# MA-1101.072024: MyCERT Alert - Overpayment Scam Targeting Individuals in Malaysia

**Date:** 19 Jul 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1101.072024  
**Advisory ID:** MA-1101.072024

---

**1.0 Introduction**
Recently, Cyber999 Incident Response Centre of CyberSecurity Malaysia received information that cybercriminals are sending fraudulent emails claiming victims have overpaid the Malaysian government (MyGOV) due to a system error. The email prompts victims to click a link to return the excess payment. This link redirects them to a fake website, where they are asked to enter their credit card details. After entering an OTP code, victims see an error message and are asked to enter another OTP code. This cycle continues as scammers collect multiple OTPs to make unauthorised charges to victims' credit cards.
**2.0 Impact**
- Financial loss and disclosure of banking information to third parties or attackers.
**3.0 
Below are references to similar incidents:
- MA-975.102023: MyCERT Alert - MyBayar PDRM Phishing Website
- MA-843.072022: MyCERT Alert - Security Best Practices on Safe Online Transaction and Safeguarding Banking Information
- MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
Figure 1: Sample of the fraudulent email
Figure 2: Sample of the fraudulent website
Figure 3: Sample of the an error notice 
**4.0 Recommendation**
Below are guidelines and best practices for protection against successful infection:
- Do not panic.
- Do not click on adware or suspicious URLs sent through SMS, email, or any messaging services.
- Delete the scam email and mark it as spam so that your email filter removes it.
- Use different password variations for each online account and adhere to best password management practices. This step should protect you in the future because no other account should be affected if one account is breached.
- Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
- Quickly file a police report if they encounter or fall victim to such scams.
- If you suspect unauthorised bank transactions in your account, immediately report to your bank by calling the bank's hotline, which normally operates 24x7.
- You can also call the Malaysian National Scam Response Centre (NSRC) hotline at 997 within 24 hours or as soon as possible. The hotline number operates daily including on public holidays, between 8 am and 8 pm.
- The public can also contact the Royal Malaysia Police (PDRM) via the CCID Infoline at 013-211 1222 or the CCID Scam Response Centre at 03-2610 1559 or 03-2610 1599.
- Do not respond or send any payments to the scammer.
Generally, CyberSecurity Malaysia advises the users and administrators to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. 
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels: 
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection#8be6f2e8eef9ffcbe6f2e8eef9ffa5e4f9eca5e6f2)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 08:30 AM - 17:30 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.linkedin.com/posts/ts-alan-yau-ti-dun-1aa53874_the-latest-scam-targeting-individuals-in-ugcPost-7218071179503259650-zr7j/?utm_source=share&utm_medium=member_ios>
- [https://www.facebook.com/photo?fbid=122102492402410710&set=pcb.122102492882410710](https://www.bitdefender.com/blog/hotforsecurity/attackers-try-to-deploy-remcos-malware-with-covid-19-