Every few weeks a Malaysian bank customer wakes up to a drained account and a set of transfers they never made. The first question is always the same: will the bank give the money back? Since 1 October 2024 there has been a written answer. Bank Negara Malaysia's policy document Ensuring Fair Treatment for Victims of Unauthorised e-Banking Transactions, which BNM itself shortens to SEFT, tells banks how to investigate, how fast to reply, and when the loss is theirs to carry.
*Image: Bank Negara Malaysia, Annual Report 2025 (Box 4, Diagram 1)*
This guide explains what SEFT actually requires, using the policy document (issued 28 June 2024) and BNM's own one-year review in its Annual Report 2025. It is a factual explainer, not legal advice for a specific case.
First, check whether your case is covered
SEFT applies only to an unauthorised transaction: a payment that you did not consent to, start or approve. Typical cases are an account takeover after you typed your login into a phishing site, or malware on your phone that approved transfers in the background.
It does not apply when you willingly made and approved the payment at the time, even if you were deceived. The policy names love scams, investment scams, parcel scams and simply paying the wrong account as outside its scope. BNM's report notes that about 95% of online fraud cases in Malaysia are authorised transactions, so most scam victims fall outside SEFT. For those cases, the first step is still calling 997 straight away so the money can be frozen; our 997 and NSRC guide covers that hour.
One detail matters a lot here. The policy says a bank cannot treat a transaction as authorised just because it passed authentication. A transfer approved by malware on your phone is not automatically "yours".
It covers licensed banks, licensed Islamic banks and prescribed development financial institutions. E-wallets are not named in the document.
The order the bank must look at things
Under paragraph 9.4, the bank must start with its own side: whether it reminded you of your duties, gave you a working way to report fraud, and whether its fraud detection should have caught a payment outside your normal pattern. BNM's example of a failure is not blocking a burst of transfers in a short time that does not match how you usually bank.
Paragraph 9.5 then lists situations where you cannot be held responsible at all, including:
- a breakdown or weakness in the bank's systems or security controls;
- forged, faulty or cancelled security devices or passcodes;
- transactions made before you received your passcode or device;
- fraud or negligence by the bank's own staff or agents;
- any transaction after you told the bank about the breach;
- contradictory evidence the bank failed to resolve.
When you carry some or all of the loss
The bank can only put the loss on you if it proves one of three things (paragraph 9.6): you acted fraudulently, you refused to cooperate with the investigation, or you broke a duty the bank had told you about. Those duties are not to disclose your login ID or passcodes (TAC, PIN or device codes) to anyone, to keep your security device safe, and to report a breach or a lost device as soon as you know. BNM's footnote gives examples of careless device security: clicking dubious links, installing APK files from untrusted sources, and skipping security updates.
Even then, paragraph 9.7 says you must not bear the full loss if the bank had the capacity to stop further unauthorised transfers and did not. BNM summarises the outcomes in three bands:
- Full compensation when the loss was caused solely by gaps in the bank's controls.
- Partial compensation when you share some fault and the bank did not act fast to stop further losses after the first fraud attempt.
- No compensation when the bank did everything required and you are solely at fault, or you refuse to cooperate.
Any decision that puts losses on you must pass an independent review inside the bank before you are told, and the bank must keep the evidence for seven years.
The deadlines that protect you
- Report immediately. Use the bank's 24-hour fraud hotline, which it must display on its website and app. Anything taken after you report cannot be charged to you.
- Within 3 working days the bank must tell you what information it needs. At minimum that is your name, IC or passport number, the account, the date and amount of each disputed transaction, and why you dispute it. Industry practice is to acknowledge within 24 hours.
- Make a police report. The bank must advise you to, and you need a copy for provisional credit.
- After 14 working days, if the investigation is still running, the bank must immediately offer provisional credit of the full disputed amount or RM5,000 per case, whichever is lower. It carries no interest, fees or charges, and you can spend it.
- By 30 working days, if there is still no decision, the bank must credit the rest of the disputed amount (with any interest or profit).
If you are later found liable, the bank can ask for the provisional credit back on a reasonable timeline. It may only report unpaid provisional credit to CCRIS six months after its final decision, and if you take the case to FMOS within those six months, not until FMOS decides. Our CCRIS and CTOS guide explains how to check what is on your record.
If the bank turns you down
The bank must give its decision in writing, with a brief assessment and the basis for any loss passed to you, and tell you about your complaint channels. Your next step is the Financial Markets Ombudsman Service (FMOS), which replaced the old OFS on 17 January 2025. It is free for consumers, handles financial disputes up to RM250,000, and you must file within six months of the bank's final decision, online at complaint.fmos.org.my or by calling 03-2272 2811.
What one year of SEFT has shown
BNM's Annual Report 2025 says the number of victims receiving full or partial compensation rose by about 26% in 2025 compared with 2024, and that banks are more consistently finishing investigations within the expected 14 days. It describes two banks that refunded every affected customer in full after investigations found fraudsters had bypassed one bank's cooling-off period and exploited the other's authentication weakness. Scam losses reported to PDRM reached RM2.8 billion in 2025.
The report also says what SEFT still lacks. Unlike Singapore and Thailand, Malaysia's framework involves only banks and customers, with no duty on telcos or platforms. BNM says there is "merit" in broadening it and that it is studying wider protection for vulnerable consumers. Nothing has been announced as of 15 October 2026.
Related reads
- Scammed? What to do in the first hour, and how the 997 line works
- How to check your CCRIS and CTOS reports
- Tribunal for Consumer Claims: who can file and how
*Sources: Bank Negara Malaysia, Policy Document BNM/RH/PD 028-139, Ensuring Fair Treatment for Victims of Unauthorised e-Banking Transactions (issued 28 June 2024, effective 1 October 2024), paragraphs 5.2, 8-11; BNM Annual Report 2025, Box 4, Fraud Resolution: Building Trust through Shared Accountability; BNM media release on the launch of FMOS (17 January 2025). Read on 15 October 2026.*
