Source:
https://www.linkedin.com/pulse/identity-theft-higher-education-rick-s-swenson-vuhuc
過去 3 個月內，香港發生兩宗大規模的學生個人資料被盜竊事件，受影響的學生人數接近 17 萬，以下是重點：
Case 1
考評局：16,900 名申請兩項國際考試內地居住人士資料外洩
RTHK 2026-10-30
https://news.rthk.hk/rthk/ch/component/k2/1876013-20261030.htm
節錄：（香港）考評局表示，昨日發現涉及約 16,900 名申請兩項國際考試的內地居住人士之個人資料外洩，相關個人資料包括姓名、出生日期及電郵地址，已報警及通報個人資料私隱專員公署，並會全力配合警方及相關機構的調查和跟進工作。
Case 2
私隱專員公署稱 Canvas 資料外洩事故涉 4 間教育機構
逾 15 萬人受影響
Now TV 新聞台
2026 年 8 月 20 日
https://news.now.com/home/local/player?newsId=659335
節錄：（香港）私隱專員公署發表網上教學管理平台 Canvas 資料外洩調查結果，涉及四間教育機構，共逾 15.3 萬人受影響。早前七間教育機構向私隱專員公署通報稱，可能受第三方網上教學管理平台 Canvas 遭黑客入侵一事影響。公署稱，經調查後證實四間教育機構受影響，包括城市大學、演藝學院、建造學院及科技大學。當中城大牽涉人數最多、逾 14 萬名學生及員工的姓名和電郵等資料外洩，演藝學院及建造學院則分別有逾 4 千及 2 千人受影響，科大受影響人數則有待核實。
高等院校學生成為身份盜竊 (Identify Theft) 的熱門目標
為什麼高等院校的學生會成為身分盜竊 (Identify Theft) 的熱門目標？從犯罪集團的角度來看，大學生有以下的優點：
（一）大學或高等院校的學生未有信貸記錄 (Credit History)，但開始承擔財務責任（例如：申請信用卡，開設銀行戶口，申請學生貸款或政府資助）。因為未有信貸記錄，財務背景相對乾淨，從犯罪集團的角度看，是零成本但高效益的原料，適合用來騙取銀行貸款或政府資助。
（二）大學生常使用手提電腦和智能手機，習慣使用社交媒體（騙徒出沒的平台）和經常上網購物，但是缺乏保護個人資料的意識，對資訊保安認識不深，也沒有養成定期檢查信用評級或信貸報告的習慣。如果是內地生，就算發現個人資料被盜竊，因為對香港的制度缺乏認識，不知道應該向那個政府部門求助，騙徒於是有更多的時間逃走或消滅犯罪證據。
（三）部份院校學生會尋找兼職工作或實習機會，騙徒透過網上的招聘平台可以輕易接觸到學生。騙徒透過假的招聘廣告配合假的公司網頁，就可以透過網上表格輕易收集到院校學生的個人資料以及各種文件（例如：真的畢業證書），然後詐騙銀行或政府。如果有進行影像面試，更可以趁機收集受害人（大學生）的面貌和聲音特徵，然後用深偽 (Deepfake) 技術複製，用來進行詐騙。
北韓黑客的玩法：他們用假身份和深偽 (Deepfake) 技術製作的影像成功透過視像面試，找到西方世界的遠端 (Remote) 資訊科技 (IT) 工作，替國家賺取外匯，也可以趁機入侵西方國家的商業機構的電腦系統，然後偷錢（提示：Binance + North Korean hackers）或竊取商業秘密或進行間諜活動。欲知詳情，請參考《延伸閱讀》部份提供的英文傳媒報導。
Case 1 的受害人是報考國際考試的內地生（即是：家庭經濟條件較佳以及計劃去外國升學的年輕內地人），跟北韓黑客有沒有關係，幕後黑手打算怎樣運用那些偷來的個人資料，有待查證。
Case 1 的另一個分析角度：跟打擊走資有沒有關係？送兒女出國讀書是大陸富裕家庭或體制中人常用的走資或洗黑錢渠道。知道那個家庭準備送孩子出國讀書，有助從源頭堵截走資或洗黑錢，對不對？幕後黑手是誰，自己想。
（四）高等院校的電腦系統有先天缺憾。外國專家的說法：大多數高等教育機構的網路安全系統旨在檢測入侵 (Intrusion)：未經授權的登錄、未打補丁的系統、可疑的連線。身份盜竊 (Identify Theft) 並不會觸發這些檢測機制。申請透過招生入口網站 (Admission portal) 提交，電子郵件來自真實以及經過驗證的帳戶，款項支付遵循已批准的流程。教育機構的網路安全系統沒有被入侵，因為攻擊者並沒有強行闖入，他們只是被允許通過一個從未驗證過他們身份的前門進入。
原文：Most higher education cybersecurity is built to detect intrusion: an unauthorized login, an unpatched system, a suspicious connection. Identity fraud triggers none of it. The applications arrive through the admissions portal, the emails come from real, authenticated accounts, and the disbursements follow approved processes. Nothing is technically breached, because the attacker isn't breaking in. They're being let in, through a front door that never confirmed who they were.
