Fraud Mode and How to Avoid it

Skimming

Attempt to steal your Customers personal data by illegally copying information contained at credit card or debit magnetic stripe.

What to do to avoid skimming:

• Make sure you already using Maybank ATM/Debit with chip technology.
• Prioritize using Maybank ATM. It is recommended to use ATM located in branch.
• When pressing PIN, please cover it with your hand and always be cautious with surrounding people or situation.
• Change your PIN periodically.
• Check your balance and activities regularly. If your found any transaction happened without you knowing, immediately report it to the Bank. Make sure Bank already had your updated personal data  such as phone number, because authorization code will be sent to your phone number.

Phishing

Attempt to steal through email and internet site sent to a lot of people with the purpose that Customer will give their personal data

What you can do to avoid it:

• Make sure you are login into or accessing information from official and reliable website. Ensure that the website is starts with https:// …. (notice the “S”) not http:// …. “S” was the sign that the website is protected by encrypted data.
  - Corporate Website Maybank : https://maybank.co.id
  - M2U ID Web (Internet Banking) : https://m2u.maybank.co.id
  - M2E untuk Nasabah Korporasi : https://m2e.maybank.co.id
• Install security software and keep updating the antivirus.
• Avoid online banking access using  public Wi-Fi.
• Never click a link or downloading attachment if you receive email containing prizes information. Before you click a link found on the email, point your cursor to the link and ensure that the link is sent by the actual sender.

SIM Swap

Attempt to access your banking transactions by duplicating or takeover your mobile phone SIM card illegally by someone irresponsible .

What you can do to avoid it:

• If your mobile phone suddenly stops working, no data, no text messages, no phone calls, immediately call your mobile service provider.
• Immediately call Bank representative and mobile service provider if you find SIM Swap indication.
• Do not publicize your mobile number or your email on social media. Use different mobile number or email address for banking purposes.
• Always check and read SMS or email notification sent by Bank.
• Do not click any untrusted link that your received from SMS or email.

Transfer to Virtual Account

Fraud Schemes Using Virtual Account

Modes of fraud are becoming more prevalent and diverse, one of them is through virtual account. Always be aware of various fraudulent attempts by transferring to a virtual account:

1. Claim to be a close relative or friend.
   Pretend to know and admit that you are having a disaster or a desperate situation, and need funds in a hurry.
2. Fake investment offer
   Offering a promising investments with fantastic profits and invite participants to transfer a certain amount of funds through virtual account.
3. Shopping in e-commerce or unknown online stores
   Shop through social media/ online store/ e-commerce and require payment outside the official payment method.
4. Fake lottery
   Be wary if there is a phone call or message, stating that you have received a lottery prize and are asked to transfer some funds and request banking data for some reason.

Caution! Scam Attempt with .APK & .PDF Files!

Fraudulent acts by sending Files or Links containing .apk & .pdf which are currently being distributed via WhatsApp application, under the guise of Wedding Invitation. Seminar,  Order from the Package Courier, Bill / Invoice, Etc.

Things to do when encountering such scam attempt:

1. Do not open / click / download any file received from a number you do not recognize
2. Do not reply / response to messages from a number you do not recognize or suspicious sources claiming to be from Maybank
3. Always keep your Personal Data Confidential, such as: ID No./Driving License/KITAS/Passport etc., Date of Birth, Biological Mother’s Maiden Name, Phone Number, Photo and other Personal Data from any party, including your:
   1. OTP/TAC
   2. CVC / CVV (3 digits on the back of the Card)
   3. User ID and Password
   4. ATM / Debit / Credit Card Number and PIN
   5. Secure2U PINs

Maybank never ask nor send files or links for customers to click on and never ask for personal/private/confidential customer data.

Fraud Attempts Employing Falsified Data/Information on Phone Numbers, ATM Locations, and Addresses via MAP Applications

Recently, there have been fraud attempts involving falsified data such as phone numbers, ATM locations, and even the Bank’s branch office addresses through map applications available on the Internet.

