Malaysian Guy Loses RM896 Within Minutes In New Online Scam

In a Facebook post on 16 May, a Malaysian man revealed that one of his close friends "re-created a new Instagram account" and requested to follow him.

"He messaged me and asked for my phone number via Instagram message. Without any doubt, I gave him my phone number, knowing that he probably lost my phone number."

He explained that the scammer had posted several photos on Instagram to make it look like it was not a phishing account.

In the message, the "friend" told him to let him know what the code was so that he could see what he won.

"A Grab Activation Code (GAC) was sent to my phone number. It was an activation code, not a TAC code. I gave the activation code to him without any doubt because I know that he is my friend," he wrote, adding that he thought it was just an activation code and that it had nothing to do with his bank account.

"I saw RM425 was debited to my GrabPay account and I did not know that it was from my bank account which was linked to the GrabPay account. After a few minutes, I received a new notification from GrabPay that RM425 was paid to UNIPIN (M) SDN BHD," he wrote.

"The scammer then messaged me again on Instagram, 'Another activation code was sent to your phone, please let me know the code.' Then, I received another notification from GrabPay that another RM425 was paid to UNIPIN (M) SDN BHD."

When the man was about to message the scammer, he realised that he was blocked and immediately knew something fishy had happened. 

"When I checked my Maybank2u, I [had] lost a total amount of RM896.30 from my bank account. The scammer cleared all the money in my bank account and left RM60 balance to my GrabPay."

"As you can see from my GrabPay activity picture below, four transactions were made directly via a debit card which is linked to my GrabPay account, and one transaction was made via Maybank2u. The scammer even managed to access my Maybank2u from the GrabPay account."

"After you authorise your debit/credit cards and save them as your preference, Grab doesn't need any OTP/CVV verification from the banks for future/subsequent transactions. GAC will act as an authorisation code to proceed with any transactions."

The victim of the scam shared that another case happened last week to his friend, who lost RM405 to a scammer who approached him in a similar way.

"Please do NOT reveal your Grab account details including GAC, one-time password (OTP), GrabPIN, phone number, and any other login details," its statement read.

"[Scammers] create fake websites, emails, or instant messages that look authentic, in order to trick you into revealing your personal information (for e.g. your login details, SMS OTPs, Grab PIN, credit card details)."

According to its website, this is what it advises:

1. Avoid sharing sensitive information with others.

2. Look out for phishing attempts.

3. Don't install apps from unknown sources.

4. Follow best practices for your Grab PIN.

5. Contact your bank immediately.