the Youngest Just 12

In February 2025, police figures revealed that within a single week, Hong Kong recorded 14 gaming account trading scam cases with total losses of approximately HK$270,000. Among the victims, 8 were students, with the youngest being only 12 years old.

3. How Does a "High-Price Offer" Gradually Become a Trap?

Beyond the statistics, what parents and teachers should understand is how these scams actually operate.

Scammers typically approach players through game chat rooms, Discord groups, social media, or second-hand trading platforms, using offers well above market value to attract attention and make students feel they have found a knowledgeable and financially capable buyer. The scammer then claims the transaction is "inconvenient on the platform" or that "an internal system verification is required," directing the victim to an unfamiliar link to continue the transaction. This is the most critical step in the entire scam; once the victim leaves the original platform, they lose the protections and transaction records it provides. The fake platform then requests the account's login credentials under the guise of "verifying the account's authenticity," allowing the scammer to gain immediate control. Finally, the victim is told that their "account has been frozen by the system" and must pay a security deposit or handling fee to "unfreeze" it, causing the victim to make repeated payments in a state of panic.

The entire process can unfold within a matter of hours, and each individual step does not appear to be an obvious scam on its own. It is precisely this gradual, step-by-step approach that makes it difficult for students to recognise the danger in time.

4. Not Just "Stealing Money": It Could Also Mean "Identity Theft"

Police have specifically warned that the most serious consequence of such scams is often not the one-off financial loss, but the theft of the account identity itself. Once scammers gain control of an account, they can directly steal in-game items, points, virtual currency, and stored credit balances, and even use the victim's identity to continue defrauding other players. If the victim uses the same password across multiple platforms, their social media accounts and even their school email may also be compromised.

In other words, these scams are never a "one-off loss"; they can trigger a chain reaction of long-term security vulnerabilities.

Conclusion: What Can Parents and Teachers Do?

Rather than simply reminding children not to be greedy or not to click on unfamiliar links, a more effective approach is to help them understand the underlying logic of how scams operate and to develop a simple decision-making framework. Many scams succeed not because of sophisticated tactics, but because scammers are skilled at creating a sense of urgency, causing victims to make the critical mistake of leaving the original platform while in a state of anxiety or fear of losing their account. When students understand this manipulation logic, they will be able to recognise the same underlying pattern even as scammers change their tactics or repackage their approach. Parents and teachers can help students remember a few key warning signals that should prompt them to stop immediately: being asked to move the transaction outside the original platform, being pressured to decide on the spot, being asked to keep things confidential, or being required to make advance payments or pay a deposit. If students can internalise these boundaries as habits, they will already be able to avoid the majority of high-risk situations.

For those who wish to build students' cybersecurity awareness in a more systematic way, consider arranging for them to complete targeted short online self-study courses. Co-organised by the Digital Policy Office, the Hong Kong Internet Registration Corporation Limited (HKIRC), and SEED Foundation, and designed specifically for secondary school students, the "Guardians of the Dataverse" online platform delivers cybersecurity courses in a game-based format. Topics covered include common cyber threats such as phishing attacks, malware, and AI deepfakes, as well as password and privacy settings, cookie management, and practical self-protection methods across everyday scenarios including email, mobile devices, social media, browsers, and online shopping. The course includes quiz sections to help students verify whether they have genuinely understood the material, reinforcing the effectiveness of their learning.

Schools wishing to strengthen student training on this topic and other areas of cybersecurity awareness are welcome to join our free online course, "Guardians of the Dataverse" For more details, please contact us.