Is there a new malware scam involving a PayNow PDF?!
Take a look at the viral claim, and find out what the facts really are!
Claim : WhatsApp Block Button Is A Scam!
People are sharing this warning about a new malware scam involving a PayNow PDF. Take a look!
I just received below the latest and new scams Modus Operandi from my Uncle. Forward to warn and share.
======================
The scammers have changed their modus operandi. They don’t ask you to download the app.
My neighbour told me yesterday that her sister (a cancer patient) wanted a part-time helper to clean her house. Hence, she went to Facebook. I called the number and made the request. The advertiser asked whether she had a Paynow, and she said that she had. He directed her to make the partial payment, and he will send the invoice to confirm. (Note: He did not ask her to download an app, as people are getting alerts). When she received the invoice in the PDF format, she did not suspect any foul play and clicked it. The invoice showed the amount paid and the balance to be paid. After that, she went to sleep. The next morning, her phone could not be switched on.
She used her laptop to check her DBS bank account. Her $20K was gone, and her two fixed deposits of $25K, which had not reached the maturity date, were also gone—the total loss was $ 70K.
When she went to the bank and asked why her fixed deposit was also gone, the receptionist told her that digital banking allows you to transfer the amount back to your account to facilitate withdrawals without going to the bank.
Police told her the malware was embedded in the PDF document.
So folks, beware that the scammers are always changing their modus operandi to con your money $$$! 😡😡😡
Recommended : WhatsApp Block Button Scam : What You Need To Know!
No Evidence There Is Any PayNow PDF Scam!
This is likely another example of FAKE NEWS circulating on WhatsApp and social media platforms, and here are reasons why…
Fact #1 : No Evidence Of PayNow PDF Scam
First, let me just point out that there is no evidence that anyone was ever scammed by a PayNow PDF invoice.
There has been no actual news report of such a case, never mind multiple cases involving malicious PayNow PDF documents.
Frankly, I don’t know of any PDF malware that can shut down a phone, and transfer money from a bank account, including liquidating fixed deposits!
Fact #2 : PDF Malware Generally Target Computers
PDF documents can contain malware, but malicious PDFs generally target Windows computers. In fact, many aren’t actual PDF documents, but are instead executable files masquerading as PDF files – invoice.pdf.exe, for example.
Malicious PDF documents or executables targeted at Windows computers won’t work on smartphones. The malicious PDF must not only be specifically designed to target smartphones, it must target the right operating system – iOS or Android. A malicious PDF targeting Android won’t work on an Apple iPhone, for instance.
On top of that, many PDF malware actually exploit vulnerabilities in a specific PDF reader – most commonly, the industry-standard Adobe Acrobat Reader. Most smartphones do not have Adobe Acrobat Reader installed, and instead rely on a variety of PDF readers like Samsung Note, OneDrive, Google Drive, Kindle, etc.
Embedded PDF malware that target vulnerabilities in the Adobe Acrobat Reader won’t work with other PDF readers. That’s probably why it’s rare to see PDF malware that target smartphones.
Recommended : Can StopNCII Remove All Nude / Deep Fake Photos?!
Fact #3 : PayNow Scams So Far Involve Phishing
Singapore reported 477 cases of PayNow scams in 2021, with 133 more cases in 2022. However, they were not due to PDF malware. Rather, their victims were deceived into giving scammers their digital banking credentials.
In other words, PayNow scams have so far involved phishing attacks, in which victims are tricked into logging into fake websites, or giving up their Internet banking login details by phone.
In one of these scams, victims received phone calls from people pretending to be bank employees. The callers would ask for the victims’ personal details, such as their Internet banking usernames and passwords, under the pretext that the bank needed them to verify transactions in their accounts.
Fact #4 : Singapore Police Warned About Android Malware
It seems likely that the viral warning is based on a misunderstanding of a Singapore Police Force warning about Android malware withdrawing money through PayNow.
Issued on 17 June 2023, the Singaporean police warned that scammers were tricking victims into installing an Android Package Kit (APK) file through WhatsApp and Facebook Messenger. Once installed, the malware allows the scammers to remotely access the victims’ devices, and steal their passwords.
The victims are then directed to fake websites that mimic banks like DBS to key in their banking credentials. The login information obtained through this phishing attack then allows the scammers to withdraw their victims’ money through PayNow.
To be clear – this PayNow scam does NOT involve any PDF. It requires the victim to install an APK file – to gain access of your 2FA (Two-Factor Authentication) device, and provide bank login information through a fake (phishing) website.
This allows the scammers to log into your bank account using the login info you provided, and authenticate all transfers using your mobile phone.
Recommended : Nurse Lost RM380K After Pressing Instagram ‘Like’ Button?!
Fact #5 : Here Are Some Common Cybersecurity Tips
Here are some simple cybersecurity tips to help you avoid getting scammed online:
- Never install APK files (for Android) from unknown or untrustworthy sources.
- Never sideload IPA files (for Apple iOS) from unknown or untrustworthy sources.
- Always check the entire filename, including its file extension:
– PDF documents should end with .pdf, and not .pdf.apk or .pdf.ipa or .pdf.exe.
– Word documents should end with .doc or .docx, and not .doc.apk or .doc.ipa or .doc.exe. - Never click on any link to go to any bank website. Always type in the link yourself into a web browser, or better still – use the official app issued by the bank.
- Never give your bank login details to any person, even if they claim to be a police officer, a bank officer, or even a cybersecurity expert!
- Never give your 2FA authentication code / TAC or OTP number to any person, even if they claim to be a police officer, a bank officer, or even a cybersecurity expert!
Please help us FIGHT FAKE NEWS by sharing this fact check article out, and please SUPPORT our work!
Please Support My Work!
Name : Adrian Wong
Bank Transfer : CIMB 7064555917 (Swift Code : CIBBMYKL)
Credit Card / Paypal : https://paypal.me/techarp
Dr. Adrian Wong has been writing about tech and science since 1997, even publishing a book with Prentice Hall called Breaking Through The BIOS Barrier (ISBN 978-0131455368) while in medical school.
He continues to devote countless hours every day writing about tech, medicine and science, in his pursuit of facts in a post-truth world.
Recommended Reading
- WhatsApp Block Button Scam : What You Need To Know!
- Can StopNCII Remove All Nude / Deep Fake Photos?!
- Nurse Lost RM380K After Pressing Instagram ‘Like’ Button?!
- Can Israel Seismic Wave Card Hack Your Phone?!
- Fact Check : New WhatsApp Cyber Crime Rules?!
Go Back To > Fact Check | Cybersecurity | Tech ARP
Support Tech ARP!
Please support us by visiting our sponsors, participating in the Tech ARP Forums, or donating to our fund. Thank you!
