Fake ‘BNM Mobile Security’ App Tricks Malaysians Into Tapping Cards to Steal Data
Bank Negara Malaysia (BNM), the country’s central bank, has warned that scammers are copying its name and look through fake websites and malicious mobile apps to steal people’s personal and banking details. The alert follows a separate advisory from Malaysia’s national cyber emergency team about a fake Android app, “BNM Mobile Security”, that tricks victims into tapping their bank cards on their own phones so criminals can use the card data elsewhere.
Key facts
- BNM said on its X account that scammers are impersonating it with fake websites and malicious apps built to collect personal and banking information, and that a site can look official without being genuine.
- MyCERT, the computer emergency response team run by CyberSecurity Malaysia, published an advisory on 4 November about a trojan app called “BNM Mobile Security”, hosted on a website posing as BNM.
- The app collects personal details, card balances, credit limits and PINs, and uses the phone’s NFC (near-field communication, the short-range radio used for tap-to-pay) to read contactless cards and relay the data to the scammers’ server.
- MyCERT said the app can read MyDebit, Visa, Mastercard, American Express and JCB cards, and is not aimed at any single bank.
- BNM says it will never ask the public to transfer money or disclose banking details for any investigation, and asks people to check suspicious messages at bnm.gov.my/verify.
How the scam works
According to MyCERT, the scheme usually starts with a phone call. The caller pretends to be from BNM, the police or an “anti-money laundering” unit and tells the victim that their bank account has been linked to money laundering. To “clear” the account, the victim is sent to a fake BNM website and told to download the security app.
Once installed, the app shows a clean, official-looking screen while working in the background. It asks for card details and PINs, and then asks the victim to hold their contactless bank card against the back of the phone. The phone reads the card and passes the data, over an encrypted link, to the criminals, who can then make unauthorised contactless payments or ATM withdrawals.
This is known as an NFC relay attack. It is dangerous because the victim’s physical card never leaves their hands, so many people do not realise anything is wrong until money disappears. MyCERT listed customers of Maybank, CIMB, Public Bank, RHB, Hong Leong Bank, AmBank, Bank Islam, BSN, Affin Bank, Alliance Bank and Bank Rakyat among those at risk, and said other local card issuers could also be affected.
What it means for Malaysians
For consumers, the message is simple: BNM does not run investigations by phone and does not distribute apps through links. Its official site, bnm.gov.my, does not host the “BNM Mobile Security” app. Anyone who receives a call claiming their account is under investigation should hang up and contact their bank directly using the number on the back of their card.
- Never tap your card on a phone because a caller or an app tells you to. Contactless cards are meant to be tapped on a shop terminal, not on your own phone.
- Only install apps from official app stores, and be wary of any app that asks for your card PIN. BNM and banks never ask for it.
- Check before you trust. BNM’s verification page lists known impersonation attempts, including deepfake adverts using the Governor’s image, fake letters and emails, and people posing as its senior officers.
For banks, the case is a reminder that fraud is shifting from stealing passwords to abusing the phone’s own payment hardware. That puts more weight on real-time transaction monitoring, quick card blocking and customer education, especially as tap-to-pay keeps growing in shops and on public transport.
What to watch
- Whether banks add fresh warnings or extra checks for contactless and ATM transactions linked to newly installed apps.
- More advisories from MyCERT and BNM as scammers copy the same NFC relay method under new app names.
- How quickly the fake websites hosting the app are taken down, and whether similar apps appear using the names of banks or the police.
Related on FinDeskAsia: PayNet and the regulators: who runs Malaysia’s payment plumbing · How Malaysia’s payment system works
Sources: The Star (November 2026) · Fintech News Malaysia (November 2026) · Bank Negara Malaysia, Verify page (November 2026)
