Anyone here kena unauthorized transaction with their grabpay account?

someone topup your grabpay via your credit card & transfer all your grabpay $$$$ to PayerMax a global gateway merchant. Max transaction rm1500.00 per day.

Many user kena. Grabpay is clueless in investigating for refund process.

total rm1500 being siphon out w/o any TAC code or finger print

there was another owner complain he recorded unauthorised login via revenue harvest. IP address was traced to be in Indonesia.

I suspecting Revenue harvest engaging PayerMax as outsourced gateway partner.






https://youtu.be/w6xFNH_x7s4

This Revenue Harvest has internal issue & they are connected to many top bankers & all our common ewallet.



This post has been edited by vexus: Jan 24 2023, 12:50 AM

why need reply own post?
no grab pay

there is security flaw in grabpay system. I recommend those holding grabpay account to unlink your credit card detail.

D'uh, never link anything to your e-wallet or any payment platform

One of my friend's grabpay also kena hack last month.
At first I thought he sohai gave out otp or what.
But now i believe grabpay is the problem...

Facebook has loads of sich posting now.

credit card no problem la, just dispute the transaction. grab will do it first, if not go to card

revenue group company recently pun got internal problem among the director.

i think i have a daily limit of RM100, so when i need to use more than 100, will have to use other method to top up or spread it over to more than 1 day. knowing its not really a very secured system. rm100 per day losses still bearable, few k per day sure die lo if noticed like 48 hours later.

its also possible previous programmers left back door.

PUAS is happy this time not their issue now

/lol

butoh lanjiao punya grab.

put hand in so many cookie jar but cant even manage 1 thing properly.

if you go to their grab sg and my facebook it's the same
they are bombarded by users

there are many complaint regarding this issue. How much can they fork out?

once $$$ wired from one account to another multi tier account until it reach offshore, all linkage disappear. I can happen within 10min untraceable.

Grab management is clueless now. If they have solution, they can refund within 24hrs. Not need to wait for days/weeks.

$$$$ has to come from Grab own pocket & shared among their affiliate gateway partner or deducted from their staff bonuses. A painful mistakes that they has to accountable for.

this will include tng ewallet, shopeepay, boost, lazada ? Every local apps payment gateway is at risk now. Backdoor Loophole is either at Revenue side or thier outsourced partner PayerMax https://www.payermax.com/about/


https://www.revenue.com.my/partners/

https://www.revenue.com.my/revpay/

https://www.revenue.com.my/about/

https://www.reddit.com/r/malaysia/comments/...grabpay_wallet/

i saw this too.

how do i know, most likely its not at payment gateway side, if payment gateway side then the transaction need not to go through grab, can direct d, most likely at grab side. we as user nothing much we can do, we should just set the limit to a number thats safe for us and still able to use the service.

Duduk malaysia ni guru besar pun blind bila see rm100k cash

thanks for sharing

most likely not in malaysia d when pulling out this trick, can easily trace back who did it 1, so if still in malaysia sure dont use the magic la.

Dang, Malaysia has so much security flaws with their e wallets.

Just unlinked my credit card to my grab. Holy shit. This is fucking annoying

just block all transfer to PayerMax

The hacker pick a perfect time to execute the exploits
Now everyone cuti

Cannot patch security immediately

hello bro, why you care about grab now?? you care about your own money.

grab has made some mistakes and YOU lost your money.

they need to fix it

btw are you an android user? because i see a lot of this no otp cases happening to android users with normal banking apps too

Fix? It has to be All in singapore. Malaysia only supporting team. Can singapore grab afford to unplug from international gateway?
Any drastic movement their shares will tumble. Now they pretend nothing happen.

I have slim hope grab can stop the transaction & refund to all affected users.

Well grab pay just doesn't affect Malaysian, it seem some Singaporean also affected and Grab is a Singapore company, so technically its a Singaporean ewallet being licensed in Malaysia

^ don’t give false information la idiots

Credit card is fine .. go fuck up the bank its bank issue

Debit card is not ok .. you get fuck up

I open Grab apps also sometimes go window pop up asking me to rekey in my password and thumbprint so I will not forget.

But too busy to read so I got do it.

Lucky so far nothing happen.
I unlink all my auto top up and banks to all apps, except Sony PlayStore.

Some popular apps also Sohai one, no give option to pay using Online banking. All need to link with bank, debit/credit card one.

Not really following this issue. Let say if I have Grab credit card linked to GrabPay but no auto-reload was setup.

Am I safe from this hack?

Rule no1, don't link any cards at all
Rule no2, always leave the balance below RM10, want to use, then only top up and use immediately.

No

Either way, if any of your cards (debit/credit) were used, you still need to take steps to reverse the fraudulent transactions. Still a hassle for anyone who got scammed or money stolen. Saying credit card is fine is like saying to thieves “nah take the free money, I’ll sort it out later”.

Berapa kali mau cakap don't link your cc and debit card to any apps, delete the link after use. Bodoh tak boleh diajar to the max.

Credit card the bloody bank will call you and you just need to dispute it ..

there so many things I use with my credit card .. the time wasted to do it manually is just stupid

time is money and only stupid people think they can waste it

Don’t give false security to people saying credit card is no good .. that’s the reason people are so stupid to still think credit and debit card is the same

Shitty people

hacker located from Indon

https://goo.gl/maps/w5ZbJyQ8b9bB9GbY8




a park nice location with bank surrounding. Once $$$$ wired out from one account to another account third/fourth tier till linkage disappear. Then cash out from bank??



