About this scam
As this is not a commonly known scam, I’ll give a brief explanation. Order-snatching or order-grabbing scams originate from China and is a well-known tactic among the Chinese-speaking community. In Chinese, it’s called 兼职刷单诈骗 (刷单, 连单, 抢单).
The scam usually runs through the use of a web app to grab “orders”, which involves simple actions like clicking a button or spinning a wheel of fortune. There’s multiple variations of it, but for this group, you would get a random “order” of a price range pre-determined by the operators of the backend at their admin dashboard, and you would have to pay to buy that “order”, in return for a percentage of commission. After buying 30 “orders”, you would be able to withdraw all the money you’ve invested plus the commission.
The scam comes when the scammer operating the backend purposely manipulate a victim’s account to show up increasingly higher priced orders every time, preventing them from being able to finish up 30 orders, until they squeezed every last drop from the victim, before the victim gives up voluntarily. They can now blame the victim for not finishing 30 orders as planned, and it’s the reason the victim couldn’t withdraw, and not that they are keeping the money on purpose. This scam has an insanely high success rate through the psychological manipulation of sunk cost fallacy, with the promise that all deposits by the victim can be withdrawn as long as they deposit more money.
Basically, the flow starts off with victims finding “job advertisements” that talks about a way to earn beermoney by working from home online and asks that you WhatsApp a number, who is the “agent”. The “agent” would take you through how to grab “orders” on the app via a newly created demo account, which the account’s money is “deposited” by the scammer. A commission from the demo account would then be brought over to your actual account, and you’d have to start doing on your own account. However, they would purposely set an order with a higher price than what you got commissioned with.
Stage 1 summarized flow chart
Stage 2 summarized flow chart
Here is a sample conversation of the entire scam that was provided to me by one of the victims.
Operation details
Unlike scam call centres, this is an actual criminal group employing a plethora of techniques to evade the chances of being found out, caught, or have their identity leaked. - They distinctly separate their work devices and personal devices. All work devices are told to be treated as “unclean” by the superiors and thus should not be used to send any sensitive details or perform any personal tasks, and they’ve abided to this rule surprisingly well.
- There appears to be a constant pattern of most if not all members using variants of iPhone X as their personal device, but it may be a coincidence.
- They would make sure to tape the front cameras of both their phones and laptops. The back camera of phones are not taped possibly to allow for logging into their scam WhatsApp and Telegram accounts via QR code scanning easily.
- It is known that E group and F group moves their operation centre every fixed period of a little over a week, by booking a different Airbnb unit before the end of every stay. They have tried going for an approach of booking 10 days and staying 7 days for a while, but they seem to have dropped this approach and no longer booking extra days.
- They would always use their phone’s mobile network, even for their laptops, by enabling mobile hotspots or via USB tethering. They would never connect to an Airbnb’s provided Wi-Fi, no matter how terrible their mobile connection gets.
- They switch domains and phone numbers every now and then, especially if it got publicised or blacklisted.
Here are also some techniques they’ve employed to ensure that they are milking a victim as much as possible.
- If a victim is depositing a large amount (more than RM10k), they’re asked to split up the deposit into separate transactions.
- If a victim hits their bank’s transfer limit, they’re asked to transfer via DuitNow to bypass the limit or to go to a nearby ATM.
- The victim is always asked to use Instant Transfer instead of Interbank GIRO, because they know the transaction cannot be reversed.
- They have a lot of money mule accounts on hand, and switch immediately when needed. If a victim failed to perform the transaction because the money mule account is flagged, the scammers would also ask for a screenshot of the banking app showing the error to know which bank flagged it, and would direct only the victims who are users of the specific bank to deposit into a different money mule account.
- They would constantly give false hope to the victim that they’d be able to withdraw the money once they’re done, and pushes them to borrow from their friends and family, and even loan sharks.
- They’d use fake profile pictures downloaded from random Facebook profiles for their WhatsApp account, and they’d explicitly choose selfie photos from mothers with their toddlers to look more credible. Throughout conversation with victims, they’d also pretend to have a family, with lines such as “my husband won’t borrow money to strangers” and “I have to take care of my baby”, among others. Note that all the scammers in this syndicate are Chinese adult male, with some capable of speaking Cantonese.
- They have legitimately no sympathy. A victim who got scammed out of his livelihood, depressed, and expressed her wants to suicide once warranted her a reply asking her to go ahead and “jump her way into tomorrow’s newspaper front page”.
Thus far, I am only aware about four active teams in this scam syndicate, namely E group, F group, V group, and S group. Each team handles a different scam website, but what they do is almost entirely the same, and share the same superiors, tactics, and documentation. The members of each group are usually together physically. For communication with their superiors, with another group, or just sending files between team members, they use Telegram. The members has a callsign of their group letter and a number, and it is also not fixed. A callsign may be assigned to another member for any reason, so any reference of callsigns below may not refer to the current callsign owner, but instead the ex-owners. The first member of every group (E1, F1, V1, S1) are the leaders of the group and handles the “customer support” WhatsApp account for the website. Their salary appears to be settled every week, and the leader also gets extra commission for handling the customer support chat.
Team details
E group
- Established at 27 October 2021.
- Currently active members: E1, E2, E3, E4, E5, E6
- E5 and E6 are newbies, joined the team on 3 Jan.
- E1 is likely planning to go to back to Sarawak, likely on 30 Jan.
- E2 appears to have been separated from the team since 28 Dec and worked from a double-storey terrace house, which may be his home. It is located at Jalan USJ 11/3a, USJ 11, Subang Jaya (I’ll not be releasing the house number as the location may be off by one or two houses, and I’d not like to see any mistargeted physical harassments).
- E4 has the highest English proficiency in the group, even though it’s still bad overall.
- E5’s real name may be Shawn.
- Team members use vivo Y20 2021 (V2043) as their work/burner phones.
- The team experimented with different target audience and approaches over the months.
- 27 Oct - 4 Nov: Tried targeting UK people while posing as “Amazon Customer Service”. Website-less approach, where every victim will only be added into a WhatsApp group, follow orders, submit required screenshots, and then privately message your “agent” to perform a deposit to “purchase” an item in order to get your commission. There was nearly no traffic at all.
- 5 Nov - 21 Nov: Targetted Australians via Facebook ads, posing as software companies. Not lucrative enough in their opinion, and decided to revert back to their original target audience.
- 22 Nov - Present: Targetting Malaysians and Singaporeans via Facebook group spams.
- Domains
- 5 Nov - 11 Nov: shopboostrworldwide.com
- 12 Nov - 6 Dec: e-merchantstimulatorworldwide.com
- 7 Dec - 19 Dec: reallyhappyhour.com
- 20 Dec - Present: eshopnurturer.com
- Past operating locations
- The dates are not accurate and should only be used as a reference, as I’m not querying the location every day.
- 27 Oct - 31 Oct: Springville Residence, Taman Equine (Block B) [Possible Airbnb listing]
- 31 Oct - 9 Nov: The Havre, Bukit Jalil (Block A)
- 9 Nov - 21 Nov: The Cruise Residence, Bandar Puteri Puchong
- 21 Nov - 28 Nov: Kiara Residence 2, Bukit Jalil
- 28 Nov - 9 Dec: Zen Residence, Bandar Puchong Utama [Airbnb listing]
- 9 Dec - 20 Dec: Maisson Residence, Ara Damansara (Block 1) [Airbnb listing]
- 20 Dec - 30 Dec: Le Pavillion / Pavillion Residence, Puchong (Block B) [Airbnb listing]
- 29 Dec - 11 Jan: The Park Sky Residence, Bukit Jalil [Airbnb listing?]
