Welcome Guest ( Log In | Register )

Outline · [ Standard ] · Linear+

Banking Bank Scam on the raise, What are your toughts

views
     
TSWei6737 P
post Jun 7 2022, 01:00 AM, updated 4y ago

New Member
*
Probation
7 posts

Joined: Feb 2022
Not sure if this is the correct place to hold this discussion.

Recently, so many case of money has been transferred out from the owner’s bank account to someone they don’t know and they claim that they have no idea why such thing happens.

Some of the examples are not scams it sounds like magic, by answering a call/ messages, their money get transferred out without their consent.

Another case claim that, all his monies get transferred to U mobile without receiving any OTP or authentication.

I know lowyat has a lot of experts in various field, so would like heard all the opinions from the professionals.

Is there something wrong in our banking system, or its just something fishy on the claim made by those victims.

Btw, should exclude those phishing links emails app etc, all these common ways to retrieve sensitive information, as i have described above those cases happens recently sounds like magic not scams.

Come share your thoughts…
Raptor9777
post Jun 7 2022, 02:20 AM

New Member
*
Junior Member
24 posts

Joined: May 2020
For small number of cases I bet it's inside job (that includes contractors who may help build the code)

For the majority of cases its the social engineering like phising or Macau scam or ponzi schemes
The stupid one either won't admit or don't even know their mistake.. While the smart one know if they admit they giving up the fight to get the money back
MUM
post Jun 7 2022, 08:54 AM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

QUOTE(Wei6737 @ Jun 7 2022, 01:00 AM)
Not sure if this is the correct place to hold this discussion.

Recently, so many case of money has been transferred out from the owner’s bank account to someone they don’t know and they claim that they have no idea why such thing happens.

Some of the examples are not scams it sounds like magic, by answering a call/ messages, their money get transferred out without their consent.

Another case claim that, all his monies get transferred to U mobile without receiving any OTP or authentication.

I know lowyat has a lot of experts in various field, so would like heard all the opinions from the professionals.

Is there something wrong in our banking system, or its just something fishy on the claim made by those victims.

Btw, should exclude those phishing links emails app etc, all these common ways to retrieve sensitive information, as i have described above those cases happens recently sounds like magic not scams.

Come share your thoughts…
*
Banks staffs swindlers money are not recent happenings....

money swindled by staff has increased to RM473.82 million over the last five years. (2008 - 2013)

Bukit Aman Commercial Crimes Department’s Head of Unit for Banking and Financial Crimes Supt Harjinder Kaur Gurdial Singh said overall the banks suffered losses amounting to RM789,106,376 for various fraud during the period.

In 2008 it was RM10.1 million, RM27.1 million in (2009), RM85.4 million (2010), RM84.5 million (2011), RM191.8 million (2012) and RM390 million (November 2013), she told reporters during a special interview on Commercial CID crime here today, in an article dated 2013

https://www.malaymail.com/amp/news/malaysia...say-cops/576801

acbc
post Jun 7 2022, 09:01 AM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
Basically a smartphone problem by installing malicious apps.

Myself will use an ancient Nokia 3310 or 106 for a TAC SMS from banks and other entities related to money. Simply register a new prepaid line from XOX or Yoodo and update it at the ATM machine. Done deal.

Now, each time u perform a new transaction, need to enter the TAC. Some only use SecureTAC which is performed on the bank apps. These are quite secure compared to TAC.

As the TAC number is on an ancient platform, idiots and scammers will try to WhatsApp or Telegram the number and got zero response instead.

Only caveat is to carry an another device when daily but no biggie because these phones are small enough to ignore. With no colour screens or multimedia capabilities, the battery will last up to 2-3 weeks.
brokenbomb
post Jun 7 2022, 09:18 AM

Regular
******
Senior Member
1,269 posts

Joined: May 2005


Don’t think “only boomer kena. Me tech savvy millennial ok ni”

Sorry haha. Scammer nowadays makin pandai. Just be careful on your TAC and spam calls
roy_zu
post Jun 7 2022, 11:43 AM

#TimeToLead
*******
Senior Member
2,378 posts

Joined: May 2008


I do have a close relative (in his 30s) got scammed with same MACAU scam modus operandi. When I ask to explain the steps, can smell some bullshit. One main point was, after the initial call, he said he googled Bukit Aman PDRM number in google and called the number before spoken to a person in charge and got scammed close to 10k.

So usually, those got scammed will not reveal full story scared muka jatuh
SUSshamino_00
post Jun 7 2022, 01:46 PM

Getting Started
**
Junior Member
77 posts

Joined: Oct 2021
Happen to HSBC a fren of mine. Money transferred out without OTP or any authorization. He just got SMS notifying him $$$ charged to be his account in a foreign country. His account is purely savings account and not used for any online transaction. No explanation given by the bank. Heard another customer there got tens of thousands withdrawn as well.


Kadaj
post Jun 7 2022, 02:31 PM

On my way
****
Junior Member
586 posts

Joined: Mar 2006
Best practice is to use 2 phones separately:

Nokia 3310: Use your sim card registered to receive OTP.

Smart phone: Use another sim card which doesn't register any service that need to receive OTP.
CPURanger
post Jun 7 2022, 02:47 PM

Enthusiast
*****
Senior Member
889 posts

Joined: Jun 2008


From what I read, many users tricked into installing malicious apk into the phone. That's why mostly get hacked. So to begin with, don't use that kind of phone.

This post has been edited by CPURanger: Jun 7 2022, 02:48 PM
lkwah86
post Jun 7 2022, 03:23 PM

On my way
****
Junior Member
545 posts

Joined: Sep 2008


QUOTE(CPURanger @ Jun 7 2022, 02:47 PM)
From what I read, many users tricked into installing malicious apk into the phone. That's why mostly get hacked. So to begin with, don't use that kind of phone.
*
buy iphone?
TSWei6737 P
post Jun 7 2022, 03:26 PM

New Member
*
Probation
7 posts

Joined: Feb 2022
QUOTE(shamino_00 @ Jun 7 2022, 01:46 PM)
Happen to HSBC a fren of mine. Money transferred out without OTP or any authorization. He just got SMS notifying him $$$ charged to be his account in a foreign country. His account is purely savings account and not used for any online transaction. No explanation given by the bank. Heard another customer there got tens of thousands withdrawn as well.
*
This was one of those examples sounds like magic that raise concerns, common scam tactics ppl really get used to it and with so many scam alert poping out when you are performing online banking if one still fall onto it, really just blame urself for being careless and irresponsible to your own hard earned money.
loki
post Jun 7 2022, 04:08 PM

Look at all my stars!!
*******
Senior Member
2,109 posts

Joined: Jan 2003
From: Damansara Damai, PJ



QUOTE(roy_zu @ Jun 7 2022, 11:43 AM)
I do have a close relative (in his 30s) got scammed with same MACAU scam modus operandi. When I ask to explain the steps, can smell some bullshit. One main point was, after the initial call, he said he googled Bukit Aman PDRM number in google and called the number before spoken to a person in charge and got scammed close to 10k.

So usually, those got scammed will not reveal full story scared muka jatuh
*
these scammers bullshit also nobody raise alarm. They suka suka can transfer call to other government department. As we know, to call some government department is like kena lottery. At first they say you got LHDN hutang, slowly can become money laundering, suka suka can change....i wonder why people can believe that cock and bull story.
nihility
post Jun 7 2022, 05:41 PM

Regular
******
Senior Member
1,596 posts

Joined: Sep 2021


Replace all the transaction with secure2u verification instead of TAC verification.
nihility
post Jun 7 2022, 05:57 PM

Regular
******
Senior Member
1,596 posts

Joined: Sep 2021


QUOTE(loki @ Jun 7 2022, 04:08 PM)
these scammers bullshit also nobody raise alarm. They suka suka can transfer call to other government department. As we know, to call some government department is like kena lottery.  At first they say you got LHDN hutang, slowly can become money laundering, suka suka can change....i wonder why people can believe that cock and bull story.
*
Usually the one targeted have "shits" within themselves. Those without "shits" won't fall for it. I received a similar call claimed to be from the Pos Malaysia, KL. That time I was expecting some delivery from Pos Malaysia, when the operator stating my parcel got blocked. Of course the immediate reaction, you will be frustrated. Upon further inquiry, whether the product delivery to my unit got block or the unit I send got blocked. The operator claimed the parcel I sent got blocked & it contained sensitive stuff. Apparently it were credit cards & my parcels were retained at Sabah IPD - linked to money laundering....After I heard such, I replied to the operator, "oh, ya ker? macam ini la, you proceed buat laporan polis. Kawan I dekat Bukit Aman akan handle kes saya, tak usah susah-susah cik, kita buat laporan polis berbeza" The operator silent awhile while putting effort to put me back into her dialog ( try to pass call to Sabah IPD), I straight away cut " I akan jumpa kawan saya dekat Bukit Aman sendiri", straight away cut the line.

