Scams and Phishing Aimed at Students & Families

Scammers invent new costumes for old tricks. The core pattern rarely changes: create urgency, borrow trust (a school logo, a famous brand, a friend’s name), and push you to click, pay, or share codes before you think. Malaysian students and parents encounter these messages on WhatsApp, SMS, Telegram, Instagram DMs, and fake shopping sites that look almost right.

Patterns students see often

• Fake giveaways that need a “registration fee” or banking OTP
• Messages claiming a game or social account will be deleted unless you log in on a suspicious page
• Shopping deals that look far below market price on unofficial sites
• “Your friend” messaging from a new account after a purported hack
• Job or internship offers that ask for fees upfront

None of these require you to “act in the next ten minutes.” That clock is manufactured.

Scenario: the RM1 “lucky draw” link

A classmate forwards a link: pay a small fee to claim a phone. Real promotions do not ask for your banking OTP to “verify identity.” Close the tab. Tell the friend privately the link looks risky so they do not lose face in the group.

Scenario: the hacked friend account

A familiar name asks for emergency e-wallet transfer or gift-card codes. The grammar is off, or they refuse a voice call. Call the friend on a number you already have. If they truly need help, they will answer.

Parent-facing twists

Adults get romance, investment, parcel delivery, and government-looking SMS scams. Students may be the first to spot odd grammar or strange links on a parent’s phone — treat that curiosity as helpful, not cheeky.

Common family scams in Malaysia

• Courier SMS asking you to click to “reschedule” a parcel you never ordered
• Investment groups promising guaranteed returns in Telegram
• Calls claiming to be from banks or “court officers” demanding immediate payment
• Messages pretending to be LHDN, police, or utilities with threatening language

Teens can practice a calm script: “Mum, this looks like the phishing example from school — can we check the official site together?”

A short pause that saves money

When a message creates panic:

1. Leave the chat thread. Open the official app or website yourself by searching, not by tapping the message link.
2. Call the person using a known number if the message claims to be them.
3. Talk through the request with a second adult when money or IC details are involved.
4. Remember schools and platforms rarely demand instant secret payments through personal chats.

The five-minute family rule

If anyone asks for money, passwords, or OTPs, wait five minutes and tell another household member. Scammers hate waiting. Legitimate services usually allow time.

Phishing clues

• Slightly wrong domains and strange spellings
• Generic greetings plus urgent threats
• Attachments you did not expect
• Forms asking for full IC, passwords, and OTPs on one page

Domain spot-check habit

Look at the full web address. shopee-security-alert.biz is not the same as the official marketplace you already use. On mobile, press and hold a link to preview the URL before opening.

OTP rules everyone should know

Banks and e-wallets send OTPs to confirm you initiated a payment. If someone else asks you to read an OTP aloud — friend, “customer service,” or “admin” — stop. That code is a key to your money.

Shopping and game scams

Low prices on unknown sites often mean counterfeit goods or nothing shipped at all. Stick to platforms your family already trusts, or pay through methods with buyer protection. For in-game currency, use official store routes inside the app, not random resellers in comments.

Students chasing side income should be wary of “easy job” posts that require buying stock first or paying “training fees.” Real employers do not ask for your TnG PIN to “activate your account.”

Social engineering in school chats

Scammers sometimes pose as alumni offering tuition or laptop deals. They may join public school Facebook groups and DM students. Verify through official school channels or known teachers before paying deposits.

If something already went wrong

Contact the bank or e-wallet provider quickly for unauthorised transactions. Change passwords on important accounts. Tell a trusted adult. Platform report tools matter, but financial recovery starts with the provider.

First-hour checklist after a loss

• Freeze cards or e-wallet if the app allows
• Screenshot fraudulent messages and transaction IDs
• Report to the bank and police as your family decides
• Warn the class group if a scam link is still circulating — calmly, without shaming the person who clicked first

Shame keeps people silent; silence lets scams spread.

Building household habits

• Keep bank hotlines saved in contacts, not only in bookmarks
• Agree that anyone can yell “pause” in the kitchen when an OTP is requested
• Review privacy settings together using Privacy and passwords
• Practise slow thinking from Be Smart when viral warnings appear

Scam resilience is digital citizenship in action. You do not need to be paranoid — you need to be willing to double-check before you click, pay, or share.