Macau Scam

By | Mohamad Hafiz bin Rahman, Muhammad Fadzlan bin Zainal, Hafizah binti Che Hasan, Zainurrasyid bin Abdullah & Abdul Wafi bin Abdul Rahman

Introduction

A scam can be described as a fraudulent scheme carried out by a dishonest person, group, or business in an effort to obtain cash or other valuables. Scams traditionally work by tricks on trust, whereby a person pretends to be a skilled or authoritative individual. In a digital era, a new form of scam has appeared that is now a common Internet issue. The Macau Scam is a sort of financial scam affecting Malaysia. It involves telephone calls from individuals disguising themselves as officers from the Royal Malaysian Police (PDRM), Bank Negara Malaysia (BNM), the Malaysian Anti-Corruption Commission (SPRM), or other agencies. A syndicate contacts victims and makes up stories about the victims having been involved in cases such as money laundering, theft or credit card fraud. They will then ask the victims to transfer money into the syndicate’s bank account to resolve the case or problem.

Macau Scam

Taiwanese and Chinese syndicates run the Macau Scam using Hong Kong international and local calls as well as local Malaysian bank accounts to collect money from the victims’ accounts. 

Before being sent overseas through money changer services, the money is converted into cash. This technique known as Voice Phishing involves communication using the Voice over Internet Protocol (VoIP) that allows callers to place any phone number to trick victims (Figure 1).

Cases of online fraud are rampant, making up nearly 72% of complaints reported to the Malaysian Computer Emergency Response Team (MyCERT) so far this year. Of the 5,507 complaints of computer security incidents received by the government agency from January 2019 to July 2019, 3,973 (72.14%) were related to online fraud ranging from the Macau Scam to illegal investments. Net losses from cybercrime or online fraud in Malaysia have reached RM309.67 million for the period between January and July this year. 

According to 2018 statistics released by the Commercial Crime Investigation Department (JSJK), the Royal Malaysian Police (PDRM), total losses from the Macau Scam increased 55.5% nationwide compared to 2017. This increase involved losses of more than RM224.6 million in 4,965 cases recorded compared to the previous year with RM99.9 million in 4,178 cases due to the Macau Scam. Figure 1 shows the Macau Scam modus operandi.

IP-PBX is a private branch exchange (in-house telephone switching system) that switches calls between VoIP users on local lines while allowing all users to share a certain number of external phone lines. The typical IP-PBX can switch calls in the same manner as a standard PBX between a VoIP user and a traditional telephone user or between two traditional telephone users.

The scammer hacks an IP-PBX and uses the services of that IP-PBX to make free international calls. Scammers usually have their VoIP service in some other country. The call moves through the compromised PBX when a subscriber to the fraudulent service makes a call to an international location. The actual owner of the PBX server cannot bill the subscriber of the fraudulent service, but the fraudster can collect payment from the customers for services provided through stolen resources. A prevalent form of communication between a PBX and a VoIP provider is the Session Initiation Protocol (SIP). A SIP trunk is a direct connection between an organization and telephony service provider (ITSP). It enables the extension of VoIP telephony beyond the firewall without the need for an IP-PSTN gateway. SIP trunking also does away with PRIs (Primary Rate Interfaces), PSTN gateways and BRIs (Basic Rate Interfaces), which results in cost reduction. Scammers can use this service legally. 

Types Of Macau Scam Tricks

There are various types of Macau Scam, such as bank loan fraud, credit card fraud, kidnapping and ransom, the release of prisoners, PDRM suit and court, lucky draw gifts, travel packages and many more. Figure 3 shows the Macau Scam tactic and who the targets are.

Several forms of Macau scam have been reported to Cyber999 (MyCERT):

1. Credit Card Trick
   
   Modus operandi: A con artist contacts a victim by impersonating a bank officer and states that the victim's name and details have been used to create a credit card registered on behalf of the victim. The victim, who denies the matter, is informed by the suspect to resolve the matter by being connected to the phone line of Bank Negara. The victim then contacts the second suspect who serves as a National Bank officer and orders a money transfer to the account provided for security purposes. The suspect also promises to return the money within seven days after the investigation is complete before it disappears.
   
   What you should do:
   
   
   • Do not ever give your card or bank details.
   • Check your payment receipt every time and make sure the transaction is correct.
   • Get the card cancelled if misplaced in any case.
   • Be careful while making significant transactions.
   • Be careful when responding to special online offers.
   • Try not to write the PIN anywhere and memorize it well.
   • Make a police report immediately.
     