There after, immediately I search the internet on the Scam related to Pos Malaysia, apparently Pos Malaysia / Parcel Scam was one of the Macau Scam.
umboy
post Jun 7 2022, 07:05 PM

Getting Started
**
Junior Member
226 posts

Joined: Nov 2021


I am very worry about this scam too
Can anyone please suggest the safest bank to store money?
jack2
post Jun 7 2022, 11:04 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
QUOTE(loki @ Jun 7 2022, 04:08 PM)
these scammers bullshit also nobody raise alarm. They suka suka can transfer call to other government department. As we know, to call some government department is like kena lottery.  At first they say you got LHDN hutang, slowly can become money laundering, suka suka can change....i wonder why people can believe that cock and bull story.
*
I intend to open this topic for discussion but TS has posted.

Nowdays, too many scam calls especially HSBC calls ....
umboy
post Jun 7 2022, 11:44 PM

Getting Started
**
Junior Member
226 posts

Joined: Nov 2021


QUOTE(jack2 @ Jun 7 2022, 11:04 PM)
I intend to open this topic for discussion but TS has posted.

Nowdays, too many scam calls especially HSBC calls ....
*
U mean HSBC not safe right
jack2
post Jun 7 2022, 11:47 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
QUOTE(umboy @ Jun 7 2022, 11:44 PM)
U mean HSBC not safe right
*
No. The HSBC scam call is calling you to notify you that you to approve for HSBC credit card transaction while I dont have HSBC cc.

If you listen and press 0, then connect you to CS which will speak like hello, this is HSBC bank credit card centre. How many hell you..
Chrono-Trigger
post Jun 8 2022, 02:03 AM

BY SELF ONE IS DEFILED AND PURIFIED
*******
Senior Member
4,310 posts

Joined: Aug 2013
I don't leave much cash in my savings account. Usually kept it to less than RM1000.

Anything extra I have, I either put it to EPF which is impossible for scammer to steal or put it as e-fixed deposit 1 month tenure.

Money in E-fixed deposit will introduce another layer of protection.
Lucas0323
post Jun 8 2022, 02:14 AM

Enthusiast
*****
Junior Member
808 posts

Joined: Aug 2011


Im afraid data leak play big role eg mysj so many details if fall on wrong hand can be dire.
Lucas0323
post Jun 8 2022, 02:15 AM

Enthusiast
*****
Junior Member
808 posts

Joined: Aug 2011


QUOTE(Chrono-Trigger @ Jun 8 2022, 02:03 AM)
I don't leave much cash in my savings account. Usually kept it to less than RM1000.

Anything extra I have, I either put it to EPF which is impossible for scammer to steal or put it as e-fixed deposit 1 month tenure.

Money in E-fixed deposit will introduce another layer of protection.
*
Gt previous case edeposit gone kena hack or something
SUSRaptor2022
post Jun 8 2022, 07:36 AM

New Member
*
Junior Member
47 posts

Joined: Mar 2022
QUOTE(umboy @ Jun 7 2022, 07:05 PM)
I am very worry about this scam too
Can anyone please suggest the safest bank to store money?
*
Kdi
Versa
Stash away
genesic
post Jun 11 2022, 09:59 PM

Enthusiast
*****
Junior Member
822 posts

Joined: Apr 2006
QUOTE(Lucas0323 @ Jun 8 2022, 03:15 AM)
Gt previous case edeposit gone kena hack or something
*
yes, this is terrible. i think the scary one is the one transferred the money out with notification or owner knowing.
what if those small amount transferred out, which something dont ring a bell to us also ..
if big amount, we will definitely aware when checking statement, but small amount .... hmm.gif hmm.gif
poooky
post Jun 12 2022, 08:00 AM

Enthusiast
*****
Junior Member
844 posts

Joined: Sep 2011
There may be legit cases where the bank is to blame, but we will never know for sure. No bank will ever admit to something like this as it would cause panic and then bank run.

At the same time, no user will openly admit that they messed up either as it is too shameful.
jibpek
post Jun 12 2022, 08:05 AM

Enthusiast
*****
Junior Member
708 posts

Joined: Jul 2012
Do it like Cheque, needs 2 days floating.
jack2
post Jun 12 2022, 09:16 AM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
QUOTE(jibpek @ Jun 12 2022, 08:05 AM)
Do it like Cheque, needs 2 days floating.
*
Probably to disable instant transfer. And allow IBG which requires 1 day floating.

But as I know, even IBG is used and sent, the transaction cannot be reversed although it is not credited. So louzy system.
bill11
post Jun 12 2022, 02:49 PM

Casual
***
Junior Member
303 posts

Joined: Aug 2005
QUOTE(jack2 @ Jun 7 2022, 11:47 PM)
No. The HSBC scam call is calling you to notify you that you to approve for HSBC credit card transaction while I dont have HSBC cc.

If you listen and press 0, then connect you to CS which will speak like hello, this is HSBC bank credit card centre. How many hell you..
*
Kena few time the scammer called me , so i ask them on the credit card number that i got charged with, apprently it is few year old credit card number, which now already changed.

Maybe next time we can ask them, do you need us to rescue you from the scam center ? because if you see the recent malaysian case in cambodia the guy who broken back and leg shared his testimonial with MCA that few thousand malaysia is there in those scam center. If they dont perform will kena beaten.
aeiou228
post Jun 15 2022, 09:33 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
Astro AEC 8pm yesterday.


Thee are two types of scams. Macau scam and phone hacking.
Macau scam requires scammer calling the potential victim. The recent cases were mostly phone hacking as reported in the above news media.

The following are some of the precautions you can do:
1) Turn off unknown source APK installation.
2) Activate/enable APP Approve or APP Authorize.
3) Set "View only" for account with substantial balance. (Not all online banking support this feature)
4) Go to settings > permission > SMS, check if any unfamiliar apps are allowed to access your SMS. If yes, deny it.
5) Do not side load any unknown APK into your main online banking phone. Instal it on separate phone if you insist.
KHOdin
post Jun 15 2022, 10:28 AM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
is there any bank still provide hardware token for OTP verification?

more and more banks force us to use app authorization nowadays
wong_86
post Jun 15 2022, 10:34 AM

DUDE
****
Junior Member
565 posts

Joined: Oct 2007
From: MARS


those kena scam one, no one telling the truth, don't want coporate give their phone to investigate, buat tak tau saja

This post has been edited by wong_86: Jun 15 2022, 10:35 AM
aeiou228
post Jun 15 2022, 11:17 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
QUOTE(KHOdin @ Jun 15 2022, 10:28 AM)
is there any bank still provide hardware token for OTP verification?

more and more banks force us to use app authorization nowadays
*
SMS (OTP/TAC/PAC) security is too venerable to breach, that's why banks up the security level to app authorization. At least until the app authorization can be breached again by the hacker.

As for the physical token, it's not very practical. Prone to malfunction, can't replace battery, hassle to bring along and the biggest problem of all... misplaced it somewhere.
Affin bank however, came out with App version token called Affin Secure. Can carry along wherever you go, never out of battery. Physical token has become obsolete.
bcombat
post Jun 15 2022, 12:27 PM

Enthusiast
*****
Junior Member
998 posts

Joined: May 2014
user posted image

This is one of the example of scam sms? if we respond by calling the no, then the scammer may access to our phone and even the banking details?
KHOdin
post Jun 15 2022, 04:15 PM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
QUOTE(aeiou228 @ Jun 15 2022, 11:17 AM)
SMS (OTP/TAC/PAC) security is too venerable to breach, that's why banks up the security level to app authorization. At least until the app authorization can be breached again by the hacker.

