Fake BNM Mobile Security App Scam Why Your Card Is at Risk
Malaysia’s fake BNM Mobile Security app scam puts your money at risk through a card tap. Learn how the trick works, the warning signs and what to do immediately.
Your bank card never leaves your hand. Your money can still leave your account.
In Malaysia, the fake BNM Mobile Security app scam uses a fraudulent Android app to collect personal details and card PINs, then relay a tapped bank card to criminals. MyCERT warned about the campaign on 4 November 2026.
Already installed it? Contact your bank immediately. For suspected financial fraud, call your bank’s scam hotline or NSRC on 997. Further steps are below.
How does the fake BNM app scam work?
Imagine you receive a call while getting on with your day. This is an illustration of MyCERT’s reported method, not a named customer’s experience.
Someone claiming to represent Bank Negara Malaysia or the police says your account is linked to money laundering. They offer a way to verify it.
Install an app. Enter your details. Provide your card PIN. Tap your card against your phone.
Taken together, those requests look alarming. Delivered one at a time by someone sounding official, they can become a checklist you follow to make the accusation go away.
The caller supplies both the panic and the solution. Convenient customer service, if you overlook the theft.
What does tapping your card actually do?
The app uses near-field communication, or NFC, to relay the card remotely. MyCERT says criminals can use this connection for fraudulent payments and ATM withdrawals.
Think of the phone as a bridge between your card and a criminal’s payment device. Entering your PIN gives them another tool.
Keeping the plastic does not mean keeping control.
BNM does not distribute this app. A familiar name on a screen is easy to borrow. Your trust should be harder to obtain.
Installed it already? Act now
Using another trusted device, call your bank through an independently verified number.
MyCERT advises immediately blocking all cards, changing PINs, removing the app and running a mobile security scan. Report the incident to Cyber999 at cyber999@cybersecurity.my.
Call your bank’s scam hotline or the National Scam Response Centre on 997 immediately for suspected financial fraud. Police confirmed on 5 November that 997 operates 24 hours daily. Lodge a police report promptly.
Even if more than 24 hours have passed, BNM says you should still report the incident to your bank.
Next time a caller demands your PIN or an unfamiliar app installation, end the call and verify independently.
For general information only, not personal financial, investment, tax or legal advice. Investments carry risk. Check information independently and seek qualified advice for your circumstances. Editorial policy and corrections.
Keep reading
Recommended Articles to read
Based on this article and the topics you have read in this browser.
