Fake job offers and payment support: check the claimed authority
Alerts from Dubai, Hong Kong and South Africa show different ways authority is claimed. What to verify before paying, sharing ID or trusting an offer.
The brief
A fake job offer in Dubai asked applicants to buy a certificate. A fraudulent Hong Kong payment-support site sought identity and banking information. South Africa’s regulator warned about two unauthorised investment providers. These official, dated warnings concern different schemes, but each makes the claimed organisation or status central to the request.
Our take is to verify three things separately: that an organisation exists, that it has the relevant permission, and that it authorised this particular request. Preserve the result before money or documents move. This is selected coverage from the 29 September–5 October scan, not a worldwide scam total. The alerts do not establish how many victims there were or how much was lost.
The full record
Dubai: a job offer used a firm’s identity
The DFSA’s 29 September warning describes emails impersonating a DIFC-registered firm. They used its logo and a purported HR manager’s signature, then directed applicants to pay USD 105, including VAT, for a “CAP Certificate”. The DFSA said the details were used without the firm’s permission and that the firm had never been DFSA-regulated. The authority advised against communicating with or paying parties connected to the scam.
Our analysis: checking that a company exists would leave the decisive question unanswered. A prospective recruit needs confirmation of the specific job offer and any related payment request through an independently established route to the genuine employer.
Hong Kong: support and verification were the pretext
In an HKICL notice published by the HKMA on 2 October, a fake payment-support website sought identity-document details and photographs, phone numbers and banking information. It also directed people to an impersonated customer-service contact. HKICL said it had no connection with the site and does not directly provide FPS services to individual members of the public. Readers should use the contact route in the official notice if they need to verify a purported HKICL communication.
The HKMA also published a 30 September Mastercard website warning and a 5 October warning concerning a suspicious app associated with OCBC Bank (Hong Kong). Those notices identify separate channels; they are not evidence that the genuine institutions sent the requests.
Our analysis: a request framed as protection or identity verification deserves the same checks as a payment instruction. Do not use contact details supplied by the questionable message as the sole means of confirming it.
Earlier HKICL notices on 29 September and 30 September described similar false buyer-protection or refund services; the latter also directed users to a fraudulent customer-service contact on WhatsApp. A separate 30 September bank notice concerned a fraudulent mobile app using Bank of Singapore’s identity. These additional notices reinforce the same verification issue; we do not infer that they represent separate criminal operations.
South Africa: distinguish an offer from authorisation
The FSCA’s separate 29 September releases state that Maivest and Quilta FX Trade were not authorised by it to provide financial services to the public. The Quilta release specifically says it was purporting to be an authorised provider. The FSCA said it could not reach either using the available contact details. These are attributed regulatory warnings; they should not be rewritten as criminal convictions.
The FSCA’s annual-report announcement, also dated 29 September, records 140 scam alerts during the financial year ended 31 March 2026. That is a count of alerts issued. It is neither this week’s total nor a count of victims or unique criminal operations.
UK: an application is not a grant of permission
A different status distinction appears in the FCA’s 30 September announcement opening crypto authorisation applications. It expressly says authorisation is not automatic. Opening an application route does not mean every applicant has been approved. A claim about regulatory status should identify the entity, the permission and the relevant date.
A record that another person can check
Our analysis: record the exact request, the independently obtained contact or official register used, the person who checked it, the response and any remaining uncertainty. Separate confirmation of an organisation’s identity from confirmation that the message and requested action are authorised.
That makes the check usable at the next handoff. A colleague should be able to see why an instruction was accepted, paused or rejected without repeating the whole conversation. It is the same distinction examined in our UK legal impersonation coverage. No particular software feature, by itself, demonstrates that a request is genuine.
Selected original notices from the 29 September–5 October scan, published after verification on 6 October. Hong Kong pages were read in the live browser; FSCA PDFs were downloaded from controls on its official archive. The selection is not exhaustive and contains no cross-country incidence estimate. The annual figure has a separate reporting period. We do not link to the malicious sites or infer guilt beyond the authorities’ statements.
- DFSA employment impersonation alert, 29 September 2026
- HKICL warning on HKMA website, 2 October 2026
- HKMA Mastercard website alert, 30 September 2026
- HKMA bank app alert, 5 October 2026
- FSCA Maivest warning, 29 September 2026, PDF
- FSCA Quilta FX Trade warning, 29 September 2026, PDF
- FSCA annual-report release, 29 September 2026, PDF
- FCA crypto authorisation gateway announcement, 30 September 2026
- HKICL buyer-protection warning, 29 September 2026
- HKICL refund warning, 30 September 2026
- HKMA Bank of Singapore app warning, 30 September 2026