KUALA LUMPUR, Oct 27 — Since September 2024, all telcos have been required by the Malaysian Communications and Multimedia Commission (MCMC) to block messages containing URLs and any clickable links.
However, many Malaysians are still receiving scam SMS messages impersonating government agencies, banks and even courier companies. So the question is, how is this still possible if the telcos are already blocking such messages?
One of the key sources is Fake Base Transceiver Station (Fake BTS) which impersonates legit mobile towers of telcos. These Fake BTS are operated by syndicates and they are constantly on the move.
When you’re connected to one of these Fake BTS, your phone’s network connection tends to drop to E or G temporarily with no data connection. If you’re in a middle of a call, your voice conversation may get disconnected abruptly as your device switches to the Fake BTS.
These Fake BTS units spoof your network ID (e.g. CelcomDigi, Maxis, U Mobile) to trick your device into switching to them. Once connected momentarily, it will quickly push the fake SMS to your phone. It happens so quickly that most users don’t even realise it.
Fake SMS messages appear to come from legitimate sender IDs, tricking users into clicking links that steal banking credentials.
As shown above, these scammers were able to spoof the sender ID, tricking victims into thinking that it was sent from legitimate 5-digit short codes or sender ID such as 15454, MAXIS, GOV, etc. This is where scammers take the opportunity to phish for personal information from victims, including logins, passwords, and verification codes.
These fake messages are transmitted outside your telco’s real network, but to the user, they appear as genuine SMS in the inbox.
Because Fake BTS operate independently of legitimate mobile networks, scammers can still deliver messages with links that bypass the SMS filtering rules enforced by telcos.
Last month, the MCMC and Royal Malaysian Police (PDRM) have managed to take down a scam SMS syndicate under operation “Op Pancing”. As shown in the video, they arrested an individual operating an active Fake BTS inside his vehicle that’s parked around the busy KLCC area.
Based on MCMC’s frequency scan, they have confirmed that the equipment was used to blast out SMS promoting online gambling sites to users around the area. When they asked the individual, he revealed that the Fake BTS is capable of sending about 10,000 SMS daily.
Following the arrest, MCMC and PDRM have also raided a home in Kota Kemuning Shah Alam which stored various Fake BTS equipment and an MPV believed to be used for the operations.
A new breed of mobile towers — fake, portable, and run by syndicates — is hijacking phone signals to push phishing texts that bypass network filters entirely. — SoyaCincau pic
According to MCMC’s statement, they have confiscated 45 equipment with an estimated value of RM100,000. The case was investigated under the Section 239(1)(a) of the Communications and Multimedia Act 1998. Violators can be slapped with a maximum fine of RM1,000,000 or face imprisonment up to 10 years, or both.
The case was also investigated under Regulation 34(5)(c) of the Communications and Multimedia (Spectrum) Regulations 2000 which carries a penalty of RM300,000 and jail time of up to three years, or both.
Of course, phishing scams come in different shapes and form. Besides SMS, scammers have also turned to internet-based messaging platforms such as iMessage and even WhatsApp.
While scam awareness is on the rise among Malaysians, we still need to stay vigilant and remain sceptical of the messages we receive on our phones. As a reminder, Banks are forbidden from sending SMS OTPs and links. Besides avoiding clicking on links sent via messages, all users should only login through official apps downloaded via official stores (Google Play Store, Apple App Store and Huawei Gallery), or from the website.
If you do fall victim or believe you’ve been scammed, contact the National Scam Response Centre (NSRC) immediately at 997. The faster you report it, the higher your chances of recovering your lost funds. — SoyaCincau
