Cover Story: Consumers more vulnerable to scams during pandemic

This article first appeared in Personal Wealth, The Edge Malaysia Weekly, on September 28, 2020 - October 04, 2020.
-A +A

There has been an increase in the number of financial scams recorded by the Ombudsman for Financial Services (OFS) this year, particularly during the Recovery Movement Control Order (RMCO) period, says CEO Marina Baharuddin. The growth in the number of cases is due to the increase in internet-related activities during this period, as well as scammers using the pandemic to successfully exploit victims’ financial insecurities.

As at Aug 31, the number of financial scams brought to OFS’ attention year to date (YTD) was 71. This figure is a significant increase from the 40 cases recorded in 2019 and the 12 cases registered in 2018. The organisation serves as an alternative channel to resolve disputes between financial consumers and its registered members, which are financial service providers licensed or approved by Bank Negara Malaysia.

Although about half of the scam cases received by OFS YTD were during the RMCO period, Marina highlights that they may have occurred prior to the MCO period but were only reported subsequently because those who wish to lodge a complaint with OFS have up to six months after the incident to do so.

“During the MCO period, there was an increase in internet usage. People spent more time online shopping, banking, communicating, being entertained and so on. This gave scammers more opportunities to find victims. Fraudsters are also leveraging the uncertainties during the Covid-19 pandemic, such as financial insecurity, to seek out victims,” she says.

Photo by Kenny Yap/The Edge

It is worth noting that the number of financial scams recorded by OFS does not represent the total figure in the country as many cases are resolved by the banks or police.

Marina adds that scams conducted via phone calls (telephone scams) were the most prevalent since the start of the MCO in mid-March. Types of telephone scams include the Macau scam, two-factor authentication (2FA) scam and parcel or prize scams.

Those fraudulent phone calls generally involve the scammers posing as the authorities, such as the police or officials with Bank Negara or the Malaysian Anti-Corruption Commission (MACC), and using scare tactics and social engineering skills to persuade victims to reveal sensitive information or transfer money out of their bank accounts.

Of late, telephone scams have made up the majority of cases received by OFS, with the number increasing yearly. In 2018, six cases of telephone scams were made known to OFS. In 2019, that figure almost doubled to 11 cases. And this year, there were 46 cases as at Aug 31.

Marina attributes the high number of such scams to the sophisticated methods used by fraudsters to socially manipulate and engineer their victims’ reactions as well as the latter’s susceptibility to such methods. “These fraudsters can manipulate [consumers] through social engineering, and that’s when the consumers fall into their trap by revealing banking details, authorisation codes and so on,” she says.

“In some instances, the scammers call the victim, claiming to be a regulator. They would tell the victim to go to the nearest ATM to deactivate the credit card that he had applied for. They then instruct the person not to tell anybody about the incident and to follow their instructions carefully.

“Upon arriving at the ATM, the victim is asked to change the designated phone number attached to his bank account and conduct an instant money transfer to the scammer’s account. The instructions given to the victim are so fast that he does not even realise what the scammer is doing. But after a while, the victim wises up and realises that he has been scammed.”

Conversely, the number of phishing scam cases received by OFS has declined, from five cases in 2018 to two last year. A common modus operandi in such scams is when fraudsters create a fake website that passes itself off as that of a financial institution or authority. The victim would mistakenly input his username and password, thinking it was the real website. The fraudsters would then access the victim’s online banking account using the stolen information.

Marina says the number of phishing cases is declining yearly, most likely owing to increased firewall security and the fact that scammers have no access to the victim’s phone and are unable to receive the authorisation code sent to the phone to complete the banking transaction.

Marina notes that a lack of awareness is the key factor contributing to the growing number of financial scam cases in Malaysia. “Many consumers are unaware of the common tactics used by scammers, thus they are easily convinced that what the scammers say is true, resulting in their falling for the scam.

“Many consumers are also careless with their personal information online. Consumers are highly dependent on technology in this day and age, and scammers have easier access to this wealth of information, which will increase consumers’ vulnerability to scams.”

What to do if you become a victim

It is extremely unlikely for a scam victim to be able to recover the money once it has been stolen, but it is not entirely impossible to do so, says Marina. The most crucial factor is how quickly the victim contacts the bank after the scam and how fast the bank reacts to the complaint.

“This is how the money flows. It is transferred from the victim’s account to the fraudster’s account, from which the scammer withdraws the money in cash or uses it as a conduit to transfer to a mule’s account, or transfer the money abroad,” she explains.

“The victim’s bank will have to conduct some sort of tracing to see where the money has flowed. More often than not, the money is withdrawn even before that can happen. So, there is an extremely small window of time when the money can be recovered.

“It all boils down to how fast the bank reacts to the complaint and contacts its counterpart. That is because when you transfer money, it is done almost instantly in real time. The money is transferred out the very next second.”

Marina highlights that there are only a handful of cases where scam victims managed to recover their money. She adds that, if the money has been transferred abroad, it can be held in escrow for a short period of time and there is a chance to recover it if either of the two banks holds on to the sum.

However, internet banking has made money transfers almost immediate, and scammers have come up with sophisticated ways of moving the money about to avoid detection, thus making the chances of recovery very slim.