As for the physical token, it's not very practical. Prone to malfunction, can't replace battery, hassle to bring along and the biggest problem of all... misplaced it somewhere.
Affin bank however, came out with App version token called Affin Secure. Can carry along wherever you go, never out of battery. Physical token has become obsolete.
*
but it's the same app that you are doing your transaction on, i feel dumb that the 2FA is coming from the same source

KHOdin
post Jun 15 2022, 04:16 PM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
QUOTE(bcombat @ Jun 15 2022, 12:27 PM)
user posted image

This is one of the example of scam sms? if we respond by calling the no, then the scammer may access to our phone and even the banking details?
*
my aunt got the same SMS this week while she doesnt even have MBB account
jack2
post Jun 15 2022, 04:25 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
Police should form a team to allow for those scam phone calls for report (the number) and catch those who rents the phone number.
aeiou228
post Jun 15 2022, 11:04 PM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
QUOTE(KHOdin @ Jun 15 2022, 04:15 PM)
but it's the same app that you are doing your transaction on, i feel dumb that the 2FA is coming from the same source
*
Affin secure is a dedicated app just for transaction approval only. Can't do other banking transactions.
MUM
post Jun 15 2022, 11:39 PM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

QUOTE(aeiou228 @ Jun 15 2022, 11:04 PM)
Affin secure is a dedicated app just for transaction approval only. Can't do other banking transactions.
*
This Affin secure apps will receives secured information from Affin sent to registered phone numbers..

If the scammer managed to "hijack" the phone number....???
Just like example this recent s'pore ocbc case?

Why some OCBC customers in SMS scams did not get OTPs
https://www.straitstimes.com/tech/tech-news...id-not-get-otps

Why does an SMS appear to be from OCBC when it isn't?
Why do banks use SMS if they are unsecure?
https://www.google.com/url?sa=t&source=web&...K-rrD9W-ZOowkDi

KHOdin
post Jun 16 2022, 12:17 AM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
so nice to see that our neighbor country news are being transparent in telling which bank's customers got scamed

our local OCBC only use app for verification now and no SMS OTP at all
aeiou228
post Jun 16 2022, 12:43 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
QUOTE(MUM @ Jun 15 2022, 11:39 PM)
This Affin secure apps will receives secured information from Affin sent to registered phone numbers..

If the scammer managed to "hijack" the phone number....???
Just like example this recent s'pore ocbc case?

Why some OCBC customers in SMS scams did not get OTPs
https://www.straitstimes.com/tech/tech-news...id-not-get-otps

Why does an SMS appear to be from OCBC when it isn't?
Why do banks use SMS if they are unsecure?
https://www.google.com/url?sa=t&source=web&...K-rrD9W-ZOowkDi
*
Affin Secure is a digital token that only works on an authorized mobile device. You can approve transaction without the SIM being inserted in the phone.
MUM
post Jun 16 2022, 01:26 AM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

QUOTE(aeiou228 @ Jun 16 2022, 12:43 AM)
Affin Secure is a digital token that only works on an authorized mobile device. You can approve transaction without the SIM being inserted in the phone.
*
I am not sure how Affin secure works.
But if no need sim in phone,... How Affin knows that the apps in authorised device?
Will it be like the device that downloaded the apps will then act like those physical token that does not need sim?

Also, does one need to carry the non sim inserted device along with the normal sim card inserted device to do online transaction?

Will it be like carry a normal sim card inserted smartphone to do the transaction together with those secure token (individual tac generating device)?
I am currently using the secure token from pbb,... Yes you are correct to mention that it has some inconveniences.

This post has been edited by MUM: Jun 16 2022, 01:36 AM
aeiou228
post Jun 16 2022, 10:17 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
QUOTE(MUM @ Jun 16 2022, 01:26 AM)
I am not sure how Affin secure works.
But if no need sim in phone,... How Affin knows that the apps in authorised device?
Will it be like the device that downloaded the apps will then act like those physical token that does not need sim?

Also, does one need to carry the non sim inserted device along with the normal sim card inserted device to do online transaction?

Will it be like carry a normal sim card inserted smartphone to do the transaction together with those secure token (individual tac generating device)?
I am currently using the secure token from pbb,... Yes you are correct to mention that it has some inconveniences.
*
1) Similar to Maybank secure2u, you can use Mayban2u App on a registered device with or without SIM slot (non SIM tablet for example)
2) Yes, you need to carry two devices but why wouldn't you register the digital token on your day to day phone ?
3) Yes, it's more convenient than physical token but one downside though, Affin Secure only approve transactions above 10k and the threshold is fixed, you can't adjust the limit in settings. So, given enough time, hacker still can make multiple 10k transactions to steal all your money in the account via OTP/TAC/PAC. I hope Affin can enable adjustable limits in future update.
ragk
post Jun 16 2022, 10:31 AM

BooBoo~
*******
Senior Member
2,353 posts

Joined: Apr 2009


As an IT guy, my advise for commoner is

#1. Download App from playstore only, never download anything through link.
#2. When redirected to bank transfer page by 3rd party, always double check the URL, make sure its legit. Any IT guy with sufficient knowledge can easily clone the same interface to trick people.
#3. Remember your security phase and picture, always double check before login, these are the info that hacker cannot fake which only known by the bank.
#4. NEVER perform any confidential activity through FREE WIFI.
#5. This is my personal habit, deny all access request from the all application, until the moment u wanted to use it, thn it will pop the request again, and that moment u will knew whether the access request making sense anot. e.g. While using camera filter app, it will pop for camera access request, make sense, but if it's asking to access my contacts and SMS, thn that's fishy, why tf a camera app need to access them?

Pure text SMS alone cant do much thing, most likely the victim phone already infected by spyware early on, my guess is the SMS probably is just a trigger.

This post has been edited by ragk: Jun 16 2022, 10:35 AM
bcombat
post Jun 16 2022, 04:55 PM

Enthusiast
*****
Junior Member
998 posts

Joined: May 2014
QUOTE(ragk @ Jun 16 2022, 10:31 AM)
As an IT guy, my advise for commoner is

#1. Download App from playstore only, never download anything through link.
#2. When redirected to bank transfer page by 3rd party, always double check the URL, make sure its legit. Any IT guy with sufficient knowledge can easily clone the same interface to trick people.
#3. Remember your security phase and picture, always double check before login, these are the info that hacker cannot fake which only known by the bank.
#4. NEVER perform any confidential activity through FREE WIFI.
#5. This is my personal habit, deny all access request from the all application, until the moment u wanted to use it, thn it will pop the request again, and that moment u will knew whether the access request making sense anot. e.g. While using camera filter app, it will pop for camera access request, make sense, but if it's asking to access my contacts and SMS, thn that's fishy, why tf a camera app need to access them?

Pure text SMS alone cant do much thing, most likely the victim phone already infected by spyware early on, my guess is the SMS probably is just a trigger.
*
Possible the terrible thing can also happen to iPhone, if we didn’t jail break it?
ragk
post Jun 16 2022, 05:23 PM

BooBoo~
*******
Senior Member
2,353 posts

Joined: Apr 2009


QUOTE(bcombat @ Jun 16 2022, 04:55 PM)
Possible the terrible thing can also happen to iPhone, if we didn’t jail break it?
*
Iphone is relatively safe for #1 and #5 mentioned above because Apple is strict on the application in their store, and doesn't allow external download source. But it's just relatively safe, so better safe thn sorry for #5.

As for #2 to #5, it apply to all phone.
TSWei6737 P
post Jun 16 2022, 11:52 PM

New Member
*
Probation
7 posts

Joined: Feb 2022
QUOTE(ragk @ Jun 16 2022, 10:31 AM)
As an IT guy, my advise for commoner is

#1. Download App from playstore only, never download anything through link.
#2. When redirected to bank transfer page by 3rd party, always double check the URL, make sure its legit. Any IT guy with sufficient knowledge can easily clone the same interface to trick people.
#3. Remember your security phase and picture, always double check before login, these are the info that hacker cannot fake which only known by the bank.
#4. NEVER perform any confidential activity through FREE WIFI.
#5. This is my personal habit, deny all access request from the all application, until the moment u wanted to use it, thn it will pop the request again, and that moment u will knew whether the access request making sense anot. e.g. While using camera filter app, it will pop for camera access request, make sense, but if it's asking to access my contacts and SMS, thn that's fishy, why tf a camera app need to access them?

Pure text SMS alone cant do much thing, most likely the victim phone already infected by spyware early on, my guess is the SMS probably is just a trigger.
*
Referring to the last paragraph, the whole fiasco is getting crazier. It is not just SMS/call, recently someone posted on facebook claiming that after answering those suspicious call, they tried to call the number on the back of their debit/credit card, it directed to the scammer, and when they tried with another phone, it goes to the legit call centre.
soul78
post Jun 17 2022, 12:03 AM

Enthusiast
*****
Junior Member
933 posts

Joined: Jul 2005


nothing to do with malicious apk files and all these bull la at this point in time. There are already statements made by those impacted that they did not install or have clicked on any linked in emails etc.