- 11 Jan - Present: Skypod Residence, Puchong
- Airbnb booking screenshots
- Bank accounts (for salary, food, Airbnb etc. - may also be mule accounts)
| User | Name | Bank | Account number |
|---|---|---|---|
| E1 | Elliot Jee Chiang Foong | Hong Leong Bank | 11750070808 |
| E1 | Elton Jee Chiang Sheng | CIMB Bank | 7053451849 |
| E2 | Sean Heng Keeng Hee | Maybank | 162786136877 |
| E4 | Chua Chi Ling | CIMB Bank | 7041940802 |
| E4 | Chua Chi Ling | Hong Leong Bank | 37350130795 |
| E4 | Teh Poh Geok | Maybank | 151520092328 |
-
Salary of E group (28/12/2021)
-
Active phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 10-269 6216 | Used by E1 for WhatsApp. | https://wa.link/o2onmi, https://wa.link/hzocmw, https://wa.link/umcrkc, https://wa.link/2e4zcz, https://wa.link/g2lp6n, https://wa.link/ado6ca, https://wa.link/964yjl |
| +60 10-276 3283 | Used by E5 for Telegram. | Telegram: @Kok123789 |
| +60 10-380 5936 | Used by E4 for WhatsApp. | https://wa.link/kbvmya, https://wa.link/zppusp, https://wa.link/xnk6dc, https://wa.link/4n851f, https://wa.link/q6edor, https://wa.link/fl378z, https://wa.link/raxfd0 |
| +60 10-386 9782 | Used by E3 for WhatsApp. | https://wa.link/5hpjey, https://wa.link/mg53uk, https://wa.link/qqgaa7, https://wa.link/rc1b8j |
| +60 10-390 1378 | Used by E4 for WhatsApp. | https://wa.link/60f224, https://wa.link/c9s55u, https://wa.link/xas0pr, https://wa.link/jl8ycs, https://wa.link/38cm2m |
| +60 10-904 8192 | Used by E1 for non-work WhatsApp (i.e. not for scamming). | |
| +60 11-2611 3356 | Used by E6 for Telegram. | Telegram: @davidmoet |
| +60 11-2958 3051 | Used by E4 for Telegram. | Telegram: @La78349 |
| +60 11-2958 3053 | Used by E1 for “eshopnurturer.com” customer support in WhatsApp. | https://wa.link/oksir1 |
| +60 11-4017 4735 | Used by E1 for Telegram. | Telegram: @chin5304 |
| +60 11-4017 4743 | Used by E2 for Telegram. | Telegram: @gabbie6524 |
| +60 16-260 4636 | Used by E2 for WhatsApp. | https://wa.link/fltaw4, https://wa.link/y5ol97, https://wa.link/aujnw4, https://wa.link/7367ok |
| +60 16-413 5378 | Used by someone with unknown role for WhatsApp and Telegram. Either E1’s friend or a superior. Attempted to coax information about me and my identity, then snitching it to E1. | |
| Unknown | Used by E3 for Telegram. | Telegram: @Waso123 |
- Past/inactive phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +44 7404 374796 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7404 561781 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7405 043908 | Used in WhatsApp by unknown E group member for UK scam operation. | Group admin of “100 AMAZON MARKETING GRP” |
| +44 7405 242525 | Used in Telegram and WhatsApp by unknown E group member for UK scam operation. | Telegram: @dudhwalavemet31 |
| +44 7405 270937 | Used in WhatsApp by unknown E group member for UK scam operation. | |
| +44 7405 318120 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7405 471385 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7405 882988 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7424 284647 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7424 498683 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7424 569067 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7438 876743 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7440 308423 | Used in WhatsApp by unknown E group member for UK scam operation. | |
| +44 7440 522603 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7440 528384 | Used in Telegram and WhatsApp by unknown E group member for UK scam operation. | Telegram: @popirathor1985 |
| +44 7440 625083 | Used in Telegram and WhatsApp by unknown E group member for UK scam operation. | Telegram: @dalwadikewy |
| +44 7448 295422 | Used in WhatsApp by unknown E group member for UK scam operation. | Group admin of “100 AMAZON MARKETING GRP” |
| +44 7448 380184 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7459 485797 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7459 527322 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7459 657374 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7459 690441 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7459 839639 | Used in Telegram and WhatsApp by unknown E group member for UK scam operation. | Telegram: @acimyxurevo |
| +44 7459 867766 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7466 095876 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7466 224522 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7466 494903 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +44 7466 872107 | Used in WhatsApp by unknown E group member for UK scam operation. | Fake member of “100 AMAZON MARKETING GRP” |
| +60 10-262 2856 | Used by E4 for WhatsApp. | https://wa.link/hqbhuu, https://wa.link/qnd4qw, https://wa.link/3ns136, https://wa.link/l44dt1, https://wa.link/xqeebo, https://wa.link/yzfcvm, https://wa.link/vsp94v, https://wa.link/wqlhsc, https://wa.link/4ls7hd, https://wa.link/hzdjcb, https://wa.link/kc3b1h, https://wa.link/h1tlaq, https://wa.link/6gx828 |
| +60 11-2958 3051 | Used by E4 for WhatsApp. | https://wa.link/c0vrq3, https://wa.link/54zgz8, https://wa.link/uk6d6b, https://wa.link/ef094x, https://wa.link/3a2wug, https://wa.link/n0lmjr, https://wa.link/vw8ufd, https://wa.link/rcepxg, https://wa.link/9zgkdt, https://wa.link/yzkp0z, https://wa.link/evbyg7, https://wa.link/vcr8ad, https://wa.link/7aanc4 |
| +60 11-4017 4722 | Used by E1 for burner Hotmail account SMS verification. | [email protected] |
| +60 11-4017 4737 | Used by previous E2 for Telegram. | Telegram: @ronaldo9988 |
| +60 11-4017 4739 | Previously used by E4 for Telegram. | |
| +60 14-926 2387 | Used by E1 for “e-merchantstimulatorworldwide.com” customer service in WhatsApp. | https://wa.link/wssqnw |
| +60 16-854 2017 | Used by E2 for WhatsApp. | https://wa.link/hbz4xj, https://wa.link/g8i8r5, https://wa.link/6ilnff, https://wa.link/oh6ozg, https://wa.link/j9qptf, https://wa.link/49d9tl |
| +60 16-986 0359 | Used by E1 for WhatsApp. | https://wa.link/sbjk24, https://wa.link/8s0r55, https://wa.link/gqcny2, https://wa.link/qqs7as, https://wa.link/615mu0, https://wa.link/i3zjf8, https://wa.link/4njenp, https://wa.link/dxu2y9, https://wa.link/lzihpm, https://wa.link/7ffz9w |
| +61 422 958 077 | Used by E1 during Australian scam operation as “e-merchantstimulatorworldwide.com” customer service in WhatsApp. | https://wa.link/0hkk8v |
| +61 423 974 744 | Used by E3 during Australian scam operation for WhatsApp. | |
| +61 423 976 254 | Used by E3 during Australian scam operation for WhatsApp. | https://fb.me/2V6KflDqu, https://fb.me/2DdLyQ867, https://fb.me/2SVb6nze9, https://fb.me/41DsM9PeG |
| +61 423 976 346 | Used by E2 during Australian scam operation for WhatsApp. | |
| +61 423 976 355 | Used by unknown E group member during Australian scam operation for WhatsApp. | |
| +61 423 976 372 | Used by E2 during Australian scam operation for WhatsApp. | |
| +61 478 279 864 | Used by unknown E group member during Australian scam operation for WhatsApp. |
F group
- Currently active members: F1, F2, F3, F4, F5
- Team members use vivo Y20 2021 (V2043) as their work/burner phones.
