MyCERT warns fake "BNM Mobile Security" Android app relays contactless bank cards for fraud
MyCERT warns that a fake BNM Mobile Security Android app can relay contactless bank cards for fraud. The advisory is dated 4 November 2026; Bank Negara Malaysia does not endorse the app.
- First reported
- Reports
- 1
Source: theledger.asia · published
What happened
On 5 November 2026 The Ledger Asia reported that the Malaysia Computer Emergency Response Team (MyCERT) had warned about a fraudulent Android application called BNM Mobile Security. MyCERT's advisory, dated 4 November 2026, says the application impersonates Bank Negara Malaysia but is not distributed or endorsed by the central bank, and that it can relay contactless bank cards for unauthorised payments and cash withdrawals.
How the scam works
According to The Ledger Asia's account of the advisory, the scam combines institutional impersonation with misuse of a customer's physical card through a card-relay attack, rather than a confirmed intrusion into banks' core systems. The advisory as reported does not provide a victim count or aggregate loss figure. In a typical relay pattern, malware or a malicious app on a phone near a victim's contactless card captures and forwards card data so that criminals can present the card elsewhere for payments or ATM withdrawals.
Bank Negara Malaysia does not distribute a BNM Mobile Security app through unofficial links. Anyone who installed such an app should remove it, stop using contactless with cards that may have been near the phone, contact their bank to watch for unauthorised transactions, and report the matter to MyCERT and the police. Install banking-related apps only from official stores and bank channels. These details come from The Ledger Asia's report of the MyCERT advisory; scammers.com has summarised them and not independently verified the app sample.
Source
The Ledger Asia report of MyCERT advisory on fake BNM Mobile Security Android app, article 5 November 2026, advisory dated 4 November 2026. Not independently verified by scammers.com.
Red flags
- An Android app named BNM Mobile Security that is not from Bank Negara Malaysia.
- Requests to install a central-bank security app from a link or sideload.
- Unusual prompts related to NFC or contactless card reading.
- Unauthorised contactless payments or ATM withdrawals after installing an unknown app.
- Apps that ask for accessibility or device-admin rights for banking security.
If you were targeted
- 1Do not install BNM Mobile Security or any unofficial Bank Negara app.
- 2Remove the app if installed and contact your bank about contactless fraud monitoring.
- 3Keep install unknown apps switched off; use official app stores only.
- 4Report the app to MyCERT and the police.
- 5Watch statements for unauthorised payments.