Browser
If you are a first-time user who is logging in to the Public Mutual Online (PMO) website through a browser, you are advised to enter and key in the URL manually (https://www.publicmutualonline.com.my) to ensure that you are redirected to the official website.

Always clear your browser’s cache as it may store your account number and other sensitive information on computers or devices you have used.

Site Authentication
Observe the lock icon next to the browser’s address bar and ensure that the certificate is for https://www.publicmutualonline.com.my.

Credentials
Always keep your login credentials and passwords confidential.

PAC
You should never reveal your Personal Authentication Code (PAC) to anyone who asks or requests it, regardless of the communication channel.

Devices
Do not use unsecured mobile devices (e.g. devices that have been jailbroken or run on a rooted Operating System (OS)) to prevent your account from being tampered with or compromised.

SecureSign
Read carefully before approving any transactions or service requests via SecureSign.

Cybercriminals could use programs that mine public profiles for potential password combinations and use dictionary attacks that automatically try different words until they find a match on your password.

Malicious software (Malware) is a program or file that is harmful to a computer system. It can originate from unsolicited or undetected sources, potentially installing itself on your computer or phone.

Malware is often disguised as a legitimate file download, typically through attachments or links shared from an unknown email source and/or a website that you visited.

Malware can steal your information and scammers will use the information obtained to steal money from your account and/or commit identity theft.

When a device becomes infected with malware, you may experience unauthorised access, compromised data or being locked out from the device.

Email scams are generally delivered in the form of spam emails. However, some are tailored to look like legitimate messages. These scams are designed to trick you into disclosing information that could lead to defrauding or stealing your identity and/or performing malicious actions on your behalf.

These emails come with a link that direct users to a fake website designed to steal their user ID, password and One-Time Password (OTP).

Phone scams refer to phone calls/ SMS that trick victims into revealing their sensitive information (e.g. user account, password and PAC/OTP)

Investors should remain cautious when they come across advertisements on investment schemes promising high returns with minimal risk.

The scammer might seem perfectly legitimate, appearing knowledgeable about investment trends with positive testimonials and convincing marketing materials.

Be cautious if an investment opportunity is presented as exclusive or based on ‘inside’/ confidential information, especially if you are asked to make an upfront payment to a personal account due to the supposed time-sensitive nature of the offer.

The QR Code Scam is another form of phishing scam using QR (Quick Response) codes. Fraudsters may trick users into scanning fake QR codes, which redirect users to download a malware onto their devices.

For example, a victim might unknowingly scan a fake QR code displayed outside a merchant’s premises to download an app for making payments.

This malicious software mimics the interface of an official app, tricking the user into entering sensitive information such as login credentials. Once entered, the malware captures this personal data, giving scammers full access to the user’s account. This allows scammers to steal sensitive information and conduct unauthorised transactions, such as withdrawing money from the user’s account.