- Their direct superior is called Lim.
- F1 recently sold his motorbike.
- F1 will be travelling with his brother and Lim (his superior) to Semporna, Sabah on 3 Feb to 7 Feb 2022.
- F3 is given the nickname 阿隆 (Ah Long), possibly reflecting his real name. He also allegedly has bad sales among his teammates.
- On 27 Sept 2021, I’ve worked together with a victim who lost her money, by having her threaten one of the scammers in the team by telling them their location as “Bukit Jalil” and lives in a condominium. This has them spooked, called up their superior, and went on a hiatus. Unfortunately, they did not return the money, but it is expected as the financials are under the control of their superiors and not them. They continued their scams on 2 Oct.
- On 9 Dec 2021, Singapore Police Force has blocked the domain “e-shopstimulator.com” in Singapore on the ISP level.
- Domains
- Unknown - 27 Sept: shopboostr-my.com
- 2 Oct - 11 Nov: e-shopboostr.com
- 12 Nov - 21 Dec: e-shopstimulator.com
- 21 Dec - Present: brandspusher.com
- Planned future: dailyshopperz.com
- Past operating locations
- The dates are not accurate and should only be used as a reference, as I’m not querying the location every day.
- Unknown - 27 Sept: The Havre, Bukit Jalil (Block A)
- 2 Oct - 27 Oct: Sfera Residency, Seri Kembangan (Block A)
- Unknown - 22 Nov: The Link 2, Bukit Jalil
- 22 Nov - 29 Nov: Le Pavillion / Pavillion Residence, Puchong
- 29 Nov - 5 Dec: Lumi Tropicana, Petaling Jaya
- 5 Dec - 13 Dec: The Park Sky Residence, Bukit Jalil
- 13 Dec - 20 Dec: Skypod Residence, Puchong
- 20 Dec - 28 Dec: Park 51 Residency, Petaling Jaya
- 28 Dec - 4 Jan: DJ Suites, Ara Damansara
- 4 Jan - 14 Jan: The Link 2, Bukit Jalil
- 14 Jan - Present: The Azure Residences / New World Hotel @ Paradigm Mall, Petaling Jaya
- Bank accounts (for salary, food, Airbnb etc. - may also be mule accounts)
| User | Name | Bank | Account number |
|---|---|---|---|
| F2 | Tan Kam Yeow | Maybank | 162740318721 |
| F2 | Lee Leong Chuan | Maybank | 112905016371 |
| F3 | Kue Zheng Hao | Hong Leong Bank | 22500032909 |
| F4 | Khaw Kal Ven | RHB Bank | 15901800091023 |
| F4 | Khaw Kal Ven | Public Bank | 6926231631 |
| F5 | Chin Zheng Hao | Maybank | 159012899570 |
-
Salary of F group (7/12/2021)
-
Active phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 10-380 6916 | Used by F4 for Telegram. | Telegram: @Hellomadafakker |
| +60 10-663 6652 | Used by F3 for WhatsApp. | https://wa.link/4ngj82, https://wa.link/i5pwsr, http://wa.link/yldzoj, http://wa.link/h334cj, |
| +60 11-1438 3809 | Used by F3 for Telegram. | Telegram: @xiaoting0224 |
| +60 11-1772 8178 | Used by F2 for WhatsApp. | https://wa.link/vi45p3, https://wa.link/onahvj |
| +60 11-2401 5696 | Used by F3 for WhatsApp. | https://wa.link/4y35ea, https://wa.link/xdctvu, https://wa.link/jpluij, https://wa.link/chjtlt, https://wa.link/ohuymw, https://wa.link/ajuawn |
| +60 14-303 4734 | Used by F1 for “brandspusher.com” customer service in WhatsApp. | https://wa.link/izja14 |
| +60 16-712 7619 | Used by F1 for Telegram. | Telegram: @F1_TopSales |
| +60 16-936 1692 | Used by F3 for WhatsApp. | https://wa.link/a935ly, https://wa.link/20nt7c |
| +60 16-938 2379 | About to be used by F1 for “dailyshopperz.com” customer service in WhatsApp. | https://wa.link/c8yi92 |
| Unknown | Used by F5 for Telegram. | Telegram: @azsxazsx8888 |
| Unknown | Used by F2 for Telegram. | Telegram: @jc0713 |
- Past/inactive phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 10-203 0269 | Used by F5 for WhatsApp. | https://wa.link/hslgec |
| +60 10-265 7729 | Used by F4 for WhatsApp. | http://mywa.link/wif8ykru |
| +60 10-276 0783 | Used by F3 for WhatsApp. | http://wa.link/rqa7mz |
| +60 10-432 8443 | Used by F5 for WhatsApp and Telegram. | https://wa.link/e8f86o, https://wa.link/wrc1a1, https://wa.link/mba5ai, https://wa.link/sh2mll, https://wa.link/m7dwh4, https://wa.link/bcx70w, https://wa.link/77173d, https://wa.link/8mul7m, https://wa.link/k67w6k, https://wa.link/keorxk, https://wa.link/r26sen / Telegram: @EmilyChin87 |
| +60 10-432 8455 | Used by F2 for WhatsApp and Telegram. | https://wa.link/or4uqs, https://wa.link/m1vzol, https://wa.link/mqigq1 |
| +60 10-563 3316 | Used by F1 for Telegram. | Telegram: @MrKK500K |
| +60 10-718 0743 | Used by F1 for WhatsApp. | https://wa.link/a0ouw1 |
| +60 10-906 3039 | Used by F3 for WhatsApp. | https://wa.link/2om9he, https://wa.link/735akf, https://wa.link/zfgwzh |
| +60 10-928 3572 | Used by F4 for WhatsApp. | https://wa.link/dpuwf2 |
| +60 11-1438 2507 | Used by F3 for WhatsApp. | https://wa.link/i1xp2h |
| +60 11-1438 3616 | Used by F1 for “e-shopstimulator.com” customer service in WhatsApp. | https://wa.link/isur76 |
| +60 11-2306 7578 | Used by F1 for WhatsApp. | https://wa.link/ju2d6r |
| +60 11-3128 9480 | Used by F4 for WhatsApp. | https://wa.link/hikddb |
| +60 11-3172 1399 | Used by F1 for WhatsApp. | https://wa.link/fn7wjn |
| +60 11-4069 2467 | Used by F5 for Telegram. | Telegram: @ShieQi90 |
| +60 11-4069 2486 | Used by F1 for WhatsApp. | https://wa.link/zj8fwm, https://wa.link/fa8es8, https://wa.link/681pfl |
| +60 11-5117 8422 | Used by F5 for WhatsApp. | https://wa.link/j0tr37, https://wa.link/42f8wo, https://wa.link/4dz4oj, https://wa.link/eis49f, https://wa.link/vi6fyx, https://wa.link/zb1sjj, https://wa.link/4f0d6y, https://wa.link/kr8mrw |
| +60 13-862 9657 | Used by F1 for “shopboostr-my.com” / “e-shopboostr.com” customer service in WhatsApp. | https://wa.link/o5hz9w |
| +60 13-882 1429 | Used by F4 for WhatsApp. | https://wa.link/s8jnn5 |
| +60 13-898 3679 | Used by F3 for WhatsApp. | https://wa.link/opk0f2, https://wa.link/p34vxx |
| +60 14-623 0885 | Used by F3 for Telegram (according to F4’s contacts). | |
| +60 14-633 2049 | Used by F4 for WhatsApp. | https://wa.link/jyc63a |
| +60 14-929 4337 | Used by F3 for WhatsApp. | https://wa.link/yybift |
| +60 16-242 1643 | Used by F5 for WhatsApp. | https://wa.link/oukhyv, https://wa.link/y2072c, https://wa.link/eamnym |
| +60 16-535 4209 | Used by F6 for WhatsApp. | https://mywa.link/59pvuuvk |
| +60 16-663 9287 | Used by F4 for WhatsApp. | https://wa.link/zqnr7r |
| +60 16-823 7416 | Used by F1 for Telegram (according to F4’s contacts). | |
| +60 16-871 9826 | Used by F4 for WhatsApp. | https://wa.link/xlogyp |
| +60 16-874 4578 | Used by unknown F group member for WhatsApp. | https://wa.link/78uq70 |
| +60 16-886 3994 | Used by F4 for Telegram and WhatsApp. | https://wa.link/juzfyl, https://wa.link/hjdwl8 / Telegram: @Hellomadafaker |
| +60 16-932 6802 | Used by F4 for WhatsApp. | https://wa.link/6b6wg1 |
| +60 16-952 7407 | Used by F6 for Telegram (according to F4’s contacts). | |
| +60 17-512 1165 | Used by F4 for WhatsApp. | |
| +60 17-853 9038 | Used by F3 for WhatsApp. | https://wa.link/j3kshm, https://wa.link/pm693t |
V group
- Currently active members: V1, V2
- Team members use Oppo A15 (CPH2185) as their work/burner phones.