Source:
https://www.1kosmos.com/resources/blog/identity-fraud-in-higher-education
換言之，騙徒成功地 Game the system。香港的情況，是不少高等院校都是作風官僚的教育機構，因為依賴政府撥款，管理層通常是建制派或地下黨，把資訊保安工作外判給紅色背景的機構或團隊（即是：利益輸送）。如果偷取學生個人資料的幕後黑手是紅色體制訓練出來的電腦黑客，事情的本質，便是紅色體制訓練出來的電腦黑客 vs 依附中共的香港建制派所控制的高等院校的電腦系統。三個字：紅吃紅。也可以當作紅色體制內部的派系鬥爭看待，所爭奪的資源，是學生及教職員的個人資料。誰勝誰負，一目了然。
（五）外國的情況，是部份二、三線大學或高等院校（例如：社區學院 Community College）經歷疫情（COVID 19 武漢肺炎）衝擊之後，正面臨收生不足的問題，財務上承受很大的壓力，對於入學申請幾乎來者不拒，也缺乏資源去更新資訊保全系統，再加上院校的的電腦系統存在上述的先天缺憾，於是輕易被黑客所攻破，偷取學生及教職員的個人資料，用來詐騙銀行或政府，洗黑錢又得。
香港也有這種情況，比較特別的地方，是內地生佔學生總數的比例高，而且持續上升。過去幾年，香港發生多宗內地生使用假學歷入讀本地大學或高等院校的例子，欲知詳情，請上網。如果騙徒偷來的個人資料或學歷文件（畢業證書）已經是假，是否會因此而觸發（銀行或政府）的監察系統發出警報，令壞人及早被發現？有待觀察。壞人被壞人連累？實在太好玩。是否因果報應，自己想。
騙徒的行騙手法
犯罪集團取得院校學生的個人資料之後，會採取以下的方法來進行詐騙：
（一）申請信用卡，或開設銀行戶口，然後申請貸款，錢轉入「錢騾」 (Money Mules) 的賬戶之後迅速被轉走。院校報警，但是賬戶持有人已經失踪，無法聯絡，又或者是個人資料被盜竊的受害人，執法部門就算找到人也沒用，只是發現另一宗的個人資料被盜竊事件，即是增加執法部門的工作量。換言之，執法部門的反應在犯罪集團的計算之內。那些個人資料，也可以用來洗黑錢，操作方法請參考《相關的文章》裡面的舊文。
（二）用偷來的個人資料（真）混合 AI 生成的（假）照片和（假）學歷證書以及（假）申請文章 (Admission essay) 向某大學申請入學，成功之後向政府申請學生貸款，錢轉入「錢騾」“(Money mules) 賬戶之後迅速被轉走。英語世界用「幽靈學生」(Ghost students) 形容這種行騙手法。這一招，犯罪集團經常用來洗黑錢（搜尋：Ghost Employees or Phantom Employees）。操作方法：沒有上班的人頭照常支薪，目的是把犯罪收入（現金）打入實體生意的賬目之內，跟合法收入或開支混合在一起，然後打入合法的銀行系統之內（提示：Placement）。共通點：用假身份搬運金錢。
香港的高等教育界稍後是否會出現「幽靈學生」(Ghost students) 向銀行或官府騙財的情況？過去 3 個月內發生兩宗大規模的學生個人資料被盜竊事件，已經敲響了警鐘。高等院校及教育官僚可有採取行動保護學生？還是繼續耍港式官腔？
（三）騙徒會建立假的大學網頁，資料來自真的大學網頁（通常是名牌大學應為比較容易吸引受害人），也許混合 AI 生成的假內容，目的是誘騙海外學生上網填寫入學申請表 (Online Form)，從而收集學生的個人資料及各種文件（例如：真的畢業證書或入學申請文章），然後詐騙銀行或官府。
後果：騙徒透過盜取院校學生的個人資料向銀行或政府騙錢，而受害的學生（或教職員）需要花很長的時間以及經歷繁複的程序，才能修補事件對個人信貸評級所帶的傷害，以及解決因為個人資料被盜所引發的債務問題。那些被盜取的個人資料，也許已經透過暗網 (Dark Web) 轉移至另一個司法管轄區，然後從事犯罪活動，要追溯責任也不容易（因為調查過程牽涉跨國司法互助）。
如果受害人是大學生，個人身份被盜竊，會影響日後的事業發展，甚至令當事人難以建立家庭。原因：受害人可能會被銀行列入黑名單，於是難以開設賬戶或申請抵押貸款或私人信貸。沒有銀行賬戶，就難以跟實體經濟建立合作關係，也難以建立事業和家庭，對不對？如果沒有官府介入，受害人就要同一時間跟多個政府部門及金融機構周旋，耗費時間和精神，但是未必有進展。如果受害人是在本地大學讀書的內地生，特區政府有沒有能力協助他或她走出困局？
大規模盜竊大學生個人資料的事情已經發生了，特區政府是否懂得回應犯罪集團的下一步？還是坐以待斃？
延伸閱讀／參考資料：
Investopedia
What Is Identity Theft? Types and Examples
By Ali Hussain
Updated January 24, 2026
https://www.investopedia.com/terms/i/identitytheft.asp
Definition
Identity theft is a crime where someone uses another person’s identifying information to impersonate them in financial, legal, or administrative transactions.
Key Points：
