Fake BNM Mobile Security app steals bank cards: what to do

MyCERT warned on 4 November 2026 about a live scam. Callers pretending to be Bank Negara Malaysia (BNM) or the police get victims to install an Android app called "BNM Mobile Security" and tap their bank cards on the phone. The app sends the cards to criminals. BNM has no such app: hang up, and never tap a card on a phone.

How the scam works

According to MyCERT, the call comes first. The caller says your bank account is linked to money laundering and that you must "verify" it with a BNM security app. You are sent to a fake website made to look like a BNM portal, and the app is installed from there, not from the Google Play Store.

The app then asks for your name, IC or passport number, phone and email. Next it shows a "security notice" asking for each card's balance, credit limit and 6-digit PIN. Last, it asks you to "pair" your cards by tapping them on the back of the phone. While you tap, the phone reads the card and passes it in real time to the criminal, who uses it for contactless payments or ATM withdrawals with your PIN. Messages such as "card not supported, try again" are there to get you to tap every card you own.

MyCERT says any contactless card can be hit: MyDebit, Visa, Mastercard, American Express and JCB, from any Malaysian bank.

Signs it is a scam

• A caller says they are from BNM, the police or a bank and tells you to install an app.
• An app or website asks for your card PIN, balance or credit limit. Banks and BNM never ask for these.
• An app asks you to tap your bank card on your phone.
• The app comes from a link or a website, not from Google Play.

What to do

1. Do not install any app a caller tells you to install. End the call and phone your bank on the number printed on the back of your card.
2. Never tap a bank card on your phone because someone on the phone or an app tells you to.
3. Install apps only from Google Play and keep Google Play Protect turned on.
4. If you already installed it: call your bank at once to block all your cards, change your card PINs, then uninstall "BNM Mobile Security" and run a security scan on the phone.
5. Report it to the National Scam Response Centre at 997, and to Cyber999 (cyber999@cybersecurity.my or 1-300-88-2999).
6. Share this with family and staff, especially older relatives, who are often the people these callers target.

How SyncTech can help

Many of these scams start with a phone call, but the same groups also send fake bank and government emails. Our spam-filtered business email catches many of those before they reach your staff. If you are not sure whether a message or app your team received is safe, ask our support team before you click.

Source and credit

We are sharing this news from MyCERT (CyberSecurity Malaysia). This summary is written by Synctech in our own words.

• MA-1495.112026: MyCERT Advisory - Fake "BNM Mobile Security" Android App Relays Bank Cards via NFC in a Banking Trojan, MyCERT, 4 November 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=5f7da6e7-8f9a-4d7c-986c-08a90c031dd3

Retrieved 4 November 2026. Bank Negara Malaysia, Google Play, MyDebit, Visa, Mastercard, American Express and JCB are trademarks or names of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.