- V1’s real name may be Lau.
- V group often gets scolded due to their low sales and V1 constantly submitting inaccurate financial records without double checking.
- Domains
- Unknown - Present: shopespread.com
- Past operating locations
- Unlike the previous teams, they don’t move.
- Unknown - Present: Maple Residence, Klang
- Salary of V group (3/1/2022)
- Active phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 11-1209 4737 | Used by V1 for Telegram. | Telegram: @Rgue2 |
| +60 11-1209 4791 | Used by V1 for “shopespread.com” customer support in WhatsApp. | https://wa.link/08bukr |
| +60 17-241 9987 | Used by V2 for WhatsApp and Telegram. | https://wa.link/qegrxp, https://wa.link/6w35cg / Telegram: @Joeytan11 |
| +60 17-242 1639 | Used by V1 for WhatsApp. | https://wa.link/j1x6iv, https://wa.link/zjekvm, https://wa.link/w28ns7, https://wa.link/kepqzl |
S group
- May be established at 11 December 2021, but traces of S group has been seen as early as October. It is unsure whether if it is the same group.
- Currently active members: S1, S2, S4
- S4 is a newbie.
- Matte reflection of S4
- Team members use vivo Y20 2021 (V2043) as their work/burner phones.
- Domains
- 11 December - Present: familyboost.online
- Past operating locations
- Unknown - Present: CitiZen 2 @ Old Klang Road, Taman Nam Fong
- Active phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 11-1902 0947 | Used by S2 for WhatsApp and Telegram. | https://wa.link/v3mpey |
| +60 11-4008 3510 | Used by S1 for Telegram and for “familyboost.online” customer support in WhatsApp. | https://wa.link/p2b1x3 |
| +60 11-4009 6215 | Used by S4 for Telegram and WhatsApp. | Telegram: @TThomasLkc / WhatsApp: https://wa.link/rnaq1e |
| +60 11-4018 1097 | Used by S1 for WhatsApp. | https://wa.link/0t1ni2 |
- Inactive phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 10-433 1897 | Used by previous S4 for Telegram (according to F4’s contacts). |
Superiors
- Some of the superiors appear to use different chat platforms depending on who they’re talking with. Other than Telegram which is the only platform seen used by scammers, the superiors also use Skype, WeChat and WhatsApp.
- They will likely have an annual dinner / pre-CNY dinner (收工酒) on 29 Jan along with E group and F group.
- Videos sent by superiors
- Runner attempting to withdraw money from a flagged money mule bank account at an ATM - I would appreciate it if someone could identify where this is filmed
- Transaction records of a money mule bank account in the HLB Connect Mobile Banking App showing how money is siphoned out
- Image containing the partial fingerprints of a superior (sent by “萬馬奔騰99 （萬利）”)
- Past operating locations
- Unknown
- Active phone numbers
| Phone number | Usage | Other details |
|---|---|---|
| +60 10-901 8135 | Used by unknown superior for Telegram. It’s in my records but unfortunately I didn’t note down anything more. | |
| +60 11-5986 1924 | Used by “萬馬奔騰99 （萬利）” for Telegram. Very likely head of the entire operation. Purchase mobile top-up PINs, supply money mule accounts, verify submitted financial sheets, etc. | Telegram: @mmm131914 |
| +60 12-227 7152 | Used by unknown superior for Telegram. It’s in my records but unfortunately I didn’t note down anything more. | |
| +60 12-632 2116 | Used by “Oscar” for Telegram. Role unknown. Is a member of the financial log sheet submission group, possibly handles financials. | |
| +60 14-650 8293 | Used by “Kim3149” for Telegram. Speaks Cantonese, likely handles higher-up side of things only. Rarely talks to the scammers. | |
| +60 16-891 4320 | Used by “F” for Telegram. Either one of the programmers for the websites, or acts as a proxy between the scammers and the programmers. | Telegram: @foong111 |
| +60 17-249 0571 | Used by “CXMM” for Telegram. Likely advisor/supervisor for scammers. Distributes salary sheets. | Telegram: @cxm8889 |
| Unknown | Used by “萬利99” for Telegram. Likely the assistant for the head of operations. Can speak both Cantonese and Mandarin. Handles Airbnb payments, help purchase burner e-mail, social media accounts, or other paid services required by the scammers. | Telegram: @mm131914 |
| Unknown | Used by “Magician Koko” for Telegram. Role unknown. Is a member of the financial log sheet submission group chat of E group, possibly handles financials. | Telegram: @casperman126 |
| Unknown | Used by “金鼠” for Telegram. Handles money mule accounts for V group, likely beginner, does not chat with the standard convention used by the other superiors. | Telegram: @mickiemouse17 |
| Unknown | Used by “Golden Keys” for Telegram. Handles money mule accounts for V group, likely beginner, does not chat with the standard convention used by the other superiors. | Telegram: @Goldenkeys88888 |
| Unknown | Used by “M” for Telegram. Handles money mule accounts for V group, likely beginner, does not chat with the standard convention used by the other superiors. | Telegram: @sibehhoseh |
| Unknown | Used by “CM 杨思晨” for Telegram. Is a member of S group’s transaction handling group chat, possibly handles money mule accounts. | Telegram: @thomasyong |
| Unknown | Used by “薯仔” for Telegram. Handles money mule accounts, possibly a runner to get cash from the accounts via ATM, or is a superior to these runners. | Telegram: @Black6531 |
Programmers
- The websites are hosted on Vultr (server location Tokyo, Japan) via Cloudways. The MySQL/SSH/SFTP username is “fydfjdrkwp”.
- When they needed to change the domain of a site, they only reassign a new domain to the same server, then blocks access from the old hostname.
