Fake passport, fake id card, employees at a selling point activating a bunch with junk data and selling those themselves.

Reading the article, I don't think they're trying to imply what is suggested by the headline, ie. that the real-name registration system is being abused somehow to scam people.

Rather it's an article pointing out that the real-name registration system did not help to combat the already rising number of scams, which was the reason that the government gave for passing the law.

It doesn't seem to be phone-specific either:

Hong Kong has seen a sharp increase in overall scam-related crime figures in recent years. Between 2020 and 2024, the number of scams reported to police almost tripled.

It's a useful data point to argue against any similar initiatives in other countries, where they may use the same reasoning to justify the law. It doesn't seem to make a difference, as criminals will always find a way regardless of the hoops that you make law-abiding citizens jump through.

More likely Jane registers a SIM using her ID. She then sells it to Sally, who uses it to scam people online.

That would be my reading of that sentence. I’m just not clear if they propose to criminalise both Jane‘s and Sally‘s acts.