Banks have to investigate if police says this is not in their purview to investigate. If not it's up to BNM to find out what is the issue.

For now.. you do what you need to safeguard your hard earned money. If banks does not strike confidence from their investors is their problem that people would not put more cash in banks moving forward.

Steps I've taken to protect myself.
- Only have less than 5k at one time in bank.
- Keep more in EPF which requires more manual intervention.
- Limit bank footprint. Have only 1-2 banks.
- If possible have overseas bank if you're able.
- Keep some in cryptos. You are your own bank.
- Keep in physical assets. gold/silver.

Other possiblities:
- Joint account which requires 2 person to remove cash.
- Put money in investment platforms that uses more secure 2FA authentication like 30secs codes i.e google authentication type of platform.
- Secure your email with Yubikey as recovery and Remove your phone number from Gmail recovery procedure.




SUSyklooi
post Jun 17 2022, 12:11 AM

Look at all my stars!!
*******
Senior Member
8,188 posts

Joined: Apr 2013


QUOTE(soul78 @ Jun 17 2022, 12:03 AM)
...........
- Secure your email with Yubikey as recovery and Remove your phone number from Gmail recovery procedure.
*
👍👍
Damned,... I Did not think about that before.
Thks for the tips
ragk
post Jun 17 2022, 11:01 AM

BooBoo~
*******
Senior Member
2,353 posts

Joined: Apr 2009


QUOTE(Wei6737 @ Jun 16 2022, 11:52 PM)
Referring to the last paragraph, the whole fiasco is getting crazier. It is not just SMS/call, recently someone posted on facebook claiming that after answering those suspicious call, they tried to call the number on the back of their debit/credit card, it directed to the scammer, and when they tried with another phone, it goes to the legit call centre.
*
Yeap malicious app can do many thing as long their app has been granted the sufficient access, it depend on how creative they wanted to carry out the scam
And many legit app also tend to request access that's very fishy, like Gmail wanted access to microphone, not saying that Gmail is going to sabotage my phone, but it's just annoying all the random app wanted to access all ur information

QUOTE(soul78 @ Jun 17 2022, 12:03 AM)
nothing to do with malicious apk files and all these bull la at this point in time. There are already statements made by those impacted that they did not install or have clicked on any linked in emails etc.

Banks have to investigate if police says this is not in their purview to investigate. If not it's up to BNM to find out what is the issue.

For now.. you do what you need to safeguard your hard earned money. If banks does not strike confidence from their investors is their problem that people would not put more cash in banks moving forward.

Steps I've taken to protect myself.
- Only have less than 5k at one time in bank.
- Keep more in EPF which requires more manual intervention.
- Limit bank footprint. Have only 1-2 banks.
- If possible have overseas bank if you're able.
- Keep some in cryptos. You are your own bank.
- Keep in physical assets. gold/silver.

Other possiblities:
- Joint account which requires 2 person to remove cash.
- Put money in investment platforms that uses more secure 2FA authentication like 30secs codes i.e google authentication type of platform.
- Secure your email with Yubikey as recovery and Remove your phone number from Gmail recovery procedure.
*
Many case still related to malicious apk, at least from what I see from reported by the news, so it's still good to have those awareness
But I do believe some case is due to black sheep in the bank
Email is very good point too, since many of the account today linked to Gmail/Facebook login, its very jialat when ur mail/facebook account got compromise

This post has been edited by ragk: Jun 17 2022, 11:23 AM
aeiou228
post Jun 26 2022, 09:42 PM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
https://m.facebook.com/story.php?story_fbid...id=323440711827
Millions of ringgit missing from 40 bank accounts holders. This time, malicious APP is not the culprit, it's insider job instead.

Jitty
post Jun 27 2022, 11:28 AM

Regular
******
Senior Member
1,046 posts

Joined: Nov 2014



QUOTE(aeiou228 @ Jun 26 2022, 09:42 PM)
https://m.facebook.com/story.php?story_fbid...id=323440711827
Millions of ringgit missing from 40 bank accounts holders. This time, malicious APP is not the culprit, it's insider job instead.
*
is this C**B bank?
MUM
post Jun 27 2022, 01:06 PM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

QUOTE(aeiou228 @ Jun 26 2022, 09:42 PM)
https://m.facebook.com/story.php?story_fbid...id=323440711827
Millions of ringgit missing from 40 bank accounts holders. This time, malicious APP is not the culprit, it's insider job instead.
*
for those that has no FB but want to know more about that read outs can try this....

Break your silence on millions lost by victims in ‘fraud’, MP tells bank
Dineskumar Ragu -June 26, 2022
https://www.freemalaysiatoday.com/category/...-mp-tells-bank/

KHOdin
post Jun 27 2022, 02:43 PM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
TIL maybank does not support SMS OTP since March this year
is there any known cases for maybank after March ?
MUM
post Jun 27 2022, 06:35 PM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

QUOTE(MUM @ Jun 27 2022, 01:06 PM)
for those that has no FB but want to know more about that read outs can try this....

Break your silence on millions lost by victims in ‘fraud’, MP tells bank
Dineskumar Ragu -June 26, 2022
https://www.freemalaysiatoday.com/category/...-mp-tells-bank/
*
As per today news update,....
Probe on bank cheating case still ongoing, say cops.
Monday, 27 Jun 20226:06 PM

Investigations on a cheating case involving bank customers is still ongoing, say police.

"A report was lodged by the bank on Jan 31 over customers’ money being swindled by a bank manager in Selangor.
https://www.thestar.com.my/news/nation/2022...ngoing-say-cops

aeiou228
post Aug 20 2022, 10:52 PM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
https://www.facebook.com/294025920750452/po...VdQBl/?sfnsn=mo
Dr also Jean scammed.
Ramjade
post Aug 20 2022, 11:33 PM

20k VIP Club
*********
All Stars
24,388 posts

Joined: Feb 2011


Just put money into KDI, and leave min amount inside the acocunt. Settle. No more scam.

This post has been edited by Ramjade: Aug 21 2022, 09:05 AM
tadashi987
post Aug 20 2022, 11:35 PM

Look at all my stars!!
*******
Senior Member
2,106 posts

Joined: Jul 2018
i think the one of the most important prevention is ensure u don't install untrusted source app e.g. apk not downloaded from playstore etc.
jack2
post Aug 20 2022, 11:49 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
QUOTE(tadashi987 @ Aug 20 2022, 11:35 PM)
i think the one of the most important prevention is ensure u don't install untrusted source app e.g. apk not downloaded from playstore etc.
*
As written in the news, the CIMB claimed that she clicked one link and then kena... if this claim is true, how about if we accidently click the link or advertisement that indirectly forward to another link?
aeiou228
post Aug 21 2022, 08:59 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
https://m.facebook.com/story.php?story_fbid...823540&sfnsn=mo
Dr's open letter on her FB
akhito
post Aug 21 2022, 09:21 AM

Enthusiast
*****
Junior Member
749 posts

Joined: Jul 2016


Just to add on, even app on Google play store is not 100% safe
https://www.ghacks.net/2022/08/01/researche...gle-play-store/ kinda even worse now on google play since they remove viewing app permission before downloading app(said will reinstated but dunno when la) so u cannot use permission to vet out sus app. doh.gif
Apple devices can be sideload app just by clicking link
https://arstechnica.com/information-technol...on-ios-devices/
so the best way i can think of is kept a secondary phone as banking authenticate which u install minimal or none other app use maybank secure2u, pbebank seucresign app etc. stay away for sms OTP infact this is what bank negara was pushing
There is someone that suggest using brokerage akaun which can only withdrawn to ur one bank acc but the downside is timelag for withdrawal

This post has been edited by akhito: Aug 21 2022, 09:21 AM
CommodoreAmiga
post Aug 21 2022, 10:44 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


I am thinking now to buy an old Nokia dedicated for receiving TAC. Will this be workable? But some bank apps use a combination of secureapp and TAC depending on the type of transactions.

Can't hack a dumb phone right?
SUSyklooi
post Aug 21 2022, 12:32 PM

Look at all my stars!!
*******
Senior Member
8,188 posts

Joined: Apr 2013


What if you received the TAC in a separate phone, but revealed it to the scammer?