- Programmers IP addresses
- 61.6.88.251
- 192.228.129.24
- 192.228.132.15
- 103.107.198.124 (VPN/Proxy)
- 103.107.198.125 (VPN/Proxy)
- 167.71.204.145 (VPN/Proxy)
- 202.73.12.62 (VPN/Proxy)
- Domains
- phplaravel-640286-2085045.cloudwaysapps.com (F group domains)
- phplaravel-683835-2253357.cloudwaysapps.com (shopespread.com)
- phplaravel-701896-2322120.cloudwaysapps.com (familyboost.online)
- phplaravel-704919-2333983.cloudwaysapps.com (eshopnurturer.com)
- phplaravel-707685-2344158.cloudwaysapps.com
- phplaravel-715817-2375205.cloudwaysapps.com (dailyshopperz.com)
Money mule accounts
Malaysia
| ID | Name | Bank | Account number | DuitNow | Sent on |
|---|---|---|---|---|---|
| - | Hamdan Fikiri bin Mokthar | Hong Leong Bank | 20150154356 | - | 8 August 2021 6:39 PM |
| - | Syed Muhammad Arif bin Syed Adnan | Hong Leong Bank | 15350875849 | - | 10 August 2021 10:45 AM |
| - | Mohd Husen bin Abu Bakar | Hong Leong Bank | 12251146649 | - | 10 August 2021 3:25 PM |
| - | Kamarulnijam bin Osman | Hong Leong Bank | 06751247305 | - | 11 August 2021 3:04 PM |
| - | Hamsita binti Hamid | Hong Leong Bank | 39550060687 | - | 11 August 2021 3:08 PM |
| - | Murzaimal Asmizam bin Jasnizam | Hong Leong Bank | 21450186690 | - | 11 August 2021 3:41 PM |
| - | Mohd Sofian bin Md Yasin | Hong Leong Bank | 02650602856 | - | 12 August 2021 5:48 PM |
| - | Ahmed Sameer bin Abdul Mutalib | Hong Leong Bank | 06750316598 | - | 13 August 2021 12:59 PM |
| - | Muhammad Arif Fahmi bin Mohamed Sa‘adi | Hong Leong Bank | 15350875887 | - | 13 August 2021 5:10 PM |
| - | Mohd Najib bin Nazri | Hong Leong Bank | 12251146742 | - | 14 August 2021 7:27 PM |
| - | Annuar bin Hassan | Hong Leong Bank | 38200010043 | - | 16 August 2021 4:57 PM |
| - | Islinda binti Ab Ghani | Hong Leong Bank | 19251000829 | - | 16 August 2021 8:45 PM |
| - | Mohd Rashidi bin Mohd Razalan | Hong Leong Bank | 39551022480 | - | 17 August 2021 1:09 PM |
| - | Haris Hazroy bin Mohd Hanafi | Bank Rakyat | 2204434217 | - | 17 August 2021 4:05 PM |
| - | Tan Chia Hui | Standard Chartered Bank | 668409955151 | - | 18 August 2021 8:25 PM |
| - | Chiang Chee Way | Standard Chartered Bank | 668409948392 | - | 19 August 2021 5:24 PM |
| - | Haris Hazroy bin Mohd Hanafi | Bank Islam | 13044021457788 | - | 19 August 2021 8:47 PM |
| - | Mohd Rashidi bin Mohd Razalan | Bank Rakyat | 2236643278 | - | 19 August 2021 11:05 PM |
| - | Muhd Nurarriffin bin Hamdan | Hong Leong Bank | 39550077168 | - | 20 August 2021 4:13 PM |
| - | Natasha Umira binti Roslan | AmBank | 8881040001449 | 920211-10-6000 | 20 August 2021 4:42 PM |
| - | Sazuan bin Sharudin | Bank Islam | 08077020276665 | - | 20 August 2021 6:56 PM |
| H89 | Faridah binti Mat Nor | Hong Leong Bank | 22551014653 | 0177142765 | 23 August 2021 10:08 AM |
| BR19 | Faridah binti Mat Nor | Bank Rakyat | 2236612622 | - | 23 August 2021 8:17 PM |
| H87 | Helena Anak Buyong | Hong Leong Bank | 39550070433 | 770706-13-5064 | 24 August 2021 10:03 AM |
| H90 | Natasha Umira binti Roslan | Hong Leong Bank | 10901024745 | - | 24 August 2021 10:26 AM |
| A019 | Harmesh Singh Gill A/L Chamkor Singh | AmBank | 8881028053304 | - | 25 August 2021 10:05 AM |
| H91 | Noorwistamira binti Abri | Hong Leong Bank | 29101004607 | - | 25 August 2021 11:57 AM |
| H95 | Sarita binti Ago | Hong Leong Bank | 29151016827 | - | 27 August 2021 9:38 AM |
| H92 | Muhamad Asyraf bin Zainodin | Hong Leong Bank | 29151016810 | - | 27 August 2021 2:49 PM |
| H96 | Mazliana binti Abd Rahman | Hong Leong Bank | 28950568704 | - | 27 August 2021 3:40 PM |
| A020 | Mohd Ashrul Nizam bin Ab Ghani | AmBank | 8881044508875 | - | 29 August 2021 1:56 PM |
| i45 | Faridah binti Mat Nor | Bank Islam | 12092020102208 | - | 31 August 2021 1:47 PM |
| H99 | Muhammad Haiqal bin Edie Adzhar | Hong Leong Bank | 34400046495 | - | 2 September 2021 4:01 PM |
| H98 | Noor Amalina binti Ab Ghani | Hong Leong Bank | 33850079415 | - | 3 September 2021 12:04 PM |
| H93 | Norwati binti Din | Hong Leong Bank | 29101004597 | - | 4 September 2021 12:03 PM |
| H94 | Sazuan bin Sharudin | Hong Leong Bank | 03551129516 | - | 4 September 2021 4:42 PM |
| BR21 | Nur Zulikha Ooi | Bank Rakyat | 2237806996 | 000201-05-0312 | 6 September 2021 11:56 AM |
| Hl04 | Hafizah binti Ibrahim | Hong Leong Bank | 06001029125 | - | 7 September 2021 11:40 AM |
| i48 | Noraini binti Ismail | Bank Islam | 03090020658812 | - | 7 September 2021 12:06 PM |
| HL02 | Hidayat Fahmi bin Saad | Hong Leong Bank | 33051040009 | - | 8 September 2021 10:08 AM |
| Hl06 | Omar Kennydy Wilbert | Hong Leong Bank | 03000686971 | - | 8 September 2021 2:10 PM |
| Hl07 | Delna binti Julkipli | Hong Leong Bank | 27450385017 | - | 9 September 2021 11:37 AM |
| Hl03 | Amira Lela Choo binti Muhamad Amin Choo | Hong Leong Bank | 39550065534 | - | 10 September 2021 12:11 PM |
| Hl01 | Fatimah binti Makhatar | Hong Leong Bank | 10650631104 | - | 12 September 2021 1:06 PM |
| i49 | Muhammad Haiqal bin Edie Adzhar | Bank Islam | 05067021408290 | - | 12 September 2021 1:13 PM |
| Hl08 | Salma binti Roman | Hong Leong Bank | 29150122482 | - | 14 September 2021 12:39 PM |
| BR22 | Zulhimi bin Abd Rahman | Bank Rakyat | 2246240996 | - | 14 September 2021 3:41 PM |
| Hl09 | Mohd Borhan bin Mustafa | Hong Leong Bank | 35401035088 | - | 14 September 2021 6:18 PM |
| - | Muhammad Dinie Imadie bin Azmi | Public Bank | 4906100029 | - | 15 September 2021 10:33 AM |
| - | Mohd Suhaimi Fuad bin Amer Hamzah | Public Bank | 4906377131 | - | 15 September 2021 11:23 AM |
| - | Muhamad Ikram bin Mad Su | Maybank | 163037351518 | - | 15 September 2021 6:08 PM |
| - | Durga Devi A/L Kalidas | Maybank | 102055490595 | - | 15 September 2021 6:14 PM |
| Hl11 | Mohd Khairul Marzuki bin Ahmadul | Hong Leong Bank | 18251086875 | - | 16 September 2021 4:24 PM |
