# MA-975.102023: MyCERT Alert - MyBayar PDRM Phishing Website

**Date:** 15 Oct 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-975.102023  
**Advisory ID:** MA-975.102023

---

**1.0 Introduction**
MyCERT observed lately that cybercriminals are sending phishing emails impersonating My Bayar Polis Diraja Malaysia (PDRM) – a PDRM traffic summon website. After clicking on the link, users will be redirected to a fraudulent website that mimics the legitimate MyBayar login page, intending to steal money from users' accounts without their knowledge.
Figure 1: Sample of the phishing email impersonating PDRM.
After users click on the link “*TO PAY MY FINES*”, it will redirect to the fake website of My Bayar PDRM. The website looks identical to the actual My Bayar website but with a unique Uniform Resource Locator (URL), which is ‘’https://policefine.ipfsoftwares.com/steps/index.php’’. The actual URL from My Bayar PDRM is ‘’https://mybayar.rmp.gov.my/en’’.
Figure 2: Screenshot of fake My Bayar PDRM website.
Users must fill in their vehicle plate number on the fake My Bayar PDRM website to search for fines. The search result will show a fine with the date and amount of fine users need to pay within seven days, and additional costs will incur if users exceed the dateline. The fine is only RM50, which is quite low for a standard fine in Malaysia.
Figure 3: The details of the fine with the date and amount that needs to be paid by users.
Figure 4: Fake payment page requires a user to input sensitive card details.
The riskiest part of this scam is when the users need to use a bank card to pay for the fine. Once a bank card is used to pay the fine, the scammer starts to harvest bank card data that consists of card number, expiry date and card verification value (CVV).
The scammer's goal in this syndicate is not to obtain money from users when they pay the fine, which is RM50, but the bank card details. Scammers could manipulate the harvested from the bank cards and make more money with that information.
**2.0 Impact**
Financial loss and disclosure of banking information to third parties or attackers.
**3.0 
Below are references to similar incidents:
- [MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
- [MA-843.072022: MyCERT Alert - Security Best Practices on Safe Online Transaction and Safeguarding Banking Information](https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=e68d78b0-c2fd-475c-bcd9-7c82cad079ca)
**4.0 Recommendations**
The malicious email is meant to retrieve banking credentials and other information from victims which could be used for other malicious purposes.  MyCERT highly recommends the following:
- Do not panic.
- Do not respond or send any payments to the scammer.
- Do not click on adware or suspicious URLs sent through SMS, email, or any messaging services.
- Delete the scam email and mark it as spam so that your email filter removes it.
- Use different password variations for each online account and adhere to best password management practices. This step should protect you in the future because no other account should be affected if one account is breached.
- Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
- Quickly file a police report if they encounter or fall victim to such scams.
- If you suspect unauthorised bank transactions in your account, immediately report to your bank by calling the bank's hotline, which normally operates 24x7.
- You can also call the Malaysian National Scam Response Centre (NSRC) hotline at 997 within 24 hours or as soon as possible. The hotline number operates daily including on public holidays, between 8 am and 8 pm.
- The public can also contact the Royal Malaysia Police (PDRM) via the CCID Infoline at 013-211 1222 or the CCID Scam Response Centre at 03-2610 1559 or 03-2610 1599.
- Contact relevant authorities such as Cyber999 for any inquiries and assistance 
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, don't hesitate to get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://mybayar.rmp.gov.my/en>
2. <https://play.google.com/store/apps/details?id=com.pdrm.mybayarsamanpdrm>
3. <https://apps.apple.com/my/app/mybayar-saman/id1552671016>
4. <https://appgallery.huawei.com/#/app/C104046205>
5. <https://www.facebook.com/CyberCrimeAlertRMP/posts/pfbid0gM2xKwUBHPGyLYMak8wNpejD3U9iPynHYUQR5GZcDuoBcrRLXeeTLc9cC3eWVP7Wl>