Close to RM 20k scammed from 20 teachers’ TnG E-Wallet accounts

On 12-February-2022, teachers and staff from different schools reported that their Touch ‘n Go (TnG) E-Wallets have been hacked. Close to RM 20,000 was stolen from them collectively.

According to a Sin Chew Daily report, the DAP Public Complaints Bureau received multiple reports from teachers alleging that their e-wallets were hacked into during Chinese New Year and large sums of money were stolen through auto-reloads.

The teachers were from eight different schools in the Klang Valley. About 20 teachers from each school were affected.

It is believed that the hacker reloaded the e-wallets multiple times within a short time before transferring the money out of the account. The money was traced to two gaming companies.

Other than the e-wallet balance, the money that teachers placed in the TnG Go+ was also stolen.

DAP Public Complaints Bureau Chief, Yew Jia Haur, accompanied by five of the victims, held a press conference highlighting the issue and requesting the authorities to address the problem.

The victims revealed that most of the cases were linked to credit or debit cards for automatic reload, the teachers’ IC numbers, and birthdays. This is because these teachers used their IC numbers and birthdays as passwords for their accounts.

They told the press that despite changing their passwords and removing the auto-reload function, the hackers kept trying to crack the new passwords.

Unfortunately for these teachers due to multiple failed attempts to log in, they have been temporarily frozen out of their accounts.

Two victims, Mr Zhong and Miss Chai had their e-wallets hacked at 3 am. Mr Zhong only later found out when in the process of removing his linked credit card that close to RM 1,000 had already been transferred out of his account.

Mr Zhong is not the only person in his school that had his account hacked, he told the press that several teachers had also fallen victim to the hacking scheme.

He also suspects that the school’s privacy was also hacked as there were also attempts to log in to the teachers’ personal emails.

Miss Chai told the press that she checked her e-wallet immediately at 6 am and found out that money had been transferred out of her account. She also revealed that couldn’t stop the hackers from reloading the account so she tried to call TnG but received no answer.

According to Sin Chew’s report, Miss Chai was unable to stop the top-up as everything happened very fast. Each top-up was RM 300 and the money in her account is immediately transferred to another account straight away.

By the end of it, she had a total of RM 2,000 stolen from her account. She told the press that as the PIN used was correct, the transaction was considered valid so the transfers are non-refundable.

Other than the massive loophole in the system, Miss Chai highlighted the importance of a 24-hour customer service hotline. As there wasn’t a 24-hour service, she was unable to report the theft until later when the service hotline started work at 7 am.

Yew further urged other victims to come forward and make police reports. Other than that, he also reminded the public not to use their IC numbers or date of birth as their e-wallet’s six-digit pin.

The bureau will continue following up on the matter, including assisting with collecting the victim’s report and forwarding it to Bukit Aman and the Malaysian Communication and Multimedia Commission (MCMC).

Other than that, he also urged the relevant government departments to conduct a review to check whether there has been a data leak. As e-wallets are regulated by Bank Negara, the bureau will also send a report to the national bank.