- Identity theft occurs when someone steals your personal information and credentials to commit fraud.
- There are various forms of identity theft, but the most common is financial.
- Identity theft protection keeps track of people's credit reports, financial activity, and Social Security number use.
- Recovering from the damage caused by identity theft can take substantial time and effort.
North Koreans use fake names, scripts to land remote IT work for cash
The Standard
2023-11-21
https://www.thestandard.com.hk/world/article/210615/
Intro：Using fake names, sham LinkedIn profiles, counterfeit work papers and mock interview scripts, North Korean IT workers seeking employment in Western tech companies are deploying sophisticated subterfuge to get hired.
Landing a job outside North Korea to secretly earn hard currency for the isolated country demands highly-developed strategies to convince Western hiring managers, according to documents reviewed by Reuters, an interview with a former North Korean IT worker and cybersecurity researchers.
North Korea has dispatched thousands of IT workers
overseas, an effort that has accelerated in the last four years, to bring in
millions to finance Pyongyang's nuclear missile programme, according to the
United States, South Korea, and the United Nations.
Marco Beranzoni’s Post
Key Points:
- Nearly 100 SARs became 20,000 suspicious transactions and 270 million dollars in referrals. Three months after FinCEN's alert.
- On 19 October, Treasury said FinCEN had identified about 270 million dollars in suspicious activity potentially linked to fraud against federal student aid programs, and referred it to federal investigators as tip-and-lead information.
- The SARs followed FinCEN's July 2026 alert, and FinCEN's review found more than 20,000 potentially suspicious transactions since February. Treasury cautions the figures reflect only what institutions identified and reported.
- Treasury describes two schemes. Ghost student schemes enrol fake
students with stolen personal information, sometimes with synthetic identities
that mix stolen and invented details and pass identity checks. Victims,
including minors, often do not know aid was taken in their name. Straw student
schemes pay real people for their details, enrol them and
keep the aid refunds, sometimes with help from corrupt school employees.
