Online Banking Fraud in Malaysia: What Evidence You Need to Get Your Money Back

Discovering that money has been taken from your Malaysian bank account without your authorisation is one of the most distressing experiences a person can face. The immediate instinct is to call the bank. That is the right first step — but it is not sufficient on its own.

Malaysian banks operate under Bank Negara Malaysia's guidelines on unauthorised transactions, but they are not obligated to refund victims automatically. The outcome of your claim depends almost entirely on the quality of evidence you provide and how quickly you act.

Here is what you need.

Bank Negara Malaysia's guidelines require banks to investigate fraud claims, but the practical reality is that the faster you act, the better your chances. Two critical windows:

• Within 24 hours: Some banks can initiate a recall on DuitNow or IBG transfers if the receiving account has not yet been emptied
• Within 48 hours: The strongest window for preserving digital evidence before it degrades or is deleted

After 48 hours, the attacker has typically moved funds through multiple accounts (a technique called "layering"), making recovery exponentially harder.

Banks need to understand the attack vector to assess liability. The most common methods in Malaysia:

Phishing: You clicked a link that directed you to a fake banking portal (mimicking Maybank2u, CIMB Clicks, RHB Now, etc.) and entered your credentials. The fake site harvested your username, password, and TAC code.

SIM Swap: The attacker convinced your mobile carrier to transfer your phone number to a new SIM card, intercepting your TAC codes.

Malware: A malicious app installed on your phone captured your banking credentials and TAC codes in real time. If you suspect this was the attack vector, a phone hack investigation can identify the malware, establish when it was installed, and document how it operated.

Social Engineering: Someone convinced you to share your TAC code directly, often by impersonating bank staff.

Evidence to preserve for each:

• Phishing: The URL you visited, screenshots of the fake portal, the SMS or email that directed you there
• SIM Swap: Your call log showing loss of service, your carrier's records, the attacker's fraudulent request to your carrier
• Malware: The app that was installed, when it was installed, and its permissions
• Social Engineering: The call log, any recorded conversation, WhatsApp messages from the impersonator

Preserve complete records of:

• Every unauthorised transaction: date, time, amount, recipient account number
• Your account statement for the 30 days preceding the fraud (to establish normal usage patterns)
• Any TAC codes you received (even if you did not initiate the transaction — this is important)
• Any login notifications or security alerts from your bank

Banks assess whether you acted promptly and responsibly. Document:

• The exact time you discovered the fraud
• The exact time you called your bank's fraud hotline
• The name and employee ID of every bank representative you spoke to
• The reference number for your fraud report
• Every subsequent communication with the bank

If your bank does not resolve your claim satisfactorily, escalate to Bank Negara Malaysia's BNMTELELINK:

• Phone: +603-2174 1717
• Email: [email protected]
• Online: bnm.gov.my/consumer-complaints

BNM has the authority to direct banks to refund victims where the bank's security measures were inadequate or where the bank failed to follow its own procedures.

A police report is not optional — it is required for most bank fraud claims and for any civil proceedings. File at your nearest PDRM station or via the CCID Scam Response Centre at +603-2610 1559.

The report must include: the transaction details, the attack method, and all evidence you have preserved. A vague report ("money was taken from my account") is significantly less useful than a detailed one with specific evidence attached.

Bank fraud claims are frequently denied on the basis that the victim "authorised" the transaction — even when the authorisation was obtained through deception or malware. Overturning this determination requires demonstrating that:

1. Your device was compromised without your knowledge
2. The TAC code was intercepted rather than voluntarily shared
3. The attack followed a documented pattern inconsistent with your normal behaviour

A professional forensic investigation produces exactly this documentation — device analysis, malware identification, attack timeline reconstruction, and a report that meets the evidentiary standards required by BNM's dispute resolution process and Malaysian courts.

The difference between a denied claim and a successful recovery is often the quality of the forensic evidence presented. Act within 48 hours.