Bank Negara Malaysia has warned the public about scammers using fake websites and malicious applications that pass themselves off as the central bank to steal personal and banking information. The advisory was issued in a post on BNM’s X account on Friday, NST reported.
“A website may look official, but that doesn’t mean it’s genuine,” the central bank said. It told the public to check anything suspicious at bnm.gov.my/verify, its own verification page.
That page collects impersonation attempts BNM has flagged, Fintech News Malaysia wrote, among them deepfake advertisements featuring the Governor, emails and letters claiming to come from the central bank, and messages from people posing as its senior officers. BNM states on the page that it will never ask the public to transfer funds or disclose personal banking details for any investigation.
One campaign behind the alert has been named. MyCert, the Malaysia Computer Emergency Response Team that operates under Cybersecurity Malaysia, issued an advisory on a fake Android app called “BNM Mobile Security” hosted on a website impersonating the central bank, as The Star documented.
MyCert, in the advisory posted on Wednesday, said the scam is driven by phone calls in which fraudsters pose as BNM, the police or “anti-money laundering officers” and pressure victims into installing the app. The call claims the victim’s bank account is linked to money laundering.
The victim is then sent to the fake BNM site to download the app, which collects personal details, card balances, credit limits and PINs. The app then leads the victim to tap a bank card against the phone, letting the scammers capture the card information and relay it to another device for unauthorised contactless transactions or ATM withdrawals.
MyCert said the app hides its real functions behind a normal-looking interface. It uses the phone’s near field communication chip to read contactless cards and forwards the data to a scammer’s server over an encrypted connection.
“It reads contactless cards of all major schemes (MyDebit, Visa, Mastercard, American Express, JCB),” MyCert said. “Any Malaysian bank card the victim taps is at risk.”
The advisory named cards issued by Maybank, CIMB, Public Bank, RHB, Hong Leong Bank, AmBank, Bank Islam, BSN, Affin Bank, Alliance Bank and Bank Rakyat among those exposed. MyCert said the app does not single out one bank. It exploits the contactless payment function of the physical card instead.
“Bank Negara Malaysia does not run this campaign, and its official channels (bnm.gov.my) do not host or distribute a ‘BNM Mobile Security’ application,” MyCert said. It added that BNM and banks never ask for a card PIN.
The public has been told not to install BNM Mobile Security, or any application, at the request of someone who calls them. MyCert also advised never to tap a bank card against a phone when a caller or an application asks for it.
BNM’s advisory did not say how many cases have been reported, or whether any of the fake sites have been taken down.