| i50 | Mohd Khairul Marzuki bin Ahmadul | Bank Islam | 10043020289406 | - | 17 September 2021 2:12 AM |
| Hl10 | Mohd Nor Hisyam bin Sikri | Hong Leong Bank | 34401025264 | 900729-03-5827 | 17 September 2021 10:03 AM |
| Hl12 | Hairur Razi bin Suhur | Hong Leong Bank | 12551057854 | 851022-14-6365 | 19 September 2021 4:37 PM |
| A023 | Hidayat Fahmi bin Saad | AmBank | 8881044725266 | 870412-02-6071 | 20 September 2021 2:34 PM |
| Hl13 | Lee You Keat | Hong Leong Bank | 15450133230 | - | 20 September 2021 2:35 PM |
| i51 | Annisa binti Piang | Bank Islam | 10025029253886 | - | 20 September 2021 11:34 PM |
| Hl14 | Mohd Hafiz bin Mohd Rashid | Hong Leong Bank | 39550094378 | - | 22 September 2021 7:24 PM |
| i53 | Fatimah binti Mokhatar | Bank Islam | 13053020408146 | - | 23 September 2021 6:24 PM |
| i54 | Roskemaidayu binti Mamat | Bank Islam | 03054020487886 | - | 25 September 2021 11:08 AM |
| Hl15 | Patimahbi binti Mohamed | Hong Leong Bank | 02850594317 | 570117-08-5090 | 27 September 2021 11:48 AM |
| i52 | Mohamad Affendi bin Kipli | Bank Islam | 11031022182525 | 951123-13-6463 | 27 September 2021 8:00 PM |
| Hl17 | Muhammad Alif Asyraf bin Mohd Yusoff | Hong Leong Bank | 35451052499 | - | 2 October 2021 1:43 PM |
| Hl16 | Shalmin bin Sulaiman | Hong Leong Bank | 06751240247 | - | 4 October 2021 11:12 AM |
| Hl18 | Johan Syamil Iskandar Abu Sahar bin Hamzah | Hong Leong Bank | 39550108501 | 910220-14-5395 | 4 October 2021 1:17 PM |
| Hl19 | Khua Leong Hai | Hong Leong Bank | 28150160720 | - | 5 October 2021 6:49 PM |
| Hl20 | Nur Afizani binti Remli | Hong Leong Bank | 18251086277 | - | 7 October 2021 9:26 AM |
| - | Mohd Faisal bin Mohd Yusoff | Maybank | 162179942963 | - | 8 October 2021 1:20 PM |
| - | Phatmavhani Ravichandran | CIMB Bank | 7630663821 | - | 8 October 2021 3:38 PM |
| - | Tan Chye Heng | Hong Leong Bank | 22050032521 | - | 9 October 2021 5:36 PM |
| Hl21 | Yee Mun Jenk | Hong Leong Bank | 05150332537 | - | 9 October 2021 5:36 PM |
| i56 | Khua Leong Hai | Bank Islam | 12131023241440 | - | 10 October 2021 4:59 PM |
| BR24 | Masitah binti Mohd Lasa | Bank Rakyat | 2246345342 | - | 11 October 2021 9:30 AM |
| Hl22 | Ezzatul Najhah binti Mohd Azer | Hong Leong Bank | 28950569002 | - | 12 October 2021 9:38 AM |
| BR23 | Nur Afizani binti Remli | Bank Rakyat | 2239329610 | 01124346712 | 13 October 2021 2:47 PM |
| Hl23 | Muhamad Khairul Ezani bin Remli | Hong Leong Bank | 13001010742 | - | 13 October 2021 3:40 PM |
| Hl24 | Nur Qurratu Aini binti Remli | Hong Leong Bank | 13401008031 | - | 14 October 2021 9:26 AM |
| BR25 | Nur Ellia Ayuni binti Remli | Bank Rakyat | 2239334877 | - | 15 October 2021 10:22 AM |
| BR26 | Muhamad Khairul Ezani bin Remli | Bank Rakyat | 2246370077 | - | 16 October 2021 1:57 PM |
| Hl27 | Nur Ellia Ayuni binti Remli | Hong Leong Bank | 13001010773 | - | 16 October 2021 6:42 PM |
| BR27 | Nurul Nabilah binti Asmawi | Bank Rakyat | 2246369984 | - | 17 October 2021 11:29 AM |
| BR28 | Nur Farah Afni binti Remli | Bank Rakyat | 2246369546 | - | 19 October 2021 10:48 AM |
| i57 | Puan Nur Qurratu Aini binti Remli | Bank Islam | 06046023727683 | - | 20 October 2021 11:25 AM |
| A025 | Khua Leong Hai | AmBank | 8881045094464 | 0179923170 | 21 October 2021 9:09 AM |
| BR29 | Nur Qurratu Aini binti Remli | Bank Rakyat | 2246372390 | - | 21 October 2021 1:32 PM |
| AL01 | Ho Pang Jin | Alliance Bank | 141580013003270 | - | 21 October 2021 2:35 PM |
| i60 | Nur Farah Afni binti Remli | Bank Islam | 06046023727815 | 960927-03-5590 | 21 October 2021 4:46 PM |
| BR30 | Nur Aimi Elyani binti Remli | Bank Rakyat | 221181227587 | - | 21 October 2021 7:30 PM |
| Hl25 | Nur Farah Afni binti Remli | Hong Leong Bank | 13001010735 | - | 22 October 2021 2:29 PM |
| i58 | Encik Muhamad Khairul Ezani bin Remli | Bank Islam | 06046023727804 | - | 22 October 2021 5:40 PM |
| - | Noor Yanabilah binti Yahya | Bank Rakyat | 2246383871 | - | 24 October 2021 2:09 PM |
| BR32 | Faridatul Akmar binti Malek | Bank Rakyat | 2246319177 | - | 24 October 2021 8:22 PM |
| Hl28 | Paveethra A/P Krishnan | Hong Leong Bank | 36501019817 | - | 25 October 2021 10:17 AM |
| Hl44 | Husin bin Atan | Hong Leong Bank | 01001031905 | - | 23 November 2021 3:05 PM |
| i74 | Noor Hatimi binti Mad Harun | Bank Islam | 05030023525725 | - | 24 November 2021 8:09 PM |
| Hl41 | Siti Zabedah binti Mohd Zaki | Hong Leong Bank | 01001031802 | 01112294736 | 24 November 2021 9:02 PM |
| - | Mohamad Azrol bin Mohd Diah | Maybank | 166010027952 | 0168837811 | 25 November 2021 12:35 PM |
| Aff13 | Mohd Danish bin Azrol | Affin Bank | 206650012860 | - | 25 November 2021 5:53 PM |
| Hl45 | Mohd Danish bin Azrol | Hong Leong Bank | 34951037018 | - | 25 November 2021 7:31 PM |
| BR46 | Syamimi Zulaikha binti Jesni | Bank Rakyat | 2246484217 | - | 26 November 2021 5:49 PM |
| A030 | Bang Boon Huei | AmBank | 8881045551069 | - | 27 November 2021 6:03 PM |
| Hl47 | Faridatul Akmar binti Malek | Hong Leong Bank | 01001032241 | - | 28 November 2021 11:34 AM |
| - | Pn Rohani binti Mat Pilus | Bank Islam | 05030020373786 | - | 29 November 2021 12:20 PM |
| Hl48 | Misri bin Atan | Hong Leong Bank | 01001032234 | 810618-05-5121 | 29 November 2021 2:49 PM |
| - | Wong Yee Lin | Hong Leong Islamic | 39551041485 | 01140099438 | 29 November 2021 7:07 PM |
| HL52 | Bruce Tiong Yu Fong | Hong Leong Bank | 02950339324 | 940531-13-5263 | 1 December 2021 2:24 PM |
| HL50 | Bong Soon Min | Hong Leong Bank | 25650218388 | - | 2 December 2021 9:39 AM |
| - | Unknown | Bank Islam | 12168024011931 | - | 3 December 2021 11:51 AM |
| i77 | Encik Bang Boon Huei | Bank Islam | 06082023760025 | 01164183371 | 3 December 2021 6:01 PM |
