Case study: tracing fraud proceeds through Hong Kong – fraud response

Assets move. In Hong Kong, they can move very fast. The matter described below is anonymised – details have been altered to protect confidentiality – but the pattern is real and the lessons apply to any fraud where proceeds route through a major regional financial centre before disappearing further east or into a crypto stack.

When fraud proceeds enter Hong Kong, the window for recovery action is narrow but it is not closed. A combination of a worldwide freezing order, a Bankers Trust order for banking disclosure, and coordinated referral to local counsel can – in the right circumstances – stop onward movement before funds leave the jurisdiction. Speed, not paperwork, is the deciding variable.

This case study walks through the situation, the strategy we applied, the process that followed, and the lessons any practitioner or victim can carry forward.

The Situation: a mid-size corporate fraud with a Hong Kong transit leg

A Hong Kong-based regional treasury function of a mid-size trading company discovered, in the spring of 2025, that a series of payments had been redirected over several weeks. The mechanism was a vendor-impersonation fraud: altered banking details on what appeared to be legitimate invoices. By the time the discrepancy surfaced, funds in the high six figures had moved through two accounts in Hong Kong and were already travelling onward.

The client's own bank had been notified, but the receiving accounts were at different institutions. Notification to one bank does not automatically freeze accounts held elsewhere. The client had lost roughly four days before Axiom Trace was engaged. Four days is a long time in payment-trail reconstruction.

There was a second problem. One tranche had already been converted into a stablecoin at a centralised exchange operating in the jurisdiction. That tranche was, technically, still traceable on-chain – but it required a different instrument set.

The Strategy: two parallel tracks before funds left the reach of Hong Kong courts

The first priority was to determine what could still be frozen locally. We have seen, in cross-border mandates, that a practitioner who tries to run every jurisdiction at once often loses the near one. Hong Kong was the nearest actionable forum. Everything else was secondary until we knew what remained there.

Track one was a banking disclosure and freezing application. Local counsel in Hong Kong was instructed within hours of engagement. The approach: apply for a Bankers Trust order to compel the receiving banks to disclose account and transaction information. In parallel, prepare a worldwide freezing order application on a without-notice basis, to prevent the defendant from dissipating whatever remained in reachable accounts.

A without-notice freezing application is standard where giving notice would allow the defendant to dissipate assets before the court sits. That condition was clearly met here.

Track two addressed the on-chain tranche. We used blockchain-analytics tools to establish the wallet journey from the exchange withdrawal through to a cluster of wallets associated with a specific deposit address. The stablecoin had not yet been withdrawn to another exchange. That gave us a choke point: a disclosure order against the VASP holding the deposit address could, if granted quickly enough, surface KYC information tied to the counterparty account.

The two tracks ran concurrently. Co-ordination between the cross-border enforcement work and the on-chain tracing was the core of our role.

The Process: from engagement to first legal steps

Day one: client engagement, evidence package assembled. Banking records, invoice chains, email headers, internal treasury logs – all preserved in a forensic-grade format before anything was forwarded to anyone. This step is not glamorous. It is, in our experience, the step most often skipped, with consequences that cannot be undone later.

Days two and three: local counsel in Hong Kong filed the Bankers Trust order application. The application was made without notice. Bank disclosure followed within a short period of the order being granted. The disclosed records confirmed the onward routing: one leg to a Southeast Asian jurisdiction, one leg to the VASP wallet cluster we had already identified on-chain.

Day four: the worldwide freezing order application proceeded. One account held a residual balance. That balance was frozen pending further order. The amount was a fraction of the total loss. But a frozen fraction is better than a dissipated whole – and it gave leverage for the next stage.

Concurrently, the disclosure order against the VASP was filed. The VASP's KYC records, once disclosed, provided a name and a passport-jurisdiction connection to a third country. That connection opened a separate tracing line that we continued after the immediate Hong Kong phase closed.

We regularly advise clients that the purpose of the first phase is not to recover everything. It is to preserve what can be preserved, establish a verified trail, and create the legal record on which a broader enforcement action can later be built.

Transferable Lessons for Fraud Victims and Practitioners

This matter surfaced three lessons we apply across every similar engagement.

First: reporting to your bank is not recovery action. It is a required notification – and it can, in some cases, trigger an internal recall process. But it does not freeze accounts at other institutions, it does not compel disclosure, and it does not preserve evidence. It is the start, not the strategy. The myth that a bank report is sufficient is one of the most costly assumptions a fraud victim makes.

Do not wait for the bank to report back before taking independent legal steps. The bank's obligations and the client's interests are not the same thing.

Second: the first 48 to 72 hours shape what is recoverable. In Hong Kong, courts can move quickly on urgent without-notice applications. That speed is only available to a claimant who has their evidence in order and local counsel already instructed. If the evidence package is not ready, the hearing window is missed. We have traced fund movements where the difference between recovery and total loss was measured in hours.

Third: on-chain tracing and banking disclosure are complementary, not alternatives. In this matter, neither track alone was sufficient. The banking records confirmed the routing; the on-chain analysis identified the choke point; the VASP disclosure produced the identity anchor. Practitioners who rely on only one of these tracks miss the case that the other one builds.

There is a further point worth stating directly. The client in this matter had, before contacting Axiom Trace, received an unsolicited approach from a firm offering to "recover" the funds for an upfront fee. That firm had no apparent legal basis, no local counsel, and no identifiable process. It was, almost certainly, a recovery-focused fraud layered on top of the original one. Second-stage recovery scams target people who are already frightened and under time pressure. Legitimate recovery work does not begin with an unsolicited approach and an upfront fee. It begins with a frank assessment of what the evidence supports.

For further context on fraud response in the first hours after a loss, see our fraud response insight hub. For jurisdiction-specific information on proceedings in this region, see our Hong Kong asset recovery overview. For a related pattern involving onward movement of scam proceeds to another jurisdiction, see our analysis of what to do when scam money lands in Kazakhstan.

If funds have already moved and you are assessing whether recovery action is viable, time matters. Request a confidential case review at info@axiomtracel.com.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In Hong Kong, we routinely coordinate proceedings with local counsel in the jurisdiction. To discuss a matter, contact info@axiomtracel.com.

We have coordinated multi-track recovery matters where the banking and on-chain evidence streams were built in parallel from day one. Disciplined first steps – evidence preservation, prompt local counsel instruction, and a clear analytical framework – are, in our experience, the strongest indicator of whether a matter can be advanced at all.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.