Higher Education’s New
Fraud: Ghost Students
Mark Pribish
2026-03-30
The Higher Education
Inquirer –
https://www.linkedin.com/pulse/higher-educations-new-fraud-ghost-students-mark-pribish-io7ee
The Higher Education Inquirer – a trusted source of reporting and analysis on higher education – published an August 15, 2025 article titled Higher Education Inquirer: The Rise of Ghost Students: AI-Fueled Fraud in Higher Education reporting that “colleges across the United States are facing an alarming increase in ‘ghost students’ – fraudulent applicants who infiltrate online enrollment systems, collect financial aid, and vanish before delivering any academic engagement.”
For those individuals unfamiliar with the phrase “ghost students,” these students “are fully fabricated identities – sometimes based on stolen personal information, sometimes entirely synthetic – created to fraudulently enroll in colleges. Fraudsters use AI tools to generate admissions essays, forge transcripts, and even produce deepfake images and videos for identity verification.”
This Higher Education Inquirer article concludes by saying that “ghost student fraud is more than a financial threat – it is a systemic risk to educational access, operational efficiency, and institutional credibility. With AI-enabled fraud growing in sophistication, higher education must act decisively to safeguard the integrity of enrollment, instruction, and student support systems.”
But it gets worse as this January 28, 2026 news article by ABC News titled Inside the 'ghost student' scam that uses identity theft to steal college loans and financial aid - ABC News reported that ghost students are a “huge issue” for thousands of colleges across the country.”
According to ABC news, “the scammers will use stolen or fake identities to enroll in classes
online and sign up for Pell grants and loans, then disappear once they get the
money – robbing the federal
government of hundreds of millions of dollars and leaving an untold number of
victims in their wake.”
Identity theft preys on
campuses–here’s what we can do about it
Bala Kumar, Jumio
e Campus News
November 26, 2024
With robust support systems
and the right security technology, universities can lessen the long-term impact
of identity theft on their students
https://www.ecampusnews.com/cybersecurity/2024/11/26/identity-theft-preys-on-campuses/
Excerpt: The long-term consequences of identity theft for students
The effects of identity theft can haunt students long after they’ve graduated. Having their identities stolen can lead to significant financial setbacks, including:
Damaged credit scores: A poor credit score can hinder a student’s ability to apply for loans, rent an apartment, or even secure a job. Repairing a damaged score can take years.
Accumulation of debt: Scammers can open credit accounts, take out loans, or make large purchases in a student’s name, leaving them with substantial debt. This financial burden can add stress to a student’s already challenging academic life.
Time-consuming recovery process: Beyond the financial consequences, the process of reporting and resolving identity theft can be complex and time-consuming. Students may need to spend significant time contacting financial institutions, credit bureaus, and law enforcement to restore their accounts and clear fraudulent activity. This not only disrupts their academic focus but also adds additional stress as they work to regain control of their financial identity.
Strategies schools can use to educate and protect students
Colleges and universities play a critical role in safeguarding their students from these scams. Educational programs, easily accessible resources, and stronger cybersecurity measures can make a significant impact in reducing students’ vulnerability to identity theft. Here are a few strategies schools should consider implementing:
Raise awareness and teach best practices: Hosting workshops, providing digital resources, and offering seminars can teach students how to identify phishing scams, minimize the risks associated with sharing sensitive information, and establish strong, secure passwords. By increasing awareness of these threats, universities can reduce the likelihood of students falling victim to common scams.
Adopt security technologies: To protect student data, universities should prioritize the use of advanced cybersecurity systems. Multi-factor authentication (MFA), encrypted communications, and routine security assessments are just a few measures that can limit unauthorized access to sensitive student information. Investing in these technologies can greatly minimize the chances of data breaches and unauthorized activity.
Leverage biometric identity verification: To further strengthen security protocols, universities can incorporate biometric identification solutions. This prevents the creation of fraudulent student profiles and adds protection for legitimate students. For instance, requiring students to verify their identity through biometric data (like a photo of their government-issued ID paired with a live selfie) at account setup ensures authenticity. Additionally, re-authenticating with biometrics for sensitive actions–like changing passwords or making financial transactions–provides an extra layer of defense against account takeover.
