Fake SARA RM300 SMS asks for your MyKad, OTP and card details

MyCERT warned on 11 November 2026 about SMS and WhatsApp messages saying an RM300 SARA payment has been credited to your MyKad. The link opens a fake claim site that asks for your MyKad number, an OTP and your card details. Real SARA payments need no link or login. Do not tap the link, and never type card details or an OTP on a page you reached from a message.

How the scam works

The message usually comes as two texts close together. The first says your RM300 SARA aid is ready and gives a link to sara[.]mykadc[.]com. The link is often split across lines or put in brackets so it looks less odd. The second text jumps straight to the page that collects your details.

The site is in Malay and copies the look of the real SARA pages. It shows a claim deadline of 31 December 2026 and warns that unclaimed aid will be cancelled, so people feel they must act quickly. You are asked to check eligibility with your MyKad number. Further steps ask for an OTP and your bank or card details.

MyCERT found the same scam system also runs fake Touch 'n Go and Maybank pages. The fake Touch 'n Go page offers card cashback of up to RM300 and asks for your card number, expiry date, CVV and name, then your email, password and the 6-digit OTP from your bank SMS. MyCERT says the scammers can see what victims type as they type it. It expects the same trick to come back under other names, such as other banks, LHDN or EPF.

What the real SARA payment is

MyCERT says the RM300 claim was already found false in January 2026. The real payment was a one-off RM100 for every Malaysian adult (18 and over), paid in February 2026. People who get SARA in 2026 receive it monthly, straight away, with nothing to apply for and no link to click. To check your status, type one of these addresses into the browser yourself: sara.gov.my, mykasih.com.my or bantuantunai.hasil.gov.my.

What to do

1. Do not tap the link, reply or forward the message. Report it, then delete it.
2. Check SARA only on the official sites above, typed in by hand, never through a link in an SMS or WhatsApp.
3. If you already typed in card details: call your bank at once on the number printed on the back of your card. Ask them to block and replace the card, and go through your online payments from about 21 October 2026. Then report to the National Scam Response Centre at 997.
4. If you typed in your email password or any other password: change it now, on every account that uses the same password, and watch for strange logins, top-ups or payments.
5. Keep the messages and the sender numbers as evidence, and report them to Cyber999 at cyber999@cybersecurity.my.
6. Share this with family and staff. Older parents and relatives who expect government aid are easy targets.

For business owners: warn your staff today, starting with anyone who holds or uses a company card. A staff member who types the company card into one of these pages to "verify" it hands it to the scammers. Remind them that no bank, e-wallet or government aid scheme asks for a CVV or an OTP through a link.

How SyncTech can help

This campaign arrives by SMS and WhatsApp, which no email filter can see. The same kind of fake bank and aid offers also come by email, and our spam-filtered email hosting stops many of those before they reach your team.

Source and credit

We are sharing this news from MyCERT (CyberSecurity Malaysia). This summary is written by Synctech in our own words.

• MA-1501.112026: MyCERT Advisory - SARA RM300 MyKad Phishing Campaign Harvesting Personal and Card Details, MyCERT, 11 November 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=d8710585-77d6-4593-986c-196415f41c88

Retrieved 11 November 2026. SARA, MyKad, Touch 'n Go, Maybank, LHDN and EPF are names of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.