How to protect yourself from identity theft in Malaysia — and what to do if it happens

Identity theft is when someone uses your personal details — your name, MyKad number, or bank and card details — to take out credit, register a phone line or move money in your name. You can't make it impossible, but a few free checks make it much harder, and knowing who to call first makes it faster to fix.

Free steps that make identity theft harder

• Check your CCRIS report. It lists your loans, credit cards and credit applications from the past 12 months, and Bank Negara Malaysia says it's currently free through eCCRIS, with no limit on how often you check. Register online at eccris.bnm.gov.my with your MyKad and internet banking, or at a CCRIS kiosk in an AKPK office.
• Check the credit reporting agencies too. CTOS, Credit Bureau Malaysia and Experian may charge for their reports; you can't delete your record with them, but the Ministry of Finance's registrar advises checking each one regularly.
• Check which mobile numbers are registered to your MyKad. Since 1 December 2025, telco apps have been adding MyDigital ID's MyIDVerify, which shows the prepaid numbers under your MyKad so you can 'whitelist' the ones that are yours. You'll need an active MyDigital ID certificate, and the rollout varies by telco.
• Never rent out or lend your bank account — JanganKenaScam warns the request can come even from family and friends. BNM reports 969 convictions against mule account holders in 2025.
• Check before you pay a stranger. The police's Semak Mule portal (semakmule.rmp.gov.my) checks bank accounts, phone numbers and company names against police reports, though the site disclaims responsibility for losses from relying on it.

Is there a credit freeze in Malaysia?

No. There's no credit freeze or fraud alert in Malaysia, and none of the official pages we checked describes one. The closest tools: credit reporting agencies need your consent before disclosing your credit report, under the Credit Reporting Agencies Act 2010; your bank's kill switch, which BNM says cardholders can now use to block a card instantly; and whitelisting your numbers through MyDigital ID. If you dispute a loan on your CCRIS report, BNM can tag the report 'Special Name' while the dispute is pending, so lenders must request it from BNM itself. None of these blocks new applications outright, so keep checking.

Warning signs of identity theft

• A loan, credit card or application on your CCRIS report that you don't recognise.
• Prepaid numbers on your MyKad that aren't yours.
• A credit card you never applied for. BNM's rules say an issuer may not activate an unsolicited card until you accept it, and you aren't liable for charges on it before then.
• A notice that your bank account's mobile number has changed or a new device has been linked. In one Financial Markets Ombudsman Service (FMOS) case, a fraudster passed a bank call centre's weak checks, changed the number and bound a new phone to the account.
• Transaction alerts for payments you didn't make.

If your identity is misused: what to do first

1. If money is at risk or you've shared banking details, call your bank's 24/7 hotline or the National Scam Response Centre (NSRC) on 997 straight away — within 24 hours, MyGOV says, so the authorities can try to block the accounts involved. The line is open 24 hours a day and has been run by the police's Commercial Crime Investigation Department since July 2025.
2. Lodge a police report. JPN and the Immigration Department ask for one when a stolen MyKad or passport is replaced, and banks must advise you to make one for e-banking fraud.
3. If you only revealed personal details, change your passwords and warn your bank, as JanganKenaScam advises.
4. Check your CCRIS report and ask for wrong personal details to be verified through eCCRIS. Its dispute channel for accounts is temporarily unavailable, BNM says, so contact the lender directly about any account or application you don't recognise; it may take up to 14 working days to respond.
5. Replace a lost or stolen MyKad immediately, as the National Registration Regulations require: at any JPN counter, or online through the MyKad Replacement System if your photo and particulars don't change. You need a police report if it was lost through crime, or through negligence for the second time or more. A fee applies and rises with each repeat loss; JPN lists the amounts.
6. For a lost or stolen passport, apply at any Immigration office with a police report and your MyKad. Approval is at the Director-General of Immigration's discretion, with the outcome within five working days. Abroad, report the loss immediately to the nearest Malaysian embassy or high commission. The replacement fee rises with each loss.
7. If a company misused your personal data, complain to the Personal Data Protection Department (JPDP) at daftar.pdp.gov.my. The Personal Data Protection Act covers commercial dealings, not federal or state government.

If a bank or credit agency won't fix it

Complain to the bank's or card issuer's Complaints Unit first — BNM won't take a complaint that hasn't been through it. If there's no response within 14 calendar days, or you're unhappy with the answer, contact BNMLINK on 1-300-88-5465 (Monday to Friday, 9am–5pm). If you're unhappy with the bank's final decision on an unauthorised transaction, you can take it to FMOS, a free ombudsman service. Complaints about a credit reporting agency, such as disclosing your report without consent, go to the Ministry of Finance's Registrar of Credit Reporting Agencies (PPK).

Can security software or a paid service help?

Partly. Details are often stolen through phishing links and malicious apps, such as the APK 'wedding invitations' JanganKenaScam describes, which ask for permission to monitor your phone. BNM's e-banking fraud rules expect you to avoid APK files from untrusted sources, keep anti-virus and anti-malware up to date as your bank advises, and install banking apps only from a trusted app store — security software is a useful safety net there.

None of the official Malaysian sources we checked assesses paid identity-protection services, and the checks above don't need one. No service can replace your MyKad, dispute a loan or call your bank for you — identity theft is mostly prevented and fixed by the steps above.

There's no credit freeze in Malaysia, so check for yourself: your free CCRIS report, the numbers on your MyKad and your bank alerts. If money is at risk, call your bank or 997 first.