Offer support for identity theft victims: Should a student fall victim to identity theft, it’s crucial for universities to have resources readily available to assist them. Providing access to legal help, credit monitoring, and counseling can help affected students recover more easily and quickly.
With these support structures in place, universities can help mitigate
long-term consequences and reduce the burden on students as they work to
restore their financial security.
Identity
Fraud in Higher Education: Ghost Students, FAFSA Fraud, and How to Stop Them
Christine
Owen
Field
CTO
Sept
2, 2026
https://www.1kosmos.com/resources/blog/identity-fraud-in-higher-education
Excerpt: Types of
identity fraud in higher education
Identity fraud isn’t just one scheme. Many institutions face several at once, and they often chain together:
Ghost
students and synthetic identities
Criminals use stolen identities, or assemble synthetic ones from fragments of real data, to apply for admission. Online programs with low-friction enrollment are the usual target. The aid disbursement is the payout, and by the time an empty seat raises questions, the money and the identity behind it are both gone.
FAFSA and refund fraud
Two paths lead to the same place. Financial aid fraud begins with a fabricated applicant filing for FAFSA aid that was never earned. Refund fraud begins with a real, enrolled student whose account is quietly taken over so the refund lands in someone else's bank. Both run through approved disbursement systems, which is why the transaction looks routine until the money is already gone.
Student
email compromise and account takeover
A compromised student inbox is rarely the goal itself. It's the credential that unlocks everything else. An attacker holding a working student account can authorize password resets across connected systems, change where a refund gets deposited, and send requests to financial aid staff from an address those staff have no reason to question.
These accounts are easy to reach because students reuse passwords and sign in from personal devices no one on campus manages. They also stay compromised, because nothing flags the takeover for weeks.
Re-admit
fraud
Impersonating a former student sidesteps most admissions scrutiny. Returning applicants face lighter vetting, and loans get issued in the real person's name. This is student identity theft with a delayed fuse; the victim often learns about it years later, when a credit application turns up debt they never took on.
Credential
and diploma fraud
Fraudsters issue counterfeit diplomas bearing a real university's name, or use stolen identities to pull official transcripts. The damage lands on the institution's reputation and on every employer relying on it.
Business
email compromise and vendor impersonation
This attack targets the people who move money rather than the systems that hold it. A convincing email arrives from what appears to be a trusted internal authority or an established supplier, asking that a payment be released quickly or that banking details on file be updated.
Decentralized procurement gives attackers plenty of approval paths to test, and the pressure of grant cycles and fiscal deadlines supplies a believable reason to skip the usual verification step.
Student
data and research IP theft
One compromised account can expose student records, research data, and university intellectual property. It also supplies the personal details that make the next round of impersonation more convincing.
Why colleges and universities are a preferred target
Higher education offers an unusual combination of high payout and low resistance:
Enrolled students qualify for substantial loans and aid, so a single working identity is worth thousands
Admissions and disbursement run on trusted, automated workflows that assume the applicant is who they claim to be
Stolen funds move through layered accounts quickly, making recovery and prosecution unlikely
Breached student data, as in the Canvas/Instructure breach, hands attackers the details they need to impersonate students and pressure staff
Why standard controls don't catch identity fraud
Most higher education cybersecurity is built to detect intrusion: an unauthorized login, an unpatched system, a suspicious connection. Identity fraud triggers none of it.
The
applications arrive through the admissions portal, the emails come from real,
authenticated accounts, and the disbursements follow approved processes.
Nothing is technically breached, because the attacker isn't breaking in.
They're being let in, through a front door that never confirmed who they were.
Detection has to happen at the identity layer or else it doesn't happen at all.