| HL54 | Hapipah binti Johari | Hong Leong Bank | 01650532075 | 620613-13-5344 | 4 December 2021 5:15 PM |
| - | Unknown | Hong Leong Bank | 01650531973 | - | 5 December 2021 9:05 PM |
| Hl49 | Supriadi bin Supu | Hong Leong Bank | 06750319083 | - | 5 December 2021 9:28 AM |
| HL60 | Muhammad Ramadhan bin Suhaimi | Hong Leong Bank | 12551058774 | - | 6 December 2021 12:49 PM |
| HL58 | Noorazah binti Sapiee | Hong Leong Bank | 01750592489 | - | 6 December 2021 2:46 PM |
| Aff14 | Nurrul Shahirah binti Fadzil | Affin Bank | 205570039584 | - | 6 December 2021 5:44 PM |
| HL62 | Lee Khoi Kiong | Hong Leong Bank | 02950340461 | - | 7 December 2021 10:56 AM |
| - | Safri bin Basri | Hong Leong Bank | 01651068823 | - | 7 December 2021 4:40 PM |
| - | Ng Wei Kiat | Public Bank | 6377875801 | 01118948990 | 7 December 2021 8:49 PM |
| HL56 | Mohd Aidil bin Kurais | Hong Leong Bank | 23451014594 | - | 7 December 2021 10:18 PM |
| - | Puan Monaliza binti Mohd | Bank Islam | 01078024284314 | - | 8 December 2021 10:46 AM |
| HL61 | Lim Hui Ping | Hong Leong Bank | 25650238052 | - | 8 December 2021 8:14 PM |
| HL64 | Zailal Fajar bin Ridwan | Hong Leong Bank | 29200049776 | - | 9 December 2021 6:13 PM |
| HL65 | Chong Jit Cheng | Hong Leong Bank | 25650230256 | - | 11 December 2021 10:15 AM |
| i80 | Azzhari Fikry binti Rambalan | Bank Islam | 12289022208878 | - | 12 December 2021 1:24 PM |
| HL66 | Jee Eo Liang | Hong Leong Bank | 25650240552 | - | 13 December 2021 3:40 PM |
| - | Nurul Kashifah binti Iskandar | Bank Islam | 12038025646143 | - | 13 December 2021 5:41 PM |
| - | Wong Siew Wei | Hong Leong Bank | 39551044671 | 0105128991 | 14 December 2021 8:33 PM |
| HL67 | Almujir bin Mohammad | Hong Leong Bank | 15301022256 | - | 15 December 2021 2:57 PM |
| - | Muhammad Lee bin Abdullah | Bank Rakyat | 2240651539 | - | 16 December 2021 11:30 AM |
| - | Zaimah binti Hamid | Bank Islam | 06037023010109 | 01119895128 | 16 December 2021 5:46 PM |
| C01 | Mior Ridhwan bin Kulub Mior | CIMB Bank | 7053178489 | 890323-08-5801 | 17 December 2021 11:46 AM |
| - | Wee Kok Huat | Hong Leong Bank | 25650229535 | - | 18 December 2021 8:37 PM |
| - | Ng Weng Kiat | AmBank | 8881045633941 | 0145290898 | 19 December 2021 6:30 PM |
| - | Muhammad Razin | OCBC Bank | 7352658727 | 01121141346 | 20 December 2021 4:41 PM |
| - | Wong Yee Lin | AmBank | 8881045606928 | 0108101400 | 22 December 2021 3:39 PM |
| A033 | Hew Chee Yong | AmBank | 8881044641160 | - | 23 December 2021 11:36 AM |
| A242 | Lau Puong Hou | Hong Leong Bank | 25751035329 | 01131779023 | 23 December 2021 5:32 PM |
| A241 | Khu Chin Chin | Hong Leong Bank | 25751035312 | 01131778987 | 23 December 2021 7:14 PM |
| - | Wong Siew Wei | United Overseas Bank (UOB) | 9093176401 | 880102-14-5744 | 24 December 2021 4:23 PM |
| A032 | Jeffry Williams | AmBank | 8881033963430 | - | 25 December 2021 8:14 PM |
| - | Wong Yee Lin | United Overseas Bank (UOB) | 9093172120 | 0108101400 | 27 December 2021 7:18 PM |
| HL69 | Aideil Hakiem bin Abdul Manap | Hong Leong Bank | 19051027301 | 941124-10-6355 | 27 December 2021 9:55 AM |
| - | Wong Jin Fook | Hong Leong Bank | 18750105996 | 01169337383 | 27 December 2021 9:06 PM |
| - | Muhammad Khairul Anwar bin Zainol | Agrobank | 2007641000009980 | 01123011079 | 28 December 2021 10:42 AM |
| MD13 | Nurulasyikin binti Md Salleh | Agrobank | 2005611999980006 | 0173387898 | 28 December 2021 8:11 PM |
| - | Loo Thoon Sean | United Overseas Bank (UOB) | 9093165922 | - | 28 December 2021 7:43 PM |
| - | Jack Anak Benjamin | Affin Bank | 201270076236 | - | 28 December 2021 10:18 PM |
| MD11 | Nazmalinda binti Amran | Agrobank | 1005611999980040 | 0198367723 | 29 December 2021 7:47 PM |
| - | Chooi Hong Kim | RHB Bank | 10806100171285 | 01116239180 | 30 December 2021 7:09 PM |
| HL70 | Afieq bin Omar | Hong Leong Bank | 06750282880 | - | 31 December 2021 10:14 AM |
| C02 | Muhammad Syakir Arif bin Arman Ali | CIMB Bank | 7635881637 | - | 31 December 2021 3:41 PM |
| - | Encik Mohd Aizol Izlan bin Ibrahim | Bank Islam | 13026027856271 | - | 2 January 2022 12:39 PM |
| C03 | Noor Azmi bin Abdullah | CIMB Bank | 7634266117 | 990330-01-7477 | 3 January 2022 11:10 AM |
| - | Norshah Rizan bin Abdul Ghani | Bank Islam | 04024021005703 | 01151300347 | 3 January 2022 3:22 PM |
| JJ8 | Aizat Asnawi bin Muhamad Fauzi | Bank Islam | 12092023269895 | 0166109804 | 3 January 2022 4:20 PM |
| - | Ng Kai Loon | RHB Bank | 10141900216104 | - | 3 January 2022 8:56 AM |
| - | Mazlan bin Hasim | Hong Leong Bank | 25150442953 | 0178527808 | 4 January 2022 1:34 PM |
| - | Loo Thoon Sean | Affin Bank | 200730463225 | - | 4 January 2022 3:18 PM |
| - | Wong Kok Keong | Hong Leong Bank | 15500045106 | - | 4 January 2022 6:11 PM |
| - | Norhafiza binti Syed Mohamad | AmBank | 8881022026897 | - | 5 January 2022 8:33 AM |
| HL71 | Aida Azmieza binti Alias | Hong Leong Bank | 39550155468 | - | 5 January 2022 2:28 PM |
| B03 | Aideil Hakiem bin Abdul Manap | Bank Simpanan Nasional (BSN) | 1417441100019622 | - | 6 January 2022 11:08 AM |
| A034 | Asraf bin Amat | AmBank | 8881032375950 | - | 6 January 2022 2:14 PM |
| - | Loo Thoon Sean | HSBC Bank | 313529901108 | - | 7 January 2022 12:22 PM |
| HL72 | Muhammad Luqman Nur Haqim | Hong Leong Bank | 03251171637 | - | 7 January 2022 3:09 PM |
| - | Eng Kang Jun | United Overseas Bank (UOB) | 1333168222 | - | 8 January 2022 10:12 AM |
| C04 | Raffi bin Kirah | CIMB Bank | 7638611450 | 880628-12-5967 | 8 January 2022 3:44 PM |
| C05 | Afsham bin Kalumpang | CIMB Bank | 7631397148 | 880302-12-5377 | 8 January 2022 3:53 PM |
| - | Tin Chee Keng | United Overseas Bank (UOB) | 9093118177 | - | 8 January 2022 8:47 PM |
| B04 | Nurul Akma binti Hossni | Bank Simpanan Nasional (BSN) | 0823941100011135 | - | 9 January 2022 2:47 PM |