Never reveal your OTP/TAC to any third party even if the party requesting for such information claims to be from a financial institution, Bank Negara Malaysia or other government agencies.
https://www.rhbgroup.com/others/fraud-aware...ment%20agencies.
CommodoreAmiga
post Aug 21 2022, 12:59 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(yklooi @ Aug 21 2022, 12:32 PM)
What if you received the TAC in a separate phone,  but revealed it to the scammer?

Never reveal your OTP/TAC to any third party even if the party requesting for such information claims to be from a financial institution, Bank Negara Malaysia or other government agencies.
https://www.rhbgroup.com/others/fraud-aware...ment%20agencies.
*
I think a lot of the cases is not user revealed to scammers, but totally no TAC. This could be phone hacked, SMS redirected after they receive the OTP and delete it by thealware, so user not aware. Once redirected, they can do whatever they want.
CommodoreAmiga
post Aug 21 2022, 01:01 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(soul78 @ Jun 17 2022, 12:03 AM)
nothing to do with malicious apk files and all these bull la at this point in time. There are already statements made by those impacted that they did not install or have clicked on any linked in emails etc.

Banks have to investigate if police says this is not in their purview to investigate. If not it's up to BNM to find out what is the issue.

For now.. you do what you need to safeguard your hard earned money. If banks does not strike confidence from their investors is their problem that people would not put more cash in banks moving forward.

Steps I've taken to protect myself.
- Only have less than 5k at one time in bank.
- Keep more in EPF which requires more manual intervention.
- Limit bank footprint. Have only 1-2 banks.
- If possible have overseas bank if you're able.
- Keep some in cryptos. You are your own bank.
- Keep in physical assets. gold/silver.

Other possiblities:
- Joint account which requires 2 person to remove cash.
- Put money in investment platforms that uses more secure 2FA authentication like 30secs codes i.e google authentication type of platform.
- Secure your email with Yubikey as recovery and Remove your phone number from Gmail recovery procedure.
*
Not good idea. You will lose money faster than scammer can scam you


SUSyklooi
post Aug 21 2022, 01:37 PM

Look at all my stars!!
*******
Senior Member
8,188 posts

Joined: Apr 2013


QUOTE(CommodoreAmiga @ Aug 21 2022, 12:59 PM)
I think a lot of the cases is not user revealed to scammers, but totally no TAC. This could be phone hacked, SMS redirected after they receive the OTP and delete it by thealware, so user not aware. Once redirected, they can do whatever they want.
*
🤔🤔Then it is the problem of the "smartphone" as it allowed downloads of apps that may hv hacking virus...
Not so much of the dumb phone problem... Thus have the extra dump phone just to receives TAC (as you suggested earlier) may not helps much.
CommodoreAmiga
post Aug 21 2022, 02:51 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(yklooi @ Aug 21 2022, 01:37 PM)
🤔🤔Then it is the problem of the "smartphone"  as it allowed downloads of apps that may hv hacking virus...
Not so much of the dumb phone problem...  Thus have the extra dump phone just to receives TAC (as you suggested earlier) may not helps much.
*
Yes. It's a known issue. If you download dodgy app other from Playstore, you sendiri cari pasal. I think dumb phones will help, since it is not capable much of anything, so can't download malware and hack, even if you wanted to. Besides, nobody bother to target those obselete dinosaurs anyway.
jack2
post Aug 21 2022, 03:40 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
phone number spoofing
tadashi987
post Aug 21 2022, 04:55 PM

Look at all my stars!!
*******
Senior Member
2,106 posts

Joined: Jul 2018
BNM is losing its reputation with all these cases
SUSBlackagar Boltagon
post Aug 21 2022, 05:27 PM

Getting Started
**
Junior Member
67 posts

Joined: Aug 2022
Try to avoid saving credit card number in apps. If got, remove them now.

Dont simply download apps.

Try use bigpay as intermediate payments if want to use CC. Use only 1 bigpay card online.
CommodoreAmiga
post Aug 21 2022, 05:43 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


user posted image

I think I have just received a CIMB fake link by scammer!!

I Certainly don't have any account application in progress!
acbc
post Aug 21 2022, 05:50 PM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
1. Use Truecaller to identify and filter out known scammers.

2. On primary phone, u can install the usual social media and messaging apps but no banking related apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Link TAC number with dumb phone below. No social media or messaging apps here.

3. On spare dumb phone, use a new number solely for receiving TAC and block in incoming and outgoing calls.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number and cannot receive or make calls. All blocked on the phone itself. And finally, an old Nokia 106 solely for receiving TAC and cannot make or receive calls too. Plus, it is small enough to be in the pocket most of the time. Only need recharging every 2 weeks.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone, RM 28 (DiGi) for secondary and finally RM 3 (Yoodo) for SMS.

Simple security tips.

This post has been edited by acbc: Aug 21 2022, 05:51 PM
CommodoreAmiga
post Aug 21 2022, 06:06 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(acbc @ Aug 21 2022, 05:50 PM)
1. Use Truecaller to identify and filter out known scammers.

2. On primary phone, u can install the usual social media and messaging apps but no banking related apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Link TAC number with dumb phone below. No social media or messaging apps here.

3. On spare dumb phone, use a new number solely for receiving TAC and block in incoming and outgoing calls.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number and cannot receive or make calls. All blocked on the phone itself. And finally, an old Nokia 106 solely for receiving TAC and cannot make or receive calls too. Plus, it is small enough to be in the pocket most of the time. Only need recharging every 2 weeks.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone, RM 28 (DiGi) for secondary and finally RM 3 (Yoodo) for SMS.

Simple security tips.
*
What do you mean by link TAC no to dumb phone? You mean all the bank TAC no goes to the dumb phone? Means none of the bank account will send TAC to phone 1 and 2. What about contact? How do bank contact you? By primary phone? Can you set TAC and contact no separately? I can't remember.
Mijac
post Aug 21 2022, 08:42 PM

On my way
****
Junior Member
538 posts

Joined: Feb 2018
QUOTE(acbc @ Aug 21 2022, 05:50 PM)
1. Use Truecaller to identify and filter out known scammers.

2. On primary phone, u can install the usual social media and messaging apps but no banking related apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Link TAC number with dumb phone below. No social media or messaging apps here.

3. On spare dumb phone, use a new number solely for receiving TAC and block in incoming and outgoing calls.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number and cannot receive or make calls. All blocked on the phone itself. And finally, an old Nokia 106 solely for receiving TAC and cannot make or receive calls too. Plus, it is small enough to be in the pocket most of the time. Only need recharging every 2 weeks.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone, RM 28 (DiGi) for secondary and finally RM 3 (Yoodo) for SMS.

Simple security tips.
*
Great detail and info.
Interesting read.

Thanks for sharing your simple security tips.
:thumbsup:
red streak
post Aug 21 2022, 08:43 PM

Doto 2 Pinoy Slayer
******
Senior Member
1,594 posts

Joined: Feb 2006


QUOTE(CommodoreAmiga @ Aug 21 2022, 05:43 PM)
user posted image

I think I have just received a CIMB fake link by scammer!!

I Certainly don't have any account application in progress!
*
Let me guess, it's from the 63001 number? hmm.gif
jack2
post Aug 21 2022, 09:42 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
QUOTE(tadashi987 @ Aug 21 2022, 04:55 PM)
BNM is losing its reputation with all these cases
*
it has been so long until now and yet to come out with the solution
Zuchie
post Aug 21 2022, 09:46 PM

New Member
*
Newbie
22 posts

Joined: May 2017


all this is the fault of the national bank. don't know why not tighten the law.
BNM pukimak!
Actually all banks are vulnerable but what happened to CIMB is the worst.