This post has been edited by vexus: Jan 24 2023, 10:51 AM

Inside job

Being edgy with cuss words doesn’t make it any difference

You are giving people a false sense of security. But, you do you la

Likely got issue on 2 sides

1) Grab - How could revenue harvest log into user account?

2) Revenue Harvest - This is where likely someone in the company that has access to api keys or customer data logged into the victims account to initiate the transfer.

I'm not surprised if revenue harvest outsourced some of their work to indonesia, which is quite a common practice.

damn son, who abused you when you were young?

Never link any payment cards to any online or ewallet accounts. If need to, use a prepaid CC like BP or GP. Those can freeze the card when not in use.

BP saved my ass many times because I only spend every 15th of the month. After that, the card will be frozen.

everything is ewallet now. Shop in lazada/shopee also require to save credit card info.

TnG ewallet also require to save your credit card info.

Even your local bank, duitnow, mae? also link in apps. You can't runaway.

Please report the incident to Singapore MAS, they will take the case very seriously.

Grabpay is a financial institution and they need to explain to MAS else they will be get fine or worst case license get revoked.

MAS singapore most of them still sleeping in CNY mood

not really, you can opt not to save your cc info
and some works by allowing you to top up their wallet using bank account
then you have prepaid card too

the recent prepaid card that is gaining popularity is touch and go ewallet visa

Use MAE.

No, because i use iphone

The aeon debit card is consider prepaid card?
Cos need reload before can use?....
And recently need subscribe to those ahem tvbox...
Scare they use my card detail for unknown usage....

So far ok for me. I never link any bank cards to any eWallet or apps. If need to, only link BP or GP. Both I can control. Calling the banks to report fraud transactions is no joke. Slow like molasses.

Grab banyak problem now

Yes Visa Prepaid.

Grabpay can set limit?

1.5k

lel

Tng i manually put money thru fpx. Well i only use it for toll :

Shoppe fak lazada, forever ask me to put cc/ bank acc. Cant get shoppe pay bonus/voucher

Duitnow number not touching that. Mae acc not created yet

Inb4 ayam boomer

Just put everything on first post, no need scroll so much

This is real big headache for GRAB.

Grab customer care is not responding. They are clueless.

Are they going to blame affected user & runaway from this matter?

i use a sort of "throwaway" debit card to solve the problem and link to that bank. Recently used a bank called "Rize" - a digital bank where signup takes 5-15 minutes, then u can request for a free debit card and link it with that. In that bank account u just do duitnow transfer every now and then limit to about 300-500 RM (or the amount u willing to lose in case hacker managed to steal the money) so you wont lose everything in case kena hacked. That's one way to do it.

I manually transfer money and its not difficult once u add it to your favorite.

Same concept like duitnow. Hack can hack rise & disperse your $$$ through a gateway.

If rize has breach in their security, no way you can escape. Some unlucky user will be targeted innocently.

that's why i call it a throwaway debit card account. hack also i lose whatever little is in there - i decide. Its not my salary account or main banking account so hack away. Yes i lose money but as I said - only amount I am willing to risk and lose.

i only use grab for transport,.. so never use their wallet on anything else,.. no grab food,.. no grab pay,..

I'm not well versed with Grab API but if its similar to payment gateways, I don't see how Revenue Harvest can even get customer payment tokens without them logging into customer's Grab account.

One of the guys that kena has gotten his money back through his grabpay wallet and bank account (but unsure if received by bank as he had blocked the account):
https://www.reddit.com/r/malaysia/comments/...allet/?sort=new

Good luck if got use paylater. Cannot simply remove your CC without getting paylater deactivated through Grab customer service

What is Bank Negara doing? All their so call fintech have security like cap ayam and so easy to bypass. Award so many licenses, security all meh.

top notch western system also being espionage

https://www.pcworld.com/article/1478487/350...l-accounts.html

sohai grab cant even top up without saving cc? I removed all cc .. now need top up .. need add cc and remove again lol .. when this shit gonna be over

some bank charge for adding card in online apps

Where got suxh thing

charges are at grab/merchant side. Grab charges RM5 if i recall but they refund immediately. TNG charges RM1 but depending on back, might not get back immediately..mine for TNG i didnt get back even my RM1 but not fussed up about it..at least grab refunds immediately when u make card payment - this is to "test" to ensure your card is legit.

weh i link my bank account for easy grab topup liao

Not sure about shopee but for lazada unless recent update (haven't update the app yet) change it, it is not mandatory to save cc info.

Recently lots of app UI have arsehole design. It prompt you to save the info but the option to not doing so is hidden away from view. so do scroll around abit.

Some banks or platform have one time charge, but will be refunded.

I'm not too sure as well, but the pattern suggests it. Since not everyone's facing the problem, just a handful of people and revenue harvest is the common denominator. My guess would be the token being captured somehow by a POS/Terminal that the customer use grabpay to pay with. Websites "should" redirect to grab's servers so no token exchange in the process.

Would be a huge security flaw to allow tokens to be captured by 3rd party and for it not to be a single-use token. Grab has some accountability here as well.

Maybe using China Brand andriod phone ?

one of the guys thar kena is using iphone so its not android or apk related