Look, the story Cheung filed today isn't really about the iPhone. Hongkongers pre-ordered through Apple's own site, on legitimate cards, and a chunk of them found unauthorised charges sitting next to the pre-order line on the same statement (SCMP reports two banks have now opened investigations). That timing correlation is the entire fraud-detection question: a transaction-monitoring system that can't distinguish "customer bought a phone" from "customer's card got skimmed within hours of buying a phone" is a system that's going to miss the next one too.

So here's what lands on a regulated firm. HKMA's Supervisory Policy Manual module TM-E-1 requires authorized institutions to maintain fraud monitoring capable of flagging anomalous transaction patterns in real time, and a coordinated skim clustered around a single merchant event is exactly the pattern that module exists to catch (the two banks investigating are, by definition, telling HKMA's Banking Conduct Department their models didn't catch it before the customer did). Separate from that, HKICL flagged fraudulent websites twice this week, on September 10 and September 11, which is the volume that tells you the retail-fraud environment right now isn't a one-off iPhone problem, it's a baseline. Whichever two banks are named when this surfaces further will need to show their post-incident review under TM-E-1, not just their refund process.

The next observable point is whatever public statement the two banks make on scope and remediation, and separately, whether HKMA's Banking Conduct Department opens a supervisory inquiry into the pattern, which historically happens quietly and shows up months later in the Annual Report, not in a press release. Until one of those two things happens, the fraud sits on the banks' books as an operational loss, not a disclosed one.