This post has been edited by Zuchie: Aug 21 2022, 09:50 PM
CommodoreAmiga
post Aug 21 2022, 09:51 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(red streak @ Aug 21 2022, 08:43 PM)
Let me guess, it's from the 63001 number?  hmm.gif
*
No. From 61750. This number was recently used by DHL to sent me some info on my package recently.
red streak
post Aug 21 2022, 10:13 PM

Doto 2 Pinoy Slayer
******
Senior Member
1,594 posts

Joined: Feb 2006


QUOTE(CommodoreAmiga @ Aug 21 2022, 09:51 PM)
No. From 61750. This number was recently used by DHL to sent me some info on my package recently.
*
That's the number I just got it from. Might be legit since the url is the same as what cimb uses but I still wouldn't click on it. It might just be a mistake since our local retards banks tend to make a bunch of stupid mistakes like that. Hong Leong did a system wide nonsensical test message the other day via their app and then said sorry later.
CommodoreAmiga
post Aug 21 2022, 10:27 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(red streak @ Aug 21 2022, 10:13 PM)
That's the number I just got it from. Might be legit since the url is the same as what cimb uses but I still wouldn't click on it. It might just be a mistake since our local retards banks tend to make a bunch of stupid mistakes like that. Hong Leong did a system wide nonsensical test message the other day via their app and then said sorry later.
*
I receive that test message too from HLB. But the above SMS from CIMB is too suspicious.
ZeneticX
post Aug 21 2022, 10:34 PM

stars for what
********
All Stars
12,413 posts

Joined: Jan 2008
From: KL - Cardiff - Subang - Sydney



Last time when I was in UK for few years, I used to have a UK bank account (under Barclays)

They provide something like a physical RSA key, basically a device to generate random code for 2FA. That device is tied to your name/account only. Any transaction have to enter the code to authenticate. This is much more secure than the OTP/TAC system we are using here

Infact now I think about it, even a simple 2FA method using Google authenticator app also more secure. Wonder why banks dont adopt this method

This post has been edited by ZeneticX: Aug 21 2022, 10:40 PM
jack2
post Aug 21 2022, 10:34 PM

Mr
********
All Stars
15,192 posts

Joined: Oct 2004
Why such fake SMS can't be traced to know the origin source/sender?
MUM
post Aug 21 2022, 10:47 PM

10k Club
********
All Stars
14,932 posts

Joined: Mar 2015

7 months ago, ....

Banks to tighten security, remove clickable links in SMSes or e-mails sent to retail customers, within the next two weeks after OCBC phishing scams

https://www.straitstimes.com/business/banki...curity-in-spore

Malaysia has yet to implement it.


This post has been edited by MUM: Aug 22 2022, 06:18 AM
cyclopcom
post Aug 25 2022, 07:24 AM

Getting Started
**
Junior Member
54 posts

Joined: Feb 2017
From my past several months observations,i feel that the most dangerous banks are hong leong bank and CIMB, second most dangerous banks are rhb,ambank and public bank.The rest also got theft cases but not so many.
download88
post Aug 25 2022, 03:21 PM

Getting Started
**
Junior Member
271 posts

Joined: Oct 2006


https://www.facebook.com/ohmedianetwork/pho...63324840519572/

tabung haji also kena nowadays

user posted image

This post has been edited by download88: Aug 30 2022, 03:25 PM
babyscouts
post Aug 25 2022, 05:24 PM

Getting Started
**
Junior Member
160 posts

Joined: Feb 2012
QUOTE(cyclopcom @ Aug 25 2022, 07:24 AM)
From my past several months observations,i feel that the most dangerous banks are hong leong bank and CIMB, second most dangerous banks are rhb,ambank and public bank.The rest also got theft cases but not so many.
*
Maybank ? hmm.gif
aeiou228
post Aug 26 2022, 10:36 PM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
2 more cases reported.

RM7k HLB
user posted image
user posted image

RM82k
https://www.enanyang.my/%E8%A6%81%E9%97%BB/...%84%E5%89%A9800
aeiou228
post Sep 8 2022, 08:52 PM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
PBB 7SEP2022

https://www.facebook.com/groups/10624883604...sn=mo&ref=share
Hinote
post Sep 19 2022, 04:53 PM

New Member
*
Junior Member
47 posts

Joined: Mar 2020
QUOTE(cyclopcom @ Aug 25 2022, 07:24 AM)
From my past several months observations,i feel that the most dangerous banks are hong leong bank and CIMB, second most dangerous banks are rhb,ambank and public bank.The rest also got theft cases but not so many.
*
QUOTE(babyscouts @ Aug 25 2022, 05:24 PM)
Maybank ?  hmm.gif
*
Yea, how about Maybank too?

Could be cause of these banks are more popular and have more customers thus looks to be having higher fraud rates, while "the rest" looks to have lesser cases as with lesser customers, likely.
Mavik
post Sep 19 2022, 05:17 PM

Patience is a virtue
Group Icon
Elite
7,826 posts

Joined: Jan 2003



QUOTE(MUM @ Aug 21 2022, 10:47 PM)
7 months ago, ....

Banks to tighten security, remove clickable links in SMSes or e-mails sent to retail customers, within the next two weeks after OCBC phishing scams

https://www.straitstimes.com/business/banki...curity-in-spore

Malaysia has yet to implement it.
*
This was implemented at the bank I was working at. On one hand, we received loads of customer complaints because trying to navigate over to the location was difficult and without the link the call to action, this brought the numbers of conversions down by double digit from both a sales perspective.
LemonJane
post Sep 20 2022, 01:47 PM

suli0206
******
Senior Member
1,107 posts

Joined: May 2016


I just received this email. No sender's email, don't know the guy in the photo. Scary

user posted image

This post has been edited by LemonJane: Sep 20 2022, 02:00 PM
CommodoreAmiga
post Sep 20 2022, 07:27 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


This is why I have changed my TAc SMS to a Nokia dumb phone with no data line. sweat.gif
aeiou228
post Sep 27 2022, 10:04 AM

Look at all my stars!!
*******
Senior Member
5,867 posts

Joined: Feb 2006
BNM unveils new measures to strengthen safeguards against financial scams

https://www.thestar.com.my/business/busines...#openShareModal

KUALA LUMPUR: Bank Negara Malaysia (BNM) today announced five additional security measures to be taken by financial institutions in a bid to strengthen safeguards against financial scams, especially online ones.

Governor Tan Sri Nor Shamsiah Mohd Yunus said the modus operandi used by criminals will continue to evolve.
"BNM is therefore continuously intensifying efforts and taking steps to combat scams by introducing additional controls and safeguards from time to time,” she said at the launch of the virtual Financial Cime Exhibition today.


Among the latest measures is requiring financial institutions to migrate from SMS One Time Passwords (OTP) to more secure forms of authentication for online activities or transactions relating to account opening, fund transfers and payments, as well as changes to personal information and account settings.

Nor Shamsiah said financial institutions will also further tighten fraud detection rules and triggers for blocking suspected scam transactions.

"Customers will be immediately alerted when any such activity involving their banking accounts is detected. As an additional measure, financial institutions will block such transactions, and customers will be asked to confirm that such transactions are genuine before they are unblocked,” she said.

Third, a cooling-off period will be observed for the first-time enrolment of online banking services or secure devices, during which no online banking activity is allowed to be conducted.

Moreover, the governor said, customers will be restricted to one mobile or secure device for the authentication of online banking transactions and financial institutions will be required to set up dedicated hotlines for customers to report financial scam incidents.

"Financial institutions have been directed to be more responsive to scam reports lodged by customers. They have also been directed to facilitate efforts to recover and protect stolen funds, including to work with relevant agencies to prevent further losses,” she said.

Nor Shamsiah noted that BNM requires banks in Malaysia to adopt high standards of security, especially for Internet and mobile banking services.

"From time to time, the central bank also issues security advisories to the financial industry highlighting the latest modus operandi of scammers and additional security measures that banks need to implement to protect their customers' savings,” she said.

Nor Shamsiah said the Royal Malaysia Police (PDRM) plays an important role in combating scams, and has implemented various initiatives on this front, including establishing the Commercial Crime Investigation Department (CCID) Scam Response Centre to facilitate the public’s reporting of financial scams.

"BNM will work together with PDRM, the Malaysian Communications and Multimedia Commission (MCMC), and the National Anti-Financial Crime Centre to further elevate the CCID Scam Response Centre as a more systematic information sharing platform that will enable quicker action to prevent further losses,” she said.

According to her, an important aspect in dealing with financial scams is raising public awareness, including of scam tactics used by criminals and the steps that the public can take to avoid becoming victims.

"In this regard, BNM, the financial industry and law enforcement agencies will continue efforts to enhance the effectiveness of awareness programmes and improve on the dissemination of information to the public,” she added.

The virtual Financial Crime Exhibition, organised by the the Museum and Art Gallery of BNM together with PDRM, is aimed at educating the public on financial fraud and can be accessed at https://museum.bnm.gov.my/fce.

