Credit Card Fraud in Malaysia: What to Do in the First 24 Hours

If you spot a charge you did not make, the clock starts now: call your bank immediately to block the card, then dispute the transaction in writing. The faster you act, the stronger your legal position and the lower your out-of-pocket exposure under Bank Negara Malaysia (BNM) rules.

---

Why the first 24 hours matter

Malaysian banking regulations place the burden of proof on the bank, not you, when an unauthorised transaction is disputed. But that protection weakens if you delay reporting. BNM’s Credit Card Policy Document (revised 2019, still in effect as of 2026) caps your liability at RM250 for unauthorised card use, provided you report the loss or suspected fraud promptly and have not acted negligently or fraudulently yourself.

Delay signals inaction and gives the bank grounds to argue you failed to take reasonable steps to protect your card.

---

Step 1: Block the card (do this first, within minutes)

Do not wait to verify every suspicious charge before calling your bank. Blocking the card stops any further damage immediately.

Three ways to block in Malaysia:

Method	What to do
Bank hotline	Call the 24-hour fraud or lost-card line on the back of your card
Mobile banking app	Use the freeze or block card feature in the app (most major banks offer this)
Bank branch	Walk in during business hours with your MyKad

When you call: report the suspected fraud, ask for a report reference number, and ask whether a temporary block or permanent cancellation is more appropriate. You should not be charged a replacement fee for a fraud-related cancellation.

---

Step 2: Write down everything

Before you file anything formally, spend five minutes documenting:

• The date, time, and amount of each suspicious transaction
• The merchant name as it appears on the statement
• The last known location of your physical card (was it in your wallet? did you use it online recently?)
• Any SMS or email transaction alerts you received, with timestamps
• Whether you received any phishing calls, links, or OTPs recently

This becomes your evidence log. Screenshot your statement or transaction history before any adjustments are made.

---

Step 3: Dispute the transactions in writing

After blocking the card, contact your bank’s dispute or fraud team and file a formal written dispute. Most banks accept this by:

• Secure message through internet banking
• Email to the fraud or customer care team
• A physical dispute form at the branch

Under BNM’s Credit Card Policy Document, once you submit a written dispute your bank:

• Must not require you to pay the disputed amount while the investigation is ongoing
• Must not impose finance charges or late fees on the disputed amount during the investigation period
• Must acknowledge your dispute and begin investigating promptly

The standard investigation window runs from 14 working days up to 180 days for complex cross-border cases. Straightforward domestic fraud cases are typically resolved faster.

Keep copies of everything you submit: the dispute form, any supporting screenshots, and all bank correspondence.

---

Step 4: Lodge a police report

A police report is not just a formality; it creates an official record that supports your dispute and may be required by your bank before they can proceed.

Two ways to file in Malaysia:

1. Online via PDRM e-Report: Visit ereporting.rmp.gov.my to lodge a report without going to a station. Suitable for straightforward fraud cases.
2. In person at the nearest police station: Recommended if the fraud involves a large amount, identity theft, or a compromised device.

For financial crime specifically, Malaysia’s Commercial Crime Investigation Department (CCID) at ccid.rmp.gov.my handles credit card fraud, online scams, and related offences. You can also verify whether an account or phone number involved in the fraud has been flagged by using the CCID Semak Mule portal.

When filing the report, include:

• Your IC number and contact details
• The card number (last four digits is sufficient; never write the full number)
• A list of the fraudulent transactions (date, amount, merchant)
• A brief narrative of when you discovered the fraud

Obtain a Salinan Laporan Polis (copy of the police report). Submit this copy to your bank as part of the dispute file.

---

Your liability: the RM250 rule explained

BNM’s Credit Card Policy Document sets a clear hierarchy of liability:

Scenario	Your maximum liability
Card lost or stolen, reported promptly, no negligence on your part	RM250
Card used without your knowledge (e.g., card cloning, online fraud), reported promptly	RM250
You shared your PIN, OTP, or card details with the fraudster	Potentially full amount (bank can argue negligence)
You acted fraudulently	Full amount, plus criminal liability

The RM250 cap applies per incident, not per transaction. If a fraudster makes ten transactions before you block the card, your total exposure is still capped at RM250, assuming you reported promptly and did not contribute to the breach.

