A payment scam can combine a persuasive caller, a copied website and an application that asks for excessive permissions. This independent guide focuses on defensive actions for Malaysian consumers, using BNM and MyCERT sources checked on 23 October 2026. It explains when to stop, how to preserve evidence and why no recovery service can promise the return of funds.
Recognise the requested action behind the story
A caller may describe a refund, parcel problem or account restriction, but the important question is what they want you to do. Requests to reveal a password, disclose an OTP, approve an unexpected transaction or install software deserve immediate scrutiny. BNM warns that unsolicited messages can impersonate trusted institutions and seek banking information. Do not use the caller’s supplied number to verify the caller. End the conversation and open the genuine provider’s application or independently obtained contact channel before taking any account action.
Understand the documented Android threat
MyCERT’s advisory dated 6 June 2026 describes banking malware distributed through courier, job-seeker and app-store lures. The documented consequences include credential theft through fake overlays and interception of OTP or TAC messages. The defensive lesson is practical: do not install an APK sent by an unknown contact to complete a routine delivery, refund or purchase. A convincing service name is not evidence that an application is safe. Review where an installation came from and stop if a task suddenly requires permissions unrelated to its ordinary purpose.
Do not confuse authentication with informed consent
A security code or approval inside your banking application can authorise a real action even when the surrounding story is false. Read the recipient and amount on the actual approval screen. Do not approve a transfer to “protect” money merely because a stranger claims the current account is compromised. If the account might be exposed, contact the bank through its own security process. A legitimate recovery instruction should be verified independently, and a person claiming urgency should not control the device while you inspect financial accounts.
Check QR payments and changed bank details
Before confirming a QR payment, compare the resolved recipient with the business you intended to pay. A substituted sticker or compromised invoice can direct money to a valid but unintended account. PayNet’s consumer fee guidance explains the payment-cost layer; it does not certify every seller who displays a code. Verify changed bank instructions through a previously known contact. A small test payment can check addressing when the real recipient confirms it, but it cannot establish that a new seller will deliver or that a refund story is legitimate.
Act promptly after a suspected loss
BNM’s scam guidance directs victims to contact their bank’s scam hotline or NSRC 997 and lodge a police report. Do not delay notification while negotiating with the suspected scammer. Use another trusted device if the current one may contain malicious software. Explain the transaction reference, timing, amount, recipient and what credentials or permissions were exposed. Preserve messages and installation details privately for investigation. Contact your bank directly if another line is unavailable. This guide does not promise recovery, and it avoids publishing conflicting opening-hour information from older and newer official pages.
Recover safely and avoid a second scam
An unsolicited “recovery specialist” may ask for another payment, a seed phrase, a banking password or remote access. Do not provide these. Continue through the genuine institution’s case channel and record each reference. If the provider’s handling remains disputed, first obtain its written response and check the FMOS eligibility and timing rules. That is a formal dispute route, not an instant refund tool. Review account limits, recovery contacts and recent activity after control is restored. A public warning should describe the pattern while protecting your identity documents and other people’s account details.
Comparison and scope
| Warning sign | Possible risk | Safer response |
|---|---|---|
| APK required for a routine service | Malicious application or credential overlay | Stop installation; use official provider channel. |
| OTP requested by caller | Account access or transaction authorisation | Do not disclose; verify independently. |
| New recipient for an existing invoice | Payment redirection | Confirm through a previously trusted contact. |
| Fee demanded to recover stolen funds | Secondary recovery fraud | Use bank, police and eligible formal dispute process. |
Practical checklist
- Pause before installing software or approving an unexpected request.
- Read the amount and beneficiary in the genuine application.
- Keep passwords, OTPs and recovery secrets private.
- After exposure, contact the bank promptly from a trusted device.
- Preserve transaction and communication evidence without posting it publicly.
- Reject promises of guaranteed recovery in exchange for another payment.
Frequently asked questions
Does an OTP prove the caller is legitimate?
No. The code may authorise your own account action. A caller asking you to disclose it can still be an impersonator.
Should I keep using a phone after installing a suspicious APK?
Avoid using it for sensitive account actions until the incident is assessed. Contact the provider from a trusted device and follow its security guidance.
Can NSRC or a police report guarantee reimbursement?
No guarantee is made here. Prompt reporting supports investigation and response, but recovery depends on the actual transaction and circumstances.
Sources and verification
- Impersonation and banking information warning — Bank Negara Malaysia — 2026-10-23
- MA-1451.062026: Android banking trojan campaign — MyCERT — 2026-10-23
- DuitNow QR consumer and merchant fees — PayNet — 2026-10-23
- Financial scam response FAQ — Bank Negara Malaysia — 2026-10-23
- FMOS complaint filing guide, 24 March 2026 — Financial Markets Ombudsman Service — 2026-10-23