大學假學歷風波：
拆解中國學生天價「保錄」背後的香港高校收生漏洞
BBC 中文網
2024 年 9 月 20 日
https://www.bbc.com/zhongwen/trad/chinese-news-69348483
節錄：「一年港碩是花錢買學歷，雖然水但有用」、「雙非（大陸排名較低大學）靠水碩逆襲」——在中國社交媒體小紅書上，大量貼文宣傳到香港讀碩士「洗學歷」，當中不少是留學中介的廣告。
香港大學今年5月爆出假學歷風波，有指最終個案多達上百宗，隨後當地各間院校都嚴查學歷。但 BBC 中文記者以臥底身份聯絡到多家中國大陸留學中介，發現仍有不少聲稱支付六位數人民幣的費用，可以「保錄」（保證錄取）入讀碩士課程。
記者採訪多名網絡上的中介及香港不同大學的行政職員，了解收生程序中哪些環節出現漏洞，讓騙徒有機可乘。事件也反映了社會和經濟的結構性問題，例如中國青年面對的升學和就業困境，以及香港高校在「教育產業化」和收入業績壓力下，學校和學生的關係被改變。
相關的文章：
教育騙局（九）
2019 年 12 月 30 日
https://xiaoshousha.blogspot.com/2019/12/blog-post_30.html
節錄：如果大學是一盤生意，大學校長是高層，他需要面對的問題包括：1. 顧客減少，影響收入。參考本地大學的財務報表，學費佔總收入的比例是兩成或以下。2. 如果再加上政府削減撥款（佔大學總收入的比例是五成或以上），對大學財政會構成壓力，雖然短期之內有儲備可以頂住。如果在 2019 年底撤退的內地生不回來，放棄香港的學業，而未來數年之內，報讀本地大學的內地生的人數開始下降（注意：這個數字由中共控制），本地大學的規模就很難維持下去。
教育騙局（五）
2017 年 11 月 17 日
http://xiaoshousha.blogspot.hk/2017/11/blog-post_17.html
節錄：面對高等教育界泡沫爆破的危機，特區政府可以做的不多，而有錢的香港家長早就把孩子送走了。最怕是不知道甚麼時候，偉大祖國覺得人數差不多了，又或者是所帶來的副作用太多（例如：內地生洗黑錢的情況開始失控，連累無辜的中小企被外資銀行取消戶口），於是突然煞停，令來港內地生的人數大幅下降，會對香港的高等教育界帶來很大的衝擊。對，放亂收死的中國式惡性循環。
OPM (Part 4)
2012 年 8 月 1 日
http://xiaoshousha.blogspot.hk/2012/08/opm-part-4.html
節錄：香港的大學，本質上是國企，是政府架構的延伸。不但財政上依賴官府的撥款，連高層的人事任命，也是由官府所控制。因此，政治勢力要干預學術自由，易過借火。政治勢力以外，還有來自商界的影響力。生意人眼中，管治欠佳、作風官僚，難以衡量效益的法定機構（大學），是一堆缺乏監管的金錢、資源、公帑，即是 Other People’s Money，絕對不容錯過，一於收為己用。
教育騙局（八）
2018 年 12 月 28 日
https://xiaoshousha.blogspot.com/2018/12/blog-post_28.html
節錄：近日上網，發現市面上開始出現替修讀副學士課程的內地生尋找補習老師的招聘廣告，那間公司提供移民和升學顧問服務，服務對象是居港的內地生，老闆是曾經在本地二線大學讀研究院的內地人，讀工程的男生，他的第一個學位來自內地二線大學（我當你真），哈哈。我夠資格，但是不敢申請，因為不想被大陸人拖欠薪金，更不想被捲入國產騙局。
囚
2026 年 8 月 8 日
https://xiaoshousha.blogspot.com/2026/08/blog-post.html
節錄：教育培訓產業跟移民顧問（港式中文）或出境中介機構（國產中文）是相關的產業鏈。在華人社會，許多人把海外升學視為移民的踏腳石或熱身練習。對有錢家庭來說，孩子的升學和移民問題，是同時處理的。換言之，交給外國大學的學費，其實是用來購買外國護照的成本（的一部份）。這個道理，很多有錢的中國家庭都懂，但是不會公開講，尤其是跟權力體制關係密切的家族。
假如我是真的（二）
2010 年 10 月 20 日