Marina says if a victim has been scammed, the first thing he needs to do is contact the bank immediately to prevent any further transactions using the bank account. Then, the victim needs to file a police report and submit the report to the bank and lodge a formal complaint so the bank can start an investigation.

“Most victims have to wait 14 days for the bank to complete the investigation, and there are two scenarios. If the victim happens to be very lucky that day and the bank manages to recover the funds, the money is returned and the case is closed,” she says.

“An issue arises when the bank is unable to recover the funds and has no choice but to decline the claim. Then, it can refer the victim to OFS, and we will look into various aspects of the case.”

Marina points out that OFS’ role is to function as a mediator between the financial institution and consumer. If the victim believes the bank has not properly fulfilled its duties, the matter can be brought up with OFS, and it will consider the merits of the claims made by both parties.

“We will look at what the scam victim has done and how much banking info was revealed. We will also look at the bank — how fast it reacted to the complaint and whether it has a robust fraud monitoring system in place,” she says.

“If the bank had delayed responding to the victim’s complaint and was unable to recover the money, there is a possibility that the case could be resolved between the complainant and the bank, and the victim can claim a partial sum.

“But more often than not, it is the consumer who has revealed all the vital information. [At times, they not only reveal] their username and password but also their authorisation code, which enabled the fraudster to perform the transaction. So, we will weigh the issue and see what is fair and reasonable.”

Evolving scams

Marina says the modus operandi for scams is always changing, making it challenging to educate the public on the different types of scams going around. She points out that financial scams in the country go as far back as two decades, when credit card skimming and the Lebanese loop scam were prevalent.

Credit card skimming occurs when scammers use a small device to steal credit or debit card information stored in the magnetic strip during legitimate transactions. The Lebanese loop is a device named after a scam regularly used by Lebanese financial crime perpetrators. The device is inserted into an ATM’s card slot and keeps the card stuck after it has been inserted by the victim.

The victim would think the ATM has malfunctioned and leave to ask for help. The scammer would quickly retrieve the loop and stolen card, along with the PIN code, which they obtained by looking over the victim’s shoulder or posing as a bystander offering help to retrieve the card.

Marina says the Lebanese loop scam and credit card skimming are no longer prevalent in Malaysia because all financial institutions in the country have since upgraded the security features in their ATMs or replaced the credit cards with the Europay MasterCard Visa (EMV) chip-based cards in 2005.

Today, one of the most common phone scams encountered by OFS is where the victim receives a phone call from the fraudsters saying that they have made an online bank transfer but have mistakenly registered the victim’s phone number and did not receive the transaction authorisation code (TAC). They will then ask the victim to reveal the TAC to carry out the transaction.

“They will ask for the code urgently because it is only valid for a few minutes. They will keep pestering the victim until the latter caves in and reveals it. Soon after, the victim receives an SMS from the bank saying that a sum of money has been transferred out of his account [without his consent],” says Marina.

Another common case witnessed by OFS is the scratch-and-win scam, which was rampant in 2018 and 2019 and usually happened in car parks at hypermarkets. “The scammers targeted unsuspecting senior citizens or ladies. They would come up to the victim pretending to be a staff member of the hypermarket. And they would tell the victim that he had won a car and gold bullion and ask for the receipt as proof that the receipt number was the winning number,” she says.

“Somehow, the victim would be taken in. The victims always tell us that they felt as though they were under a spell. The scammers would then offer to send the victim to register for the new car and along the way, they would make a detour to a goldsmith shop to collect the bullion.

“The goldsmith would then request for the victim’s credit card in order to claim the bullion. The merchant would swipe the card and the victim generally signed for the transaction and authorised the payment. The merchant would then come up with some sort of excuse to delay the delivery of the bullion and run away with the money.”

There are other types of scams that are hard to categorise, says Marina. OFS had a case where the victim travelled overseas and was kidnapped and locked up in a room. He was then asked to sign documents or authorise credit card payments under duress. The victim would be beaten up until the scammers had obtained all the signatures required. Then he would be forced to gulp down a drugged drink and pass out for several days.

While many institutions have gone to great lengths to educate the public on such scams, these are still widespread in Malaysia, says Marina. “People tend to be careless and quick to believe the people behind the scam phone calls, who tell them their bank account has been used for money laundering or they have been involved in a hit-and-run case. They need to be more doubtful.

“What they need to do is keep calm, put down the phone, and then verify the phone number and call to speak to the correct parties themselves. [Remember that] no bank or regulator will call for personal information.”

What OFS does

The Ombudsman for Financial Services (OFS) is an independent, non-profit organisation that serves as an alternative dispute resolution channel between financial consumers and its registered members, which are financial service providers licensed or approved by Bank Negara Malaysia.

OFS is also the sole operator of the Financial Ombudsman Scheme (FOS), approved by Bank Negara under the Financial Services Act 2013 and Islamic Financial Services Act 2013.

It mediates in disputes involving banking products and services amounting up to RM250,000. It also hears insurance and takaful claims of up to RM250,000, third-party motor insurance property damage claims and takaful claims of up to RM10,000, as well as unauthorised transactions of up to RM25,000 through the use of designated payment instruments or payment channels. Its services are provided free to its members’ customers.