Hongkongers have been warned about a potential scam involving fake complimentary annual rail passes with a QR code allowing fraudsters to steal people’s personal information through their mobile phones.

Rail giant the MTR Corporation on Wednesday said it was aware of online social media messages about people receiving passes in the mail and had reported the case to police.

Recipients were sent a letter congratulating them on winning an annual MTR pass, with a physical card enclosed. The letter said recipients needed to scan an accompanying QR code to activate the pass.

How to spot a scam? Hong Kong cybersecurity experts share possible ‘red flags’

However, scanning the QR code allowed fraudsters to steal personal information from the victim’s phone, according to social media posts warning people about the scam.

The MTR Corp confirmed “someone” had pretended to be the company.

“We emphasise that the MTR Corporation does not have any programme which involves sending out free annual passes by mail and requiring the recipients to scan a QR code to use them,” it said.

The company had not issued any free yearly passes recently, it added.

It urged the public to remain alert and to guard their personal information carefully.

Hounax changed website address 32 times to evade Hong Kong authorities

“If anyone suspects that they have been deceived, please call police as soon as possible,” the company said.

The Post has contacted police for comment. Reports of the scam have not yet appeared on the force’s “CyberDefender” platform.

Octopus, issuer of stored value cards used on the MTR, said it was also aware of the case and similarly urged vigilance.

The incident is just the latest to target Hongkongers, with the city battling a wave of cybercrime and other fraudulent activity in recent months, including scammers using fake adverts for dog meat and bogus social media accounts pretending to be travel agencies.

Hongkongers scammed out of HK$705 million in 9 months amid fresh alerts by telcos

Last month, authorities launched an investigation after at least 158 people claimed to have been swindled of HK$155 million (US$19.8 million) on a virtual asset exchange platform called Hounax.

Police recorded a 52.5 per cent jump in all types of deception from January to September compared with the same period last year, with 29,650 cases and total reported losses rising from HK$3.38 billion to HK$4.99 billion.