https://xiaoshousha.blogspot.com/2010/10/blog-post.html
節錄：內地缺乏可靠的身份證明文件。對於港澳台地區的生意人、僱主和消費者來說，即使對一個內地人的身份證明文件有懷疑，也不知道應該向內地的那一個部門查證。對中國國情稍有認識的人都知道，內地假學歷、假證件氾濫，地下黑市中，偽造的北京大學或者清華大學畢業證書只需要幾千元人民幣，製作精美，許多人都買得起。而就算文件是真的，要證明持證者是本人亦非易事。
姓甚名誰（二）
2010 年 11 月 12 日
https://xiaoshousha.blogspot.com/2010/11/blog-post_12.html
節錄：內地人一旦有機會離開中國大陸，移居海外（香港、澳門、新加坡或者西方國家），通常都會第一時間改名，改掉容易被辨認出是大陸人身份的中英文名字。他們相信，此舉可以避免被歧視，有助開展新生活。
「進階版」求職須知 (Part 5)
2019 年 1 月 10 日
https://xiaoshousha.blogspot.com/2019/01/part-5.html
節錄：無良僱主或中間人（即：人事顧問或獵頭公司）收集求職者的個人資料，然後轉售圖利，是常見的港式求職騙局。常見的做法：填完申請表格，叫你回家等通知，之後音訊全無。也許會約你去面試，但是感覺很假，因為對方的表情和語氣似背對白，是有劇本的。對方也許會在面試過程中耍手段，真正目的是趕你走（因為收集個人資料的任務已經完成），把放棄的責任推卸到閣下身上。
「進階版」求職須知 (Part 6)
2020 年 9 月 22 日
https://xiaoshousha.blogspot.com/2020/09/part-6.html
節錄：這幾篇，是這個系列的 (Part 2) （發表日期：2018 年 6 月 29 日）的延伸，也是 (Part 5) （發表日期：2019年1月10日）的補充，如果你沒有看過這個系列，請參考下面的《相關的文章》。如果你不知道甚麼是假面試，請參考 (Part 2) 裡面《延伸閱讀》部份所提供的三篇英語文章，題目有 Fake Interview 這個詞，是外國打工仔女的經驗之談。作者沒有名氣，但頭腦清醒，也敢講真話，具備參考價值。所用的英文並不深奧，大學生應該看得懂。
Online Form
2018 年 9 月 13 日
https://xiaoshousha.blogspot.com/2018/09/online-form.html
節錄：對方是試圖製造虛假的希望，乘機收集閣下的個人資料，想篩走不夠富貴的申請人（原因：美國人這個身份很昂貴，因為全球收入都要繳稅，而且稅率很高），還是想把放棄的責任推卸到求職者身上，or all of the above，自己想。真相是：洋人耍手段，用迂迴曲折的手法說不。
英倫黑錢
2022 年 3 月 1 日
https://xiaoshousha.blogspot.com/2022/03/blog-post.html
節錄：壞人的思路：現實世界的司法制度以國界為基礎，把個人資料轉移到另一個國家或司法管轄區 (Jurisdiction)，用來開設空殼公司或網上銀行賬戶洗黑錢，就算日後受害人（透過傳媒報導）發現個人資料被盜用，要追究責任也很困難。此外，還要花費不少時間與功夫去跟另一個國家的官僚周旋，才能還自己一個清白，洗脫跟犯罪集團合作的嫌疑，對不對？
洗黑錢督數偽術
2018 年 4 月 14 日
https://xiaoshousha.blogspot.com/2018/04/blog-post_14.html
節錄：中資機構也懂得洗黑錢，所以有「影子員工」或「影子觀眾」的做法，用來誇大營運開支或票房收入，作用是掩飾資金的去向或來源，亦可以是把維穩費落格或者瓜分（即：食夾棍、內鬼運財）。應用於新聞機構或娛樂事業的話，便是長期不上班但是名字出現於員工名單內，定時支薪的記者編輯，又或者是沒有參與電影製作，但是名字出現於幕後工作人員名單中的大陸人。回歸之後的中港合拍片，製作人員的名單越來越長，有如水蛇春，當中幾多成是真，幾多成是假，自己想。如果你嘗試查證真偽，可能會招惹殺身之禍。
文章