It was officiated jointly by Nor Shamsiah and Inspector-General of Police Tan Sri Acryl Sani Abdullah Sani. - Bernama
CommodoreAmiga
post Sep 27 2022, 10:23 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


Another simple method. Allow user to disable midnight transactions. Say between 12am to 7am. A lot of cases happens when you are sleeping. Surely most people don't do shopping midnight (unless got those sales) and anything so urgent meh? Can always wait to transfer in the morning.
KHOdin
post Sep 27 2022, 01:23 PM

7 Stars Newbie
*******
Senior Member
2,928 posts

Joined: Oct 2008
From: Somewhere On The Earth
QUOTE(acbc @ Aug 21 2022, 05:50 PM)
1. Use Truecaller to identify and filter out known scammers.

2. On primary phone, u can install the usual social media and messaging apps but no banking related apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Link TAC number with dumb phone below. No social media or messaging apps here.

3. On spare dumb phone, use a new number solely for receiving TAC and block in incoming and outgoing calls.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number and cannot receive or make calls. All blocked on the phone itself. And finally, an old Nokia 106 solely for receiving TAC and cannot make or receive calls too. Plus, it is small enough to be in the pocket most of the time. Only need recharging every 2 weeks.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone, RM 28 (DiGi) for secondary and finally RM 3 (Yoodo) for SMS.

Simple security tips.
*
seem like great idea but why separating tac phone and bank apps ya?
sad that we need to take all these security precautions on our own hand
CommodoreAmiga
post Sep 27 2022, 04:39 PM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(KHOdin @ Sep 27 2022, 01:23 PM)
seem like great idea but why separating tac phone and bank apps ya?
sad that we need to take all these security precautions on our own hand
*
Because smartphone too smart. One of the common hack is via malware downloaded, once they have your Id and password, they need the TAC to make setting changes and transactions approval. If the TAC is sent to the same phone (usually it is for most people), they will be able to redirect that TAC to them and delete the TAC from your phone, hence a lot of cases users claim didn't receive any TAC. If your TAC is received on the dumb phone, even your smartphone hacked, they can't do anything because they don't have the TAC. It is near impossible to hack dumb phone...no app store to download, don't have USb port, and don't subscribe any data line to it.
nexona88
post Sep 27 2022, 08:36 PM

The Royal Club Member
*********
All Stars
48,521 posts

Joined: Sep 2014
From: REality
QUOTE(acbc @ Aug 21 2022, 05:50 PM)
1. Use Truecaller to identify and filter out known scammers.

2. On primary phone, u can install the usual social media and messaging apps but no banking related apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Link TAC number with dumb phone below. No social media or messaging apps here.

3. On spare dumb phone, use a new number solely for receiving TAC and block in incoming and outgoing calls.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number and cannot receive or make calls. All blocked on the phone itself. And finally, an old Nokia 106 solely for receiving TAC and cannot make or receive calls too. Plus, it is small enough to be in the pocket most of the time. Only need recharging every 2 weeks.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone, RM 28 (DiGi) for secondary and finally RM 3 (Yoodo) for SMS.

Simple security tips.
*
Woah quite detail tips...
👍
nexona88
post Sep 27 2022, 08:38 PM

The Royal Club Member
*********
All Stars
48,521 posts

Joined: Sep 2014
From: REality
QUOTE(CommodoreAmiga @ Sep 27 2022, 10:23 AM)
Another simple method. Allow user to disable midnight transactions. Say between 12am to 7am. A lot of cases happens when you are sleeping. Surely most people don't do shopping midnight (unless got those sales) and anything so urgent meh? Can always wait to transfer in the morning.
*
Or user set which time period to do transactions.... Give options to disable from time to time 💪
acbc
post Sep 27 2022, 08:42 PM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
QUOTE(nexona88 @ Sep 27 2022, 08:36 PM)
Woah quite detail tips...
👍
*
No longer useful once banks retired TAC and migrate to SecureTAC next month.

I will update the process next month again.
acbc
post Sep 27 2022, 08:44 PM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
QUOTE(KHOdin @ Sep 27 2022, 01:23 PM)
seem like great idea but why separating tac phone and bank apps ya?
sad that we need to take all these security precautions on our own hand
*
Many banks allowed separate numbers for TAC and emergency.

Why separate? Because scammers can spoof the bank's phone numbers.

If everything goes to your only number, scammers can exploit it easily with apps or links.
acbc
post Sep 27 2022, 08:55 PM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
1. Use Truecaller to identify and filter out known scammers. Install on both phones if possible.

2. On primary phone, u can install the usual social media and messaging apps but no banking related or wallet apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Activate SecureTAC on the bank apps and tie to the secondary phone number only. A dumb phone no longer useful due to the lack of TAC. No social media or messaging apps.

4. Be sure to fill in your contact numbers properly. For the bank to contact u, use the primary number and for SecureTAC, use the secondary number. Some banks may require u to enter the secondary number from the ATM or online.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number with Truecaller installed to monitor which calls coming in. U may set the app to block all calls not in the contact list for extreme security.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone and RM 28 (DiGi) for secondary.

Simple security tips.

** Updated 27/09 to support SecureTAC only **
CommodoreAmiga
post Sep 28 2022, 07:06 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(acbc @ Sep 27 2022, 08:55 PM)
1. Use Truecaller to identify and filter out known scammers. Install on both phones if possible.

2. On primary phone, u can install the usual social media and messaging apps but no banking related or wallet apps.

3. On secondary phone, use a different number solely for data but block all incoming and outgoing calls. U then install all banking related apps like normal. Activate SecureTAC on the bank apps and tie to the secondary phone number only. A dumb phone no longer useful due to the lack of TAC. No social media or messaging apps.

4. Be sure to fill in your contact numbers properly. For the bank to contact u, use the primary number and for SecureTAC, use the secondary number. Some banks may require u to enter the secondary number from the ATM or online.

For my case, I'm using the A72 as primary phone with everything loaded. For secondary phone, I opt for OnePlus 7 solely for banking related apps. Has a separate number with Truecaller installed to monitor which calls coming in. U may set the app to block all calls not in the contact list for extreme security.

As for the monthly cost, it is RM 38 (U Mobile) for primary phone and RM 28 (DiGi) for secondary.

Simple security tips.

** Updated 27/09 to support SecureTAC only **
*
Problem is there are still some banks that use TAC and some mixed. I am not sure which is which, some bank still use TAC when you change your settings like transactions limit etc.
cybpsych
post Sep 28 2022, 07:16 AM

---------------------
*********
All Stars
65,333 posts

Joined: Jan 2003
ouch

user posted image
acbc
post Sep 28 2022, 07:23 AM

Look at all my stars!!
*******
Senior Member
9,048 posts

Joined: Jan 2003
QUOTE(CommodoreAmiga @ Sep 28 2022, 07:06 AM)
Problem is there are still some banks that use TAC and some mixed. I am not sure which is which, some bank still use TAC when you change your settings like transactions limit etc.
*
Starting next month, no more TAC according to BNM.
cybpsych
post Sep 28 2022, 08:52 AM

---------------------
*********
All Stars
65,333 posts

Joined: Jan 2003
QUOTE(acbc @ Sep 28 2022, 07:23 AM)
Starting next month, no more TAC according to BNM.
*
starting next month?

didnt see BNM set a deadline though. they just put some guidelines and recommendations.
dannyw
post Sep 28 2022, 09:41 AM

Regular
******
Senior Member
1,286 posts

Joined: Jan 2007
QUOTE(cybpsych @ Sep 28 2022, 07:16 AM)
ouch

user posted image
*
Huh... those old phone force to change? doh.gif

Have to check my wife's phone Android version (Redmi Note 8)


cybpsych
post Sep 28 2022, 09:55 AM

---------------------
*********
All Stars
65,333 posts

Joined: Jan 2003
QUOTE(dannyw @ Sep 28 2022, 09:41 AM)
Huh... those old phone force to change?  doh.gif

Have to check my wife's phone Android version (Redmi Note 8)
*
RN8 is using Android 11 laugh.gif

i'm using this phone as well, but not amonline app
CommodoreAmiga
post Sep 28 2022, 10:10 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(acbc @ Sep 28 2022, 07:23 AM)
Starting next month, no more TAC according to BNM.
*
QUOTE(cybpsych @ Sep 28 2022, 08:52 AM)
starting next month?

didnt see BNM set a deadline though. they just put some guidelines and recommendations.
*
Yeah, where can change so fast. This is Malaysia. They will drag another 6 mths or more if no deadline. Malaysia boleh.
dannyw
post Sep 28 2022, 10:22 AM

Regular
******
Senior Member
1,286 posts

Joined: Jan 2007
QUOTE(cybpsych @ Sep 28 2022, 09:55 AM)
RN8 is using Android 11  laugh.gif

i'm using this phone as well, but not amonline app
*
Noted with thanks, you no account with them? Just her phone never update, only update one time during unbox biggrin.gif

Looks like have to update if is not Android 10. Else the FD stuck there.