| - | Ahmad bin Abu Bakar | Hong Leong Bank | 07000354357 | - | 10 January 2022 2:52 PM |
| - | Erman bin Amat | Bank Simpanan Nasional (BSN) | 1210041000188967 | - | 10 January 2022 8:07 PM |
| HL73 | Ho Kah Lok | Hong Leong Bank | 18850087701 | - | 11 January 2022 1:44 PM |
| - | Wong Siew Wei | Alliance Bank | 160130013000475 | 0135679274 | 11 January 2022 3:19 PM |
| - | Muhammad Muhaimin bin Md Din | Hong Leong Bank | 39550077072 | - | 11 January 2022 6:01 PM |
| - | Pierre Goh Qi Hong | Hong Leong Bank | 26500072996 | - | 12 January 2022 9:26 AM |
| - | Tan Poh Siew | United Overseas Bank (UOB) | 9093161161 | - | 12 January 2022 3:08 PM |
| - | Tan Poh Siew | United Overseas Bank (UOB) | 9093183920 | - | 12 January 2022 5:05 PM |
| HL74 | Muhammad Fitrie Shah bin Yaki | Hong Leong Bank | 02801087880 | - | 12 January 2022 8:13 PM |
| HL75 | Raffi bin Kirah | Hong Leong Bank | 02801087921 | - | 13 January 2022 9:49 AM |
| B05 | Ho Kah Lok | Bank Simpanan Nasional (BSN) | 1013141100051765 | - | 13 January 2022 5:17 PM |
| HL76 | Por Yeong Kaan | Hong Leong Bank | 02801087859 | - | 13 January 2022 8:28 PM |
| - | Dayang Nur Zahirahtul bt Assim | Bank Simpanan Nasional (BSN) | 0714141100020200 | - | 13 January 2022 8:47 PM |
| - | Che Mohd Husaini bin Che Hussin | AmBank | 8881039028829 | - | 13 January 2022 8:52 PM |
| - | Muhammad Zukry bin Tukiran | RHB Bank | 15131100084475 | - | 14 January 2022 10:09 AM |
| A035 | Ho Kah Lok | AmBank | 8881046228999 | 940823-14-6247 | 14 January 2022 3:52 PM |
| C07 | Tang Chee Meng | CIMB Bank | 7076127429 | 771027-14-5089 | 14 January 2022 6:31 PM |
| HL77 | Chok Kong Vui | Hong Leong Bank | 28950570211 | - | 15 January 2022 10:22 AM |
| - | Wong Chung Shun | CIMB Bank | 7638651519 | - | 15 January 2022 9:23 PM |
| C08 | Nur Hidayah binti Hamzah | CIMB Bank | 7063290012 | 16 January 2022 3:31 PM | |
| C09 | Arif bin Musa | CIMB Bank | 7616518991 | 16 January 2022 7:20 PM |
Singapore
| Name | Bank | Account number | PayNow | Sent on |
|---|---|---|---|---|
| Unknown | United Overseas Bank (UOB) | 3873876385 | - | 22 December 2021 7:53 PM |
| Ang Khay How | United Overseas Bank (UOB) | 3793288504 | 80103847 | 23 December 2021 11:15 AM |
| Elizabeth Tan Jing Yi | OCBC Bank | 526490727001 | 88036573 | 28 December 2021 4:47 PM |
| Syara Sim Wei Ling | OCBC Bank | 687745810001 | 89286453 | 29 December 2021 10:06 AM |
| Unknown | United Overseas Bank (UOB) | 4303743388 | - | 30 December 2021 8:21 PM |
| Zeth Koh Tze Wei | OCBC Bank | 569499726001 | 89139674 | 2 January 2022 5:27 PM |
| Unknown | United Overseas Bank (UOB) | 7693032575 | - | 3 January 2022 8:07 PM |
| Unknown | United Overseas Bank (UOB) | 4343731668 | - | 8 January 2022 7:22 PM |
| Unknown | United Overseas Bank (UOB) | 3631026093 | - | 11 January 2022 11:55 AM |
| Muhammad bin Norjihan | United Overseas Bank (UOB) | 4303743841 | 89313584 | 11 January 2022 5:40 PM |
| Ivan Chong | United Overseas Bank (UOB) | 7693045669 | 88568240 | 12 January 2022 12:46 PM |
| Nur Hilmi bin Samsudin | OCBC Bank | 671880854001 | 89139845 | 13 January 2022 10:04 PM |
Tether (USDT / TRC20)
- TCrMk5HZo8MeT3ak1oFZAVMCRo8K52rhQf (owned by E group during UK/Australia scam, inactive)
- TJpntZrpFGWvVt8dvcN7ATBje8zivj9aW4 (owned by E group during UK/Australia scam, inactive)
- TNy2zxKTYeWjyMZteqDGQMTMLf5w2HMfy8 (owned by V group, still in use)
Footnote
To fellow Malaysians and especially victims affected by the scam, I’m sorry that it took me months before deciding to publish this leak. I have relied on making repeated attempts on sending these information to the authorities, in hopes of having them punished by the law, but did not succeed in doing so. Publishing this publicly is unfortunately the last resort. It is actually surprising that about tens of victims gets scammed per week from this one scam syndicate alone, but yet there is so little news about it nor any awareness posts on social media. As much as I understand the pain that a victim may go through after being scammed, I would still encourage that they post about their story to avoid more victims from falling into the same trap. Any victim who has talked about their experience should not be bantered, as much as you think greed may be the reason this scam is so successful, you do not know what has one been through before they took the steps they decided to take. They are a hero for sharing their story, and there’s no saying how much potential victims they might’ve saved.
I have intercepted and talked with multiple victims throughout this ordeal, some which had unfortunately got scammed thousands, expressed their unwillingness to contact the authorities as they believe it is a waste of time and wouldn’t help. It is sad to see this scenario occurring, and I believe it is only right if the police could set up anonymous tipping platforms (that does not require to use of WhatsApp, unlike the existing contact methods). Banks should also be doing the same in that accounts can be reported prior to receiving police reports, as long as sufficient proof is provided, in order to terminate an account right there and then, stopping further deposits from being made.
It is also questionable how many Hong Leong Bank money mule accounts made up the list. It is worth speculating how much are they doing to stop money laundering on their service that it became the favourite bank for this scam syndicate.
Depending on the circumstances, I may leak some more evidence that was still left unorganised from my messy pile of data. If time permits, a full documentary video may also be made and released documenting all these information.
As for the scammers, 哥 来几台华人棺材车，好不？～ Wish you all filthy animals a terrible Chinese New Year.
