Credit and debit card fraud in Malaysia: what to do if your card is misused — and who pays

Card fraud rarely needs your physical card. Most unauthorised-transaction disputes the Financial Markets Ombudsman Service (FMOS) handled in 2025 followed a phone scam or a phishing message carrying a malicious link or app. Card-based payment disputes were its largest category, rising from 1,317 cases in 2024 to 1,953 in 2025, its Annual Report 2025 says.

How card details get stolen

• Phishing. In one FMOS case, a fake streaming-service email led a cardholder to a payment page; the card details and SMS OTPs she entered were used to add her card to a mobile wallet on another device.
• Malicious apps. In another case, 11 online transactions totalling RM47,410 hit a credit card the day its holder installed an app advertised on Instagram, which FMOS found had compromised her banking credentials.
• Lost or stolen cards, especially abroad — FMOS saw cards stolen in Malaysia used in shops abroad within the same hour.
• Impersonation calls. A caller posing as your bank or Bank Negara Malaysia asks you to 'confirm' a transaction or read out the code on the back of your card; BNM says its officers never call for card or banking details.

If your card is misused: first steps

1. Freeze the card. BNM says cardholders can now use a 'kill switch' in their bank's app to block a card instantly; it becomes mandatory for debit cards on 1 January 2027.
2. Call the issuer on the number on the back of the card — issuers must keep a dedicated hotline open at all times.
3. Dispute every transaction you don't recognise. Within three working days the issuer must acknowledge it and tell you what it needs, such as each transaction's date and amount and why you dispute it.
4. On a credit card, don't pay the disputed amount: the issuer can't require it, or charge interest or fees on it, while it investigates.
5. Lodge a police report and keep every message, statement and letter, as BNM advises fraud victims.
6. If you also transferred money to a scammer, call the National Scam Response Centre on 997 within 24 hours, as MyGOV advises, and your bank's scam hotline.

Who pays? What Bank Negara Malaysia's rules say

BNM's credit and debit card policy documents of 19 December 2025, which replaced the 2019 credit card and 2016 debit card rules, apply the same liability tests to both.

An OTP you entered isn't proof on its own: the issuer can't rely solely on a transaction being authenticated to decide you authorised it. And if a debit card investigation runs beyond 14 working days, the issuer must offer provisional credit up to RM5,000, free of interest and fees, and credit the rest within 30 working days of your dispute if it hasn't finished — repayable if you're found liable.

Losses are often shared in practice. FMOS split the loss in the malicious-app case because the bank missed a burst of unusual transactions. But it left RM24,954.83 with a traveller who left his card in a bag in an aircraft's overhead compartment and reported it late, though interest and late charges were waived, and held the phishing victim fully liable for giving her OTPs to the fake site.

Payments you approved yourself in a scam

BNM's rules protect you against unauthorised transactions — ones made without your knowledge. A payment a scammer talks you into making or approving yourself, as in love, investment or parcel scams, isn't one, and BNM's compensation framework covers unauthorised transactions only. Yet about 95% of online fraud cases in Malaysia are authorised transactions, BNM's Annual Report 2025 says; BNM is assessing whether widening the framework's scope would help protect vulnerable consumers. Until then, speed matters most: call 997 and your bank at once so the money can be traced and blocked.

If the bank rejects your claim

The issuer must explain its decision in writing and point you to FMOS, which replaced the Ombudsman for Financial Services in January 2025. You can file within six months of the bank's final decision, or if it hasn't responded within 60 days. FMOS is free and covers unauthorised card, ATM, internet banking and e-money transactions with direct losses up to RM250,000. A case manager first tries to settle the dispute; if that fails, either side can take it to an Ombudsman, and a decision you accept binds the bank. File at fmos.org.my or call +603-2272 2811.

How to make your card a harder target

• Switch off online (card-not-present) payments in your bank's app when you don't need them.
• Lower your contactless limit or turn contactless off; issuers must offer a simple way to do both.
• Keep transaction alerts on and report any you don't recognise immediately. Under BNM's rules, genuine transaction alerts don't contain links.
• Never share your PIN, card details or OTP, and don't base your PIN on your birth date, IC, passport or phone number.
• Install apps only from official app stores, never from APK files sent in chats.
• Travelling? Keep the card on you and make sure your bank's alerts reach you abroad — the cardholder in the FMOS aircraft case missed them because roaming was off.

Can security software help?

Only with part of it. No app stops a pickpocket, and your bank's controls and fast reporting do most of the work. Security software helps against the malicious apps and phishing links behind many FMOS disputes, and BNM's e-banking fraud rules list keeping anti-virus and anti-malware up to date, as your bank advises, among the ways to keep your device secure.

Freeze first, call second, dispute in writing third. And never type an OTP into a page you reached from a link.