Now days phone can't use long due to the apps requirement.
cybpsych
post Sep 28 2022, 10:38 AM

---------------------
*********
All Stars
65,333 posts

Joined: Jan 2003
Maybank To Fully Migrate To Secure Authentication By June 2023: CEO

https://www.businesstoday.com.my/2022/09/28...-june-2023-ceo/

Maybank said it will fully migrate to a more secured authentication method via Secure2u by June 2023 for online activities or transactions relating to account opening, fund transfers, and payments as well as changes to personal information and account settings.

The group said this will be in line with Bank Negara’s steer for Banks to migrate from SMS One Time Passwords (OTP) to more secure authentication for these transactions.

Currently, Maybank only allows one Secure2u device per account holder (per customer) to minimise the possibility of a customer’s online banking details being compromised or used by any third party. As an added security measure, Maybank alerts a customer via SMS, push notification, and email when Secure2u is registered on a new device.

...

Maybank will also introduce a cooling-off period when customers enable Secure2u on a different device to help prevent unauthorised Secure2u approvals by the fourth quarter of 2022. The cooling-off period before the activation of Secure2u on a new mobile device will provide sufficient time for customers to verify and report to the Bank in case of any unauthorised registration.

This post has been edited by cybpsych: Sep 28 2022, 10:38 AM
cyclopcom
post Sep 28 2022, 02:15 PM

Getting Started
**
Junior Member
54 posts

Joined: Feb 2017
I think most people are making the wrong judgement on this matter, the culprits of this crime are smartphone and mole ,not TAC or SMS. That's why you seldom see elderly kena stolen money , because they don't use or don’t know how to use smartphone. If you force people to use smartphone or app then you will push those elderly or non tech savvy into high risk. So,i suggest bank/bnm should not directly/indirectly forcing people to use smartphone or app, you should take the risk if you prefer mobile banking.

Some cases also kena stolen money even the victim never activate online banking,then in this case the mole should be the culprit.

This post has been edited by cyclopcom: Sep 28 2022, 02:21 PM
akhito
post Sep 28 2022, 02:24 PM

Enthusiast
*****
Junior Member
749 posts

Joined: Jul 2016


QUOTE(cyclopcom @ Sep 28 2022, 02:15 PM)
I think most people are making the wrong judgement on this matter, the culprits of this criminal are smartphone and mole ,not TAC or SMS. That's why you seldom see elderly kena stolen money , because they don't use or don’t know how to use smartphone. If you force people to use smartphone or app then you will push those elderly or non tech savvy into high risk.  So,i suggest bank/bnm should not directly/indirectly forcing people to use smartphone or app, you should take the risk if you prefer mobile banking.
How to push elderly to risk when they are not using smartphone in the first place. They are not  affected by scam because they are not using online banking at all. The only afffected ppl is elderly that use pc banking  but no smartphone. How realistic will be the number be. The chance are if he/she can use pc, for sure they have access to smartphone and are willing to learn. Now iti just time to update with more security knowledge and practices

BNM tightening security measure on smart devices is good because sms is insecure and very easy to spoof

Some cases also kena stolen money even the victim never activat.e online banking,then in this case the mole should be the culprit.
Yes this I agree but apk scam, click link dominated them all
*
This post has been edited by akhito: Sep 28 2022, 02:25 PM
TY155 P
post Sep 28 2022, 02:28 PM

New Member
*
Probation
5 posts

Joined: Aug 2022
Actually whenever there is any security update / patch, i will always run and install it. Where some old ppl say do not upgrade it as it slow down your phone. Im like ... ??? What? ~

Reason ambank set not gonna support those device below android 10 below, i guess its because, Android 10 and above has more security restriction.
cyclopcom
post Sep 28 2022, 02:59 PM

Getting Started
**
Junior Member
54 posts

Joined: Feb 2017
QUOTE(akhito @ Sep 28 2022, 02:24 PM)
The chance are if he/she can use pc, for sure they have access to smartphone and are willing to learn.
*
can use pc≠ have access to smartphone ≠ know how to protect himself from scam ≠ know how to response when facing scam ≠ tech savvy ≠ willing to learn ≠ can ge rid of hack/scam after learn .

This is why so many young people kena hack/stole because they think they are familiar with technology and careful enough to prevent being stole, but the fact refute this, not to mention the elderly and non tech savvy.
cmk96
post Sep 28 2022, 03:03 PM

Look at all my stars!!
*******
Senior Member
2,096 posts

Joined: Oct 2007
QUOTE(TY155 @ Sep 28 2022, 02:28 PM)
Actually whenever there is any security update / patch, i will always run and install it. Where some old ppl say do not upgrade it as it slow down your phone. Im like ... ??? What? ~

Reason ambank set not gonna support those device below android 10 below, i guess its because, Android 10 and above has more security restriction.
*
old ppl don't want any changes to their phone... because the layout of android 9,10 and 11 is different.

previosly in worked in vaccination ppv... many old ppl cant display their booster digital cert coz they hv older mysejahtera version.

i said...you hv no choice...must update to latest version... they will take photo of the old cert first...in case after update... every thing will be gone!

yup.. they are paranoid in updating their phones.
akhito
post Sep 28 2022, 03:12 PM

Enthusiast
*****
Junior Member
749 posts

Joined: Jul 2016


QUOTE(cyclopcom @ Sep 28 2022, 02:59 PM)
can use pc≠ have access to smartphone ≠ know how to protect himself from scam ≠ know how to response when facing scam ≠ tech savvy ≠ willing to learn ≠ can ge rid of hack/scam after learn .

This is why so many young people kena hack/stole because they think they are familiar with technology and careful enough to prevent being stole, but the fact refute this, not to mention the elderly and non tech savvy.
*
u know can use pc without smartphone is almost nil right. when using new technology u should always be aware and learn not been ignorant. If BNM no depreciate sms otp then got sim spoof then I bet ppl will blame BNM do nothing to protect their money.

The Gabenor ald stated very clear that the practices are trading ease of use for security. And from security standpoint, security and ease of use always din go hand in hand.

Moreover, weakest link in security is human. If the user being ignorant no matter what system in place also no use. Wan secure without learning just don't touch online banking just like my old uncle that did not open online banking and visit bank counter to perform transaction.

This post has been edited by akhito: Sep 28 2022, 03:13 PM
CommodoreAmiga
post Sep 29 2022, 06:23 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(TY155 @ Sep 28 2022, 02:28 PM)
Actually whenever there is any security update / patch, i will always run and install it. Where some old ppl say do not upgrade it as it slow down your phone. Im like ... ??? What? ~

Reason ambank set not gonna support those device below android 10 below, i guess its because, Android 10 and above has more security restriction.
*
Like some people still insisting on using Windows XP or 7. Lol.
CommodoreAmiga
post Sep 29 2022, 06:25 AM

Look at all my stars!!
*******
Senior Member
3,864 posts

Joined: Jun 2022


QUOTE(CommodoreAmiga @ Sep 28 2022, 10:10 AM)
Yeah, where can change so fast. This is Malaysia. They will drag another 6 mths or more if no deadline. Malaysia boleh.
*
Maybank just announced complete transition sometime middle of 2023, as expected.
TY155 P
post Oct 3 2022, 04:01 PM

New Member
*
Probation
5 posts

Joined: Aug 2022
QUOTE(CommodoreAmiga @ Sep 29 2022, 06:23 AM)
Like some people still insisting on using Windows XP or 7. Lol.
*
Ouch.. thats... too much for XP hahaha but my work place still using Vista.. where 2 weeks ago, my boss baru upgrade other pc window xp to Window 10 (x.x)
k town shit
post Oct 4 2022, 09:13 AM

Enthusiast
*****
Junior Member
771 posts

Joined: Jan 2009
QUOTE(shamino_00 @ Jun 7 2022, 12:46 PM)
Happen to HSBC a fren of mine. Money transferred out without OTP or any authorization. He just got SMS notifying him $$$ charged to be his account in a foreign country. His account is purely savings account and not used for any online transaction. No explanation given by the bank. Heard another customer there got tens of thousands withdrawn as well.
*
Even HSBC also not safe?
I thought it happened to local bank only

 

Change to:
| Lo-Fi Version
0.0517sec    0.61    5 queries    GZIP Disabled
Time is now: 15th December 2025 - 07:12 AM