Here are some tips to avoid them:

1. Please ensure you obtain information regarding the location-based branch and phone number from Maybank's official website.
2. Should you require further information, you can contact Maybank Customer Care at 1500611 / +622178869811 (from abroad) or email customercare@maybank.co.id

Smishing

Fraudulent efforts aimed at stealing personal and banking data. The method used by the perpetrators is using a fake identity and claiming to be a bank employee, staff from a Financial Institution/Agency/Foundation, a close acquaintance, or someone we know. The perpetrator will then send an SMS informing you of one of the following:

• An unusual transaction on your credit card or account and asking you to cancel the transaction.
• An increase in administrative/transaction fees, and if you disagree with the fee increase, the perpetrator will ask you to provide personal and banking information, or
• Offering an unreasonable prize.

After sending the SMS, the perpetrator will then provide a link that directs you to a fake website resembling the official Maybank website and asks you to fill in personal and banking information on the fake website.

Here are some things you can do to avoid this:

1. Do not open/access suspicious links
   If you receive an SMS, email, or WhatsApp from a suspicious source, do not open/access the link because it carries the risk of personal data theft or malware infiltration into the device you are using.
2. Do not share your personal & banking data 
   The purpose of the scammer is to steal your confidential personal and banking data, such as card numbers, PIN, One-Time Password (OTP) codes, Transaction Authorization Code (TAC), card expiration date, CVV/CVC codes (for Credit and Debit Cards), and/or user ID, password, or Secure2u passcode used on your internet/mobile banking. Never provide your personal and banking information over the phone or by filling out personal and banking details on suspicious websites.
3. Confirm with the bank 
   Be cautious of phone calls, SMS, emails, or WhatsApp messages that seem suspicious and ask you to provide personal and banking information. If you experience this, immediately contact your bank using the bank’s official contact details and report what happened.

 Social Engineering

A fraudulent attempt using psychological manipulation techniques that exploit the victim’s unawareness to gain access to personal or banking information and other valuable “confidential” data.

Here are several steps you can take to avoid social engineering scams:

1. Always keep your personal or banking information confidential, such as One Time Password (OTP), Transaction Authorization Code (TAC), Secure2u Passcode, PIN, the 3-digit code on your card (CVV/CVC), User ID, and Password. Do not share this information with anyone, including individuals claiming to be from the Bank, regardless of the method or location.
2. Do not easily trust and stay alert when receiving calls from unknown numbers offering prizes/sweepstakes/transaction cancellations, especially if followed by a request for your personal and banking information.
3. Be cautious of emails and WhatsApp messages that contain suspicious links or app files.
4. Do not click on suspicious links.
5. Activate SMS and email notification features to inform you of deposit, withdrawal, or fund transfer transactions.
6. Regularly check your balance and change your PIN.
7. Use the official Maybank Indonesia mobile banking app, M2U ID App, which can be downloaded from the App Store (for iOS users) and Play Store (for Android users) under the search name ‘Maybank2u ID’.
8. Contact Maybank Customer Care at 1500611 or +622178869811 (from overseas), or email customercare@maybank.co.id to report any indications of social engineering you may have experienced.

Cyber Hygiene

Cyber hygiene is the practice of maintaining good habits to ensure the security of your devices, personal data, and banking information.

Risks of neglecting Cyber Hygiene:

• Devices become slow and crash frequently.
• Accounts become more vulnerable to hacking.
• Increased risk of phishing and malware attacks.

Tips for practicing Cyber Hygiene:

• Regularly update your devices and applications.
• Use strong passwords with a mix of numbers, letters, and symbols, ensure each account has a unique password, and change them periodically.
• Enable Two-Factor Authentication (2FA) for services like email, social media, and banking.
• Install trusted antivirus software and firewalls to protect your devices from cyberattacks.

Voice Phishing (Vishing)

Voice Phishing or Vishing is a type of scam carried out through phone calls. Scammers typically impersonate bank representatives, government agencies, or other trusted organizations to trick you into disclosing your personal and banking information.

Below are some steps you can take to protect yourself:

1. Never share your One-Time Password (OTP), PIN, Transaction Authorization Code (TAC), Secure2u passcode, CVV/CVC, User ID, or password with anyone, including individuals claiming to be bank officers.
2. Verify the caller’s identity through official communication channels.
3. End the call immediately if you feel pressured, threatened, or suspicious.
4. Report suspicious phone numbers to the relevant authorities or the official Customer service channels.

To help protect Customers from phone-related scams, such as voice phishing (vishing), M2U ID App has been equipped with Call Prevention feature.