# MA-542.122015: MyCERT Alert - Winning Coupon Scam

**Date:** 09 Dec 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-542.122015  
**Advisory ID:** MA-542.122015

---

#### **1.0 Introduction**
MyCERT has been receiving several incidents from foreign Internet users who are receiving a winning scratch ticket via postal mails. The mails are posted from Malaysia that comes with fake winning tickets and fake attractive travel brochures of holiday destinations in Malaysia with malicious purpose to cheat victims.
The scam works by luring the victim into believing that they have won a huge amount of money and in order to claim the prize, the victims are asked to pay some amount of tax.
The inexperienced and untrained victim on security awareness may believe the fake winning ticket and proceeds to make payment to the fraudster account without realizing it is actually a scam. This results in huge loss of money to the victim as the money has been transferred to fraudster account.
**2.0 Impact**
- Huge loss of money to victims
- Identity theft as confidential details of victim is stolen and used for other malicious activities
**3.0 Modus Operandi**
1. Fraudster sends fake winning ticket and travel brochures to the victim by post letter from Malaysia.
2. Victim receives the postal mail, opens it and finds a fake travel brochure and a fake scratch ticket/coupon. Victim scratches the ticket and deceives by the fake winning scratch coupon (e.g. $170000). Refer Figure 1 and 2 below.
3. After that, victim calls a Malaysian telephone number in the brochure. The fraudster confirms about the prize and asks the victim for some ‘tax’ payment to be transferred first in order to get the huge money prize. An email address and a website URL is also attached in the postal mail.
4. Victim transfer ‘tax’ payment to the fraudster account without knowing that it is a fake account and later realized that he or she has been cheated.
Figure 1: Fake travel brochure.
Figure 2: Fake winning coupon.
**4.0 Recommendations**
- Be wary of suspicious postal mails or emails from known or unknown persons.
- Be wary about any winning tickets, scratchies and fake brochures.
- Get more information regarding the winning scratchies on the Internet such as at discussions groups, mailing list or discussion forums.
- Be extra cautious when involving transfering a sum of money to unknown entity.
- Foreigners are advised to check at the Malaysia Embassy or with Malaysia Tourism Office in their country if such winning coupons are genuine or fake.
> Malaysia Toursim website:
> <http://www.tourism.gov.my/en/my>
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#c2a1bba0a7b0fbfbfb82a1bba0a7b0b1a7a1b7b0abb6bbecafbb) or [[email protected]](/cdn-cgi/l/email-protection#f19c8892948385b19c8892948385df9e8396df9c88) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <http://www.scamcallfighters.com/Malaysian-Travel-Brochure-Scratch---Win-Lottery-Scam-hits-Australia---New-Zealand-blog-62.html>