     
2. Police Officer/Bank Officer/Authority Officer Trick
   
   Modus operandi: The con artist disguises as a police, bank or other authority officer to deceive a victim by contacting and threatening the victim by phone. They will notify that the victim has committed a criminal act, such as a hit-and-run, giving or receiving bribes, money laundering, etc. The con artist will also offer a fee to close the case if the victim does not wish to be prosecuted. Victims who are deceived by this trick will make a transaction to a given account.
   
   What you should do:
   • Get the card cancelled if misplaced in any case.
   • Do not disclose your bank account number, ATM card or credit card number to an unidentified individual.
   • Do not call back the number that you have been given. Instead, call the official number of the company, organization, or institution involved for further clarification.
   • Do not make a deal over the phone.
   • If the call is from an authority officer, please make an appointment or directly walk into the police station, bank or authority office for further clarification.
   • Make a police report immediately.
     
     
3. Lottery and Lucky Draw Trick
   
   Modus operandi: Victims receive notifications of winning a lottery or lucky draw via phone call or SMS. They are asked to make upfront payments to claim the winnings. In some cases, victims are told they have won a valuable asset such as a car or a condominium overseas. They are told they could convert the valuable assets into cash, but they would first have to make a payment, usually to a foreign bank account.
   
   What you should do:
   • To claim any cash prize, do not make any advance payment. Winning a lucky draw or lottery should not require advance payments or fees.
   • Ignore such notifications, especially when you did not participate in any lottery or lucky draw.
   • Do not supply your personal information.
   • Make a police report immediately.
     
     
4. Impersonating kidnappers
   
   Modus Operandi: A victim receives a phone call from someone claiming the victim's child or a family member had been kidnapped. The victim is told to urgently pay the requested ransom amount stated by the caller to a third-party bank account, although there was no abduction.
   
   What you should do:
   • Do not make any deal over the phone.
   • Drop the phone and immediately call the family member said to have been kidnapped to check.
   • Make a police report immediately.
     
     

Targeted Victims

Who are favourite Macau Scam targets and why? 

1. Seniors and retirees
   
   These people usually have more money and accumulated wealth than young people. They are also not up to date or aware of the latest scams, making them attractive targets for scammers.
   
   
2. Rich and wealthy people
   
   Because they have much money, wealthy people are among the favourites for Macau scammers. Scammers disguise as police, Bank Negara or other authority officers to trap victims. A con artist notifies the victim of having committed some crime and announces that their bank account has been suspended and will be frozen for an investigation. This ought to make the victims nervous and follow the instructions. Since these people know they have a lot of money in the bank and worry about losing it, some may readily follow all the instructions given by the scammer.
   
   
3. Easily distressed individuals
   
   Some people have an overthinking and distressed mindset. These kinds of people can easily panic, so imagine if a scammer claims the victim has committed a crime or a family member was kidnapped and requests a money transfer as soon as possible.

How to Prevent Being Scammed

A syndicate usually contacts victims with stories of how the individuals have been involved in cases such as money laundering, theft, credit card fraud, etc. The fraudsters then ask the victims to transfer money to a bank account to resolve the case or problem. 

Public awareness plays an important role in preventing falling victim to this scam. There are a few steps to consider if you receive a suspicious call:

1. Always be vigilant and do not be easily fooled by the tricks of certain parties;
2. Never panic or follow the instructions given by the caller without first contacting the police or financial institution concerned;
3. Do not call back the phone number from which you received the call. Instead, get the official phone number of the company, organization or institution for further verification;
4. Never disclose personal details or the details of any of your accounts to anyone for the purpose of verifying your identity;
5. If you believe it was a fake call, file a police report and provide a recording of the phone call or any notes you have recorded to facilitate police investigation, or report to Cyber999;
6. Visit BNM's official portal for the latest information and advice on financial fraud.

Report to Cyber999

If you have fallen victim to cybercrime, you can lodge a report with the Cyber999 Help Centre, a public service that provides emergency response to computer security-related emergencies. The report can be filed through an online form, e-mail, SMS, phone call, facsimile, the Cyber999 mobile app or by walking into CSM. The centre will make a report and conduct a technical investigation and analysis based on the incident reported. All cybercrime-related incidents can be reported by calling 1-300-88-2999 or the 24-hour emergency helpline (019-2665850), fax (03-80087000), SMS (15888) CYBER999 REPORT [e-mail, complaint], online form (https://www.mycert.org.my) or e-mail cyber999@cybersecurity.my.

Conclusion

In addition to the Macau Scam, many other financial scams are happening every day. The unaware public can be trapped by fraudsters who steal hard-earned money and wealth. Prevention is always better than detection, but both are difficult tasks because fraudsters are always coming up with new ideas for fraud whenever old methods get figured out by fraud detectors. Thus, it is also challenging for fraud detectors to identify new fraud patterns. So always be aware of the latest news on scam syndicates and pay attention to community service orders or alerts from your service providers.