Illustration of a phone approving an online card payment in an app instead of an SMS one-time password

BSN Drops SMS OTPs for Online Card Payments From 15 December, Moves to BSNSecure

November 11, 2026 FinDeskAsia

Bank Simpanan Nasional (BSN), Malaysia’s state-owned savings bank, will stop sending SMS one-time passwords (OTPs) to approve online card purchases from 15 December 2026. Instead, cardholders will confirm e-commerce payments inside the bank’s BSN eWallet app using BSNSecure, its multi-factor authentication feature. BSN says the switch is meant to tighten transaction security and protect customers from financial fraud.

Key facts

From 15 December 2026, BSN will replace SMS OTPs with BSNSecure for online (e-commerce) transactions made with its cards.
To keep shopping online with a BSN card, customers must download and register for the BSN eWallet app, which is where BSNSecure approvals for card payments will happen.
BSN eWallet is separate from the myBSN mobile banking app. myBSN uses BSNSecure to approve internet banking actions such as fund transfers, credit card payments and e-SSP purchases.
BSN says it already stopped SMS codes (TAC) for myBSN banking transactions on 1 July 2023; this move extends the change to online card payments.

AdvertisementYour brand ~~here~~Reach Malaysia’s fintech & payments decision-makersAdvertise →Your brand ~~here~~Put your payments or fintech brand beside every FinDeskAsia story.Get rates →

What is changing, in plain terms

Today, when a BSN cardholder buys something online, the merchant’s checkout page usually triggers a six-digit code sent by SMS, which the shopper types in to finish the payment. After 15 December, that code will no longer arrive by text. The approval request will go to the BSN eWallet app on the customer’s phone instead.

BSN describes BSNSecure as a feature that verifies the customer’s identity and makes sure only authorised transactions go through. Because the approval is tied to an app on a registered phone, rather than to a text message, it is much harder for a scammer to intercept or trick someone into handing it over.

BSN eWallet is a digital wallet for BSN card members. Besides approving online payments, it offers card management tools and rewards and promotions, and it is available on Android, iOS and Huawei phones. Customers should note that it is a different app from myBSN, which handles everyday banking such as checking balances, DuitNow transfers and paying card, financing and loan instalments.

What it means for Malaysians

For BSN cardholders, the practical step is simple: install and register BSN eWallet before 15 December. Anyone who skips this risks having online purchases stall at checkout once SMS codes stop. Older customers and those who share phones may need help from family or a branch to set up the app.

For merchants and SMEs selling online, the change should be invisible on their side, since the card-scheme checkout flow stays the same. But they may see a short spike in abandoned payments around the switchover if some BSN customers have not registered in time.

For the wider banking system, BSN is catching up with an industry-wide shift. In September 2022, after a wave of scams, Bank Negara Malaysia (BNM), the central bank, directed banks to adopt five key anti-fraud measures, the first of which was moving customers away from SMS OTPs to more secure forms of authentication. Most large banks have since moved approvals into their own apps. BSN, which serves many lower-income and rural savers, is now closing one of the last gaps for its card users.

SMS codes have been a favourite target for fraudsters because they can be phished through fake websites, read by malicious apps, or captured through SIM-swap tricks. App-based approval does not end scams, since criminals can still pressure people into approving payments themselves, but it removes an easy route for stealing codes.

What to watch

How smoothly BSN’s card customers move to the BSN eWallet app before the 15 December cut-off, especially those less comfortable with smartphones.
Whether BSN extends the eWallet to more features, or eventually merges card approvals into the myBSN app to reduce the need for two separate apps.
Further BNM moves on authentication, as scammers shift from stealing codes to tricking victims into approving payments themselves.

Related on FinDeskAsia: How Malaysia’s payment system works and PayNet and the regulators.

Sources: The Star (November 2026); Lumi News / WISER.MY (November 2026); BSN, BSNSecure page (November 2026); Association of Banks in Malaysia (September 2022).