The bank carries the burden of proving you acted negligently or fraudulently. If the bank tries to hold you liable for more than RM250 without proving negligence, you have grounds to escalate.

---

Step 5: Escalate if the bank drags its feet

If the bank rejects your dispute or fails to resolve it within the stated investigation window, escalate in this order:

1. Bank’s internal escalation: Write to the bank’s Head of Compliance, referencing your dispute number and timeline.
2. BNM BNMLINK: Call 1-300-88-5465 or email bnmtelelink@bnm.gov.my. BNM does not adjudicate disputes directly but can press banks to honour their policy obligations.
3. Financial Markets Ombudsman Service (FMOS): File at fmos.org.my. Decisions are binding on the bank up to RM250,000 and free to file.

Exhaust the bank’s internal process first. Allow at least 14 working days before escalating to FMOS.

---

Preventing it from happening again

Once the immediate crisis is handled, take these steps to reduce future risk:

• Enrol in transaction alerts: Every transaction above RM1 should trigger an SMS or push notification. Check your bank app settings.
• Set a lower overseas transaction limit: If you rarely travel, set your card’s overseas limit to RM0 in the app and re-enable it only when you travel.
• Enable 3D Secure: Verified by Visa or Mastercard Identity Check adds an OTP step for online purchases. Confirm with your bank that it is active.
• Never share OTPs: No legitimate bank or government agency will call and ask for your OTP. Hang up immediately.
• Check your CCRIS report: If your card details were compromised, pull a free CCRIS report via BNM LINK to verify no new credit was opened in your name.

For a full guide on how chargebacks work after the immediate fraud response, see How to Dispute a Credit Card Transaction in Malaysia.

If you are worried your card debt has grown due to a fraudster running up balances, learn how credit card finance charges work in Malaysia and how to manage them while a dispute is pending.

---

Key takeaways

• Call your bank and block the card the moment you spot any suspicious transaction. Do not wait.
• Your maximum liability under BNM rules is RM250, provided you report promptly and did not act negligently or share your OTP/PIN.
• File a written dispute immediately. The bank cannot charge you interest on disputed amounts while investigating.
• Lodge a police report via PDRM e-Report or at the nearest station. Give a copy to the bank.
• If the bank rejects your dispute unfairly, escalate to FMOS. Decisions are binding and free to file.
• Add transaction alerts and a low overseas limit to your card after the dust settles.

---

Frequently asked questions

How quickly do I need to report credit card fraud in Malaysia?

Report it as soon as you discover it. BNM’s policy requires reporting within a “reasonable time” of discovery. There is no fixed statutory deadline for the initial block, but delay weakens your case. For the formal written dispute, most banks require you to file within 30 to 60 days of the statement date. Check your cardholder agreement for the exact window.

Will I get my money back if my credit card is used fraudulently?

In most cases, yes. If you report promptly and did not contribute to the breach, the bank credits the disputed amount back once the investigation confirms the transaction was unauthorised. Straightforward cases typically resolve in 14 to 45 working days.

Do I need a police report to dispute a credit card transaction?

A police report is not always mandatory to initiate a dispute, but most banks will request one before completing the investigation, especially for larger amounts. It also protects you legally by creating an official record of the crime.

What if the fraudster made purchases overseas?

International fraudulent transactions are still covered under BNM’s RM250 liability cap, but the investigation can take longer because the card network (Visa or Mastercard) must coordinate with the overseas merchant’s bank. Investigations for international cases can run up to 180 days.

Can the bank close my account after a fraud incident?

Banks do not routinely close accounts when the fraud was not your fault. They cancel the compromised card and issue a replacement. If the bank suspects your involvement, it may freeze the account pending investigation, but this is rare for genuine victims who report promptly.