Illegal: Card cloning devices can be easily purchased from any online platform. — YAP CHEE HONG/The Star
PETALING JAYA: Federal police have warned that it is illegal to sell or own devices that can clone or hack cashless payment cards or access cards.
Bukit Aman Commercial Crime Investigation Department (CCID) director Comm Datuk Rusdi Mohd Isa said police are aware of special cloning and duplication devices being sold via online sources.
ALSO READ: Ways to protect cashless payment cards
The police, he said, will work with the relevant authorities, such as the Malaysian Communications and Multimedia Commission, and e-commerce platforms to clamp down on such activities.
“We view this seriously. The possession and use of electronic devices for committing fraud or cloning cards is an offence that can be investigated for cheating under Section 420 of the Penal Code, as well as for offences under the Computer Crimes Act 1997 and the Communications and Multimedia Act 1998.
“Although there are cases of card cloning, it is not widespread as any such unauthorised use can be detected in the operator’s system. Such activities are often carried out by organised syndicates.
“In any system, even if it is well-designed, there can still be weaknesses in oversight and the sale of the physical cards. It must be understood that no system is absolutely fool-proof, especially when users are not careful,” he told The Star.
ALSO READ: Man, wife held for using hacked contactless payment cards, 304 cards and RM400,000 seized
On Wednesday, a transport company director and his foreign wife were arrested for possession of hundreds of cloned payment cards, and exposed a wider trail of individuals who owned similar forged cards to dodge tolls.
Negri Sembilan police chief Deputy Comm Datuk Alzafny Ahmad said that based on information from the operator, the use of cloned cards by others was also detected at other locations.
He said cloned card use can be detected by the company and the users can be traced.
“The main suspect who sold the cloned cards to the couple is still at large, but has been identified. Efforts to trace his whereabouts and bring him to book are ongoing.
“The case was exposed after the operator lodged a police report on finding transactional discrepancies. Our advice to the public is to refrain from using such fake cards. Top up credit in your account through legal channels,” DCP Alzafny told The Star.
He warned that those caught in possession of such devices could face action for forgery under Section 474 of the Penal Code.
ALSO READ: Transport firm director held over hacked Touch ‘n Go cards
On Wednesday, Negri Sembilan police arrested the 43-year-old director and his 33-year-old Chinese national wife in an operation and seized 304 cards and RM400,000 in cash.
Investigations revealed that the couple had purchased the RM300-pre-loaded cards for RM150 to RM200 each.
The couple, who operate the Seremban-based transport company with a fleet of 160 lorries, had allegedly distributed the cards to their drivers to reduce the cost of using tolled highways.
As a result, the operator suffered losses exceeding RM60,000 in July and last month. Police also urged those with information on the sale and unauthorised top-up of credit by syndicates to contact the nearest police station.
Checks showed that devices for hacking, cloning and duplicating such payment card systems are being openly sold on e-merchant websites.
To safeguard their payment cards, the federal CCID advised users to avoid placing them in places where they can be easily scanned or their signals detected such as in an opened bag.
Users can also keep their cards in an anti-RFID wallet to prevent unauthorised data reading.
Police said users should regularly check transaction statements to spot unauthorised or suspicious activity.
Users should not share card details such as serial numbers or credit balance with third parties.
Buying “unlimited” or cheap payment cards sold on social media or e-commerce platforms should be avoided as these are likely to be fake or cloned.
Police also advised users not to store large sums on a single card to minimise losses in the event it is misused or hacked. Other cases of cloned cards have also been cracked by the police.
In 2016, Bukit Aman CCID busted a syndicate and arrested 14 people in several states for selling cloned cards for half the value of unauthorised credit. Losses amounting to RM2.2mil were reported.
The same year, a couple in their 40s was held in Kota Damansara for similar offences that caused the operator losses of RM20,000.
In 2017, another card-cloning syndicate was crippled in Penang with the arrest of five men and the seizure of 260 cloned cards